John Lambert on Twitter: "If you are looking to study #PowerShell #malware for #DFIR a roundup follows"

Country	Code	For customers of
United States	40404	(any)
Canada	21212	(any)
United Kingdom	86444	Vodafone, Orange, 3, O2
Brazil	40404	Nextel, TIM
Haiti	40404	Digicel, Voila
Ireland	51210	Vodafone, O2
India	53000	Bharti Airtel, Videocon, Reliance
Indonesia	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italy	4880804	Wind
3424486444	Vodafone
» See SMS short codes for other countries

1. Show replies
1. John Lambert‏ @JohnLaTwC 23 Dec 2016
  Replying to @JohnLaTwC
  
  John Lambert Retweeted John Lambert
  
  1200 line obfuscated payload dropped by Word macro: https://twitter.com/JohnLaTwC/status/810154801673760769 …, http://pastebin.com/V1F1hRg7
  
  John Lambert added,
  
  John Lambert @JohnLaTwC
  
  1200 line obfuscated #PowerShell malware threat, dropped by Word Macro ENJOY INTERNETZ https://pastebin.com/V1F1hRg7 #DFIR pic.twitter.com/LaDT2bR14F
  
  9 retweets 17 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. John Lambert‏ @JohnLaTwC 23 Dec 2016
  Replying to @JohnLaTwC
  
  Some #PowerShell payloads I’ve seen in the wild: http://pastebin.com/juC4CkQG and http://pastebin.com/R75bqYkL
  
  5 retweets 15 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. John Lambert‏ @JohnLaTwC 23 Dec 2016
  Replying to @JohnLaTwC
  
  John Lambert Retweeted John Lambert
  
  #Powershell threat targeting Brazil: https://twitter.com/JohnLaTwC/status/793163947356532736 …, http://pastebin.com/KiWD1juJ
  
  John Lambert added,
  
  John Lambert @JohnLaTwC
  
  Interesting Brazilian threat that uses #PowerShell to download a payload and uninstall AVG. http://pastebin.com/KiWD1juJ pic.twitter.com/JMcZueeQ26
  
  3 retweets 7 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. John Lambert‏ @JohnLaTwC 23 Dec 2016
  Replying to @JohnLaTwC
  
  John Lambert Retweeted John Lambert
  
  Some common #PowerShell download & run methods:https://twitter.com/JohnLaTwC/status/790236887214534656 …
  
  John Lambert added,
  
  John Lambert @JohnLaTwC
  
  Some common download & run methods used in #PowerShell malware. Look for it in Base64 and compressed text too. #DFIR pic.twitter.com/NjEPrSGtPu
  
  5 retweets 16 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. John Lambert‏ @JohnLaTwC 23 Dec 2016
  Replying to @JohnLaTwC
  
  John Lambert Retweeted John Lambert
  
  #PowerShell malware stealing credentials: https://twitter.com/JohnLaTwC/status/780111723176919040 …, http://pastebin.com/R8wqMKYP
  
  John Lambert added,
  
  John Lambert @JohnLaTwC
  
  Open Excel macro file. Where did that credential prompt come from? Oh hello #PowerShell: http://pastebin.com/R8wqMKYP pic.twitter.com/lAbzCsD8QR
  
  6 retweets 10 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo
1. John Lambert‏ @JohnLaTwC 23 Dec 2016
  Replying to @JohnLaTwC
  
  John Lambert Retweeted John Lambert
  
  #DFIR Python tool to decode common encoded #PowerShell malware, PsXray:https://twitter.com/JohnLaTwC/status/801179692619288576 …
  
  John Lambert added,
  
  John Lambert @JohnLaTwC
  
  Updated Py #PowerShell decoder script. Base64, compressed, char[], and shellcode. @ https://github.com/JohnLaTwC/PyPowerShellXray … #DFIR pic.twitter.com/OEYPn0efOW
  
  18 retweets 33 likes
  Thanks. Twitter will use this to make your timeline better. Undo
  
  Undo