Brad

@malware_traffic

Sharing information on malicious network traffic and malware samples

127.0.0.1
malware-traffic-analysis.net
Joined July 2013
3,593 Photos and videos Photos and videos

Tweets

You blocked @malware_traffic

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @malware_traffic

  1. Apr 14

    2022-04-16 (Thursday) - Reviewed / I posted at . Saw weird DNS traffic for Cobalt Strike DNS CnC activity, thanks to using so-import-pcap in with the ruleset. Malicious domain in DNS traffic: gmhteuster[.]com

    2 replies . 46 retweets 90 likes
    Undo
  2. Retweeted
    Apr 14

    2022-04-14 (Thursday) - Ongoing activity using URL --> zip --> .msi --> --> . Researchers started seeing this infection method as early as Monday (2022-04-11). IOCs for today's activity available at:

    4 replies . 56 retweets 128 likes
    Undo
  3. Apr 11

    Or maybe this one

    5 retweets 31 likes
    Show this thread
    Show this thread
    Undo
  4. Apr 11

    2022-04-11 (Monday) - This is how I picture successful infections from today's .msi files

    5 replies . 38 retweets 142 likes
    Show this thread
    Show this thread
    Undo
  5. Apr 11

    2022-04-11 (Monday) - Saw using kuxoemoli[.]com on 172.241.27[.]237 from a infection - References: &

    23 retweets 32 likes
    Undo
  6. Retweeted
    Apr 7

    2022-04-05 (Monday) - From a malware infection, we saw traffic from 23.108.57[.]23 using cuhitiro[.]com as its domain. More info available at:

    3 replies . 50 retweets 137 likes
    Undo
  7. Retweeted
    Apr 5

    ISC Diary: reviews new malware first seen on 2022-03-30

    1 reply . 61 retweets 186 likes
    Undo
  8. Apr 4

    Ivan after last week's attempt by Emotet to use links didn't work out...

    2 retweets 24 likes
    Show this thread
    Show this thread
    Undo
  9. Apr 4

    2022-04-04 (Monday) - infection with activity - of the infection, some malware samples, email examples, and IOCs are available at:

    2 replies . 29 retweets 84 likes
    Show this thread
    Show this thread
    Undo
  10. Mar 31

    2022-03-31 (Thursday) - obama173 distribution () - UPS theme - "/nmt/" in the URL string. Email example: Downloaded zip: DLL: DLL: DLL:

    19 retweets 37 likes
    Undo
  11. Retweeted
    Mar 29

    2022-03-29 (Tuesday) - started using links again in its malspam since yesterday - We've consistently seen from infections so far this week using verofes[.]com as its C2 domain - IOCs for today's example available at:

    1 reply . 47 retweets 103 likes
    Undo
  12. Retweeted
    Mar 28

    2022-03-28 (Monday) - Sometime today, switched to links in the malspam instead of attachments. Example:

    35 retweets 67 likes
    Undo
  13. Mar 28

    2 replies . 8 retweets 33 likes
    Undo
  14. Mar 25

    March 2022 traffic analysis exercise - use a of infection traffic to write an incident report - -

    3 replies . 90 retweets 293 likes
    Undo
  15. Mar 25

    2022-03-21 (Monday) - (///) infection with and - of the infection traffic, associated malware samples, and list of IOCs available at:

    1 reply . 36 retweets 87 likes
    Undo
  16. Mar 24

    2022-03-24 (Thursday) - of the infection, 20 email examples, 12 Excel files, 1 DLL for infection with another DLL for - based on an earlier tweet from today - available at:

    24 retweets 56 likes
    Undo
  17. Mar 24

    Agh! Typo! That domain verofes[.]com is using 139.60.160[.]8 -- not [.]9 from my original tweet. Cobalt Strike sample & analysis: - - -

    3 retweets 15 likes
    Show this thread
    Show this thread
    Undo
  18. Mar 24

    2022-03-24 (Thursday) - From an epoch4 infection, I saw verofes[.]com as a domain on 139.60.160[.]9 over TCP port 443 today. Also saw more Cobalt Strike lgbtqplusfriendlydomain[.]com on 144.202.49[.]189 over TCP port 444.

    2 replies . 22 retweets 86 likes
    Show this thread
    Show this thread
    Undo
  19. Mar 23

    2022-03-23 (Wednesday) - info dump from () with the "aa" distribution tag. , email, malware samples, and list of IOCs available at: - password: infected

    19 retweets 40 likes
    Undo
  20. Retweeted
    Mar 22

    ISC Diary: reviews variants , and

    22 retweets 47 likes
    Undo

@malware_traffic hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·