f you're using any of those Monster A19 wifi lightbulbs (monsterilluminessence . com) be aware your data appears to be going to @splunk cloud.
Remote
James_inthe_box
@james_inthe_box@infosec.exchange
mastodon 4.8.0-alpha.3+glitch641 Followers
180 Following
46 Posts
Joined November 07, 2022
In light of recent LLM's breaking out of their guardrails and doing damage, I felt compelled to write this.
https://gist.github.com/silence-is-best/e8fe274d219fc509ed950286deeae502
Couple #screenconnect droppers at:
https:// doc. papperldoculess\.top/edocument/
Replying to
#clickfix to #vidar (among other things) via:
http:// www\.apcconstruction\.com/
https://app.any.run/tasks/4599dbb0-1041-43f3-b127-a42cfc7ca60e
Handful of IOC's for those .js #purelogs #stealer #malspams:
https://app.any.run/tasks/43e561e4-707a-4189-8b4c-d4795b2451a6
Exfil port is 4449
Calls hidden Edge
Calls hidden Chrome
Replying to
@wdormann@infosec.exchange @mjg59@nondeterministic.computer Honestly I always thought secure boot was the secondary objective...primary being Windows OS Lock in.
A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses:
https://gist.github.com/silence-is-best/48b613e82bf64f1fd8b9a231ccdd590b
#retrohunt
Got tired of mucking with these miserable #screenconnect msi's so here's a #suricata rule to catch the initial check via sni:
https://gist.github.com/silence-is-best/29afec335264313e9bf5bfa1c6e60144
https://app.any.run/tasks/73887f39-a8ac-4702-a67d-36465caca294
cc @da_667@infosec.exchange
An interesting development with #PureLogStealer ....seen this twice now where the Edge flag is invalid:
https://app.any.run/tasks/992252ed-c867-4ad9-8b3f-f53c9ca8451b
Replying to
@netresec@infosec.exchange Aye it's very consistent 
Replying to
@jerry@infosec.exchange To all those that continue to use LLM's....this is the path you have chosen.
Replying to
@AAKL@infosec.exchange Ya windows being windows :D
Replying to
@nixCraft@mastodon.social I'll be waiting for 26.04.1 ;)
Replying to
@wdormann@infosec.exchange PHM is absolutely a book -> movie kinda film.
An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:
https://gist.github.com/silence-is-best/bc95a949f272f8c5487d057bbd74d14f
Some fresh #raton
https://app.any.run/tasks/d020658f-dbca-4a1c-bfec-557db23a332d
C:\Users\Cristian\Desktop\NewRaton\DONOTDELETE\Commands.pdb
#medusahvnc in a js -> autoit:
https://app.any.run/tasks/86ddc895-ed72-4eae-8c9c-f1e7b81abaf9
Replying to
Replying to
Replying to
@0xfeedc0fe Aye...and that's right where I found it ;)
#nanocore......#ransomware ..?
https://app.any.run/tasks/0f06cf0b-8417-4e7d-83db-0fd384472772
No files actually encrypted though 🤔
#unknown panel associated with:
bf777e4dee6918d2373ba83433b4a7530d6e69465a1b6107ef4fd43f4ea60ec4
Replying to on mastodon.world
@signalapp@mastodon.world Where are they stored? What's the encryption level? Who has access?
Replying to
@0xfeedc0fe Huh....that's really odd.
Replying to
Replying to
@malmoeb That's a good find.
Replying to
@da_667@infosec.exchange Awesome!
Much hatred for the latest #Wireshark
Replying to
@FirehaK Good eye! I saw some lateral movement and scanning as well...busy binary!
PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.
1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b
Replying to
@da_667@infosec.exchange Awesome!
Replying to
@threatinsight@infosec.exchange Spot on takeaway.
Replying to