PrecisionSec threat feeds offer curated #threatintelligence focused on malware and C2 frameworks that are typically utilized in an intrusion or incident.
Canada
Joined March 2012
- Tweets255
- Following731
- Followers365
- Likes89
PrecisionSec retweeted
#Remus #Stealer's ETH fallback C2 rotated (2026-10-21 ~18:00 UTC).
Contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF (eth_call 0xc2fb26a6) now returns:
hxxp://24hocst[.]help:2538/ (159.223.150[.]218)
#RemusStealer #EtherHiding
PrecisionSec retweeted
Join me at @BSidesVancouver on May 26 for my workshop "Precision #ThreatHunting: Unveiling Adversary Infrastructure using Free and Open Source Tools," designed to teach participants techniques for discovering and analyzing adversary infrastructure. Only 6 seats left! #OSINT
PrecisionSec retweeted
#RevengeRAT #base64 hosted on #pastebin: hxxps://pastebin[.]com/e8grybhb
Some other interesting #powershell #malware posted by that user:
pastebin.com/u/jccdt
PrecisionSec retweeted
[#Malware Analysis] IQY file embedded in PDF drops EXE with valid digital signature vmray.com/analyses/2c5729e17…
PrecisionSec retweeted
This map shows live and kicking #Emotet Tier-1 C&C proxies for the past 24 hours. 95 servers in total listening on random ports, however majority uses TCP port 80 or 443. Notice that there are no T1's located in Russia.
PrecisionSec retweeted
Seen some spam emails leading to #BlackTDS domains, some of which contained scripts leading to other content. I followed one which led to #GrandSoftEK . A HTA seems to download "Ascentor Loader" (see strings) which led to #GandCrab
More info here:
zerophagemalware.com/2018/06…
PrecisionSec retweeted
Analysis of an Emotet Dropper
0ffset.wordpress.com/2018/03…
Downloaded from @virusbay_io
PrecisionSec retweeted
#GandCrab version 2.3r 🧐(new) released in the wild today.
MD5: 1c20431db2283ec63a03696e03f54a57
PrecisionSec retweeted
New #emotet sample uploaded to @HybridAnalysis
MD5: e7b64cafa40fe064bfbbfcdfaff104db
LOL, now he's switched from Replace commands to securestring 😋
Leave IEX out and you get back your strings. Still same payload servers as yesterday. - might as well not obfuscate at all 😀
PrecisionSec retweeted
More #bitcoin targeting from #Trickbot ver 1000123 gtag kas102
dinj: pastebin.com/PnqxBY39
sinj: pastebin.com/e9TwvXz7
conf: pastebin.com/JWJsaJy9
sample: virustotal.com/#/file/8a9741…
@malwrhunterteam
PrecisionSec retweeted
While everybody was focusing on BadRabbit; Locky/TrickBOT (config 1000075 already) was busy little bees, #DDE, virustotal.com/#/file/b27420…
PrecisionSec retweeted
How TrickBot tricks its victims with web injects (man-in-the-browser) uperesia.com/how-trickbot-tr… #banking #malware #trickbot #cybercrime
PrecisionSec retweeted
9-12-2017: #Trickbot banker “mac1” -> ver 1000047 - Theme: "Bankwest" - mcconf IOC & plugins same as nitter.gq/VK_Intel/status/905996… Thx: @dvk01uk 👍
9-7-2017: #Trickbot banker “kas14” -> new ver 1000047 -> Theme: "Secure Msg RBS" mcconf & plugins -> ghostbin.com/paste/y7p4vk Ty: @dvk01uk 👍
PrecisionSec retweeted
#Cerber Ransomware Actors Shift to Password-Protected Documents: blog.cloudmark.com/2016/12/0…
PrecisionSec retweeted
#Dridex Banker Server Statistics 2016 --> 329 Servers (2016-2017) #elasticsearch #kibana #letslearn #malware vkremez.com/2017/01/dridex-b…
PrecisionSec retweeted
My new post for @Malwarebytes: "#TrickBot comes with new tricks – attacking Outlook and browsing data" blog.malwarebytes.com/threat…
