AO VIVO
CHROMEB STEALERChromeB Stealer: iloveboats9.vip Panel Bağlantılı Çok Modüllü Tarayıcı Hırsızı◆WINRARSFXDROPPERSpanishSFXDropper 5c40b6c2 -- WinRAR-SFX-sfxrar-pdb Documento_digital-scr-screensaver D-BAT-launcher Spanish-interface Aceptar-Cancelar-Continuar CryptProtectMemory rsaenh-dll | Orta◆WINRARSFXDROPPERItalianInvoiceSFX 668b4176 -- WinRAR-SFX-dropper Berner-Group-invoice-phishing Fattura-30-09-2025 PO_1072-exe Oct1-exe image002-jpg-distraction AES-0017 sfxzip-pdb CryptProtectMemory | Orta◆VBSLOADERVBSNetReflectionLoader 61806a90 -- VBScript-6710-lines BinaryFormatter-deserialization AAEAAAD-header PowerShell-Editor-assembly Base64-chunk-concatenation ricewithoutwatch dugshellslungs randomized-function-names | Orta◆ASUSUPDATERATAsusUpdateRAT 624c6b56 -- ASUSTeK-Computer-disguise AsusUpdateSetup-exe JSON-C2-protocol cJSON-library hwid-ping-cmd-filemgr-fileupload-task-del InternetOpenW-HttpSendRequest cmd-exe-output-capture | Yuksek◆BLACKBASTABlackBasta Loader 65ca7ba8 -- Microsoft-Office-OSE-disguise Global-OfficeSourceEngine64Mutex ose-pdb self-modifying-ex_cod VirtualAlloc-runtime-API WinHttp-C2 SetThreadToken-DuplicateToken ecduu-obfuscated-string | Kritik◆BEASTWASHEREBeastWasHere ESXi Ransomware 66f86812 -- ELF-32bit-Linux ChaCha20-encryption vim-cmd-vmsvc-getallvms VMDK-VMEM-VMXF BEASTWASHERE-marker beast-log default-key daemon-mode partial-encryption | Kritik◆CURLHELPERDLLCurlHelperDLL 5129d1d2 -- libcurl-8-18-0 User-Agent-CurlHelper-1-0-Windows Bearer-token auth=Bearer TbcString Dll6-dll csdnimg-cn baidu-com CALG-RC4 CALG-AES-128 future-timestamp | Orta◆C2 ATIVOAgentTesla — digicert.com◆C2 ATIVOAsyncRAT — system.io◆C2 ATIVOAgentTesla — stem.ru◆C2 ATIVOAsyncRAT — system.io◆C2 ATIVOAsyncRAT — microsoft.com◆CVE-2021-44228Apache Log4j2 JNDI enjeksiyon açığı (Log4Shell). Uzaktan kod yürütmeye olanak ta◆CVE-2024-3400Palo Alto Networks PAN-OS GlobalProtect'te OS komutu enjeksiyonu açığı. Kimlik d◆CVE-2020-1472Netlogon Uzak Protokolü'nde ayrıcalık yükseltme açığı (Zerologon). Kimlik doğrul◆CVE-2023-20198Cisco IOS XE Web UI'de ayrıcalık yükseltme açığı. Uzaktaki kimliği doğrulanmamış◆CVE-2024-1709ConnectWise ScreenConnect kimlik doğrulama bypass açığı. Kurulum sihirbazı endpo◆CHROMEB STEALERChromeB Stealer: iloveboats9.vip Panel Bağlantılı Çok Modüllü Tarayıcı Hırsızı◆WINRARSFXDROPPERSpanishSFXDropper 5c40b6c2 -- WinRAR-SFX-sfxrar-pdb Documento_digital-scr-screensaver D-BAT-launcher Spanish-interface Aceptar-Cancelar-Continuar CryptProtectMemory rsaenh-dll | Orta◆WINRARSFXDROPPERItalianInvoiceSFX 668b4176 -- WinRAR-SFX-dropper Berner-Group-invoice-phishing Fattura-30-09-2025 PO_1072-exe Oct1-exe image002-jpg-distraction AES-0017 sfxzip-pdb CryptProtectMemory | Orta◆VBSLOADERVBSNetReflectionLoader 61806a90 -- VBScript-6710-lines BinaryFormatter-deserialization AAEAAAD-header PowerShell-Editor-assembly Base64-chunk-concatenation ricewithoutwatch dugshellslungs randomized-function-names | Orta◆ASUSUPDATERATAsusUpdateRAT 624c6b56 -- ASUSTeK-Computer-disguise AsusUpdateSetup-exe JSON-C2-protocol cJSON-library hwid-ping-cmd-filemgr-fileupload-task-del InternetOpenW-HttpSendRequest cmd-exe-output-capture | Yuksek◆BLACKBASTABlackBasta Loader 65ca7ba8 -- Microsoft-Office-OSE-disguise Global-OfficeSourceEngine64Mutex ose-pdb self-modifying-ex_cod VirtualAlloc-runtime-API WinHttp-C2 SetThreadToken-DuplicateToken ecduu-obfuscated-string | Kritik◆BEASTWASHEREBeastWasHere ESXi Ransomware 66f86812 -- ELF-32bit-Linux ChaCha20-encryption vim-cmd-vmsvc-getallvms VMDK-VMEM-VMXF BEASTWASHERE-marker beast-log default-key daemon-mode partial-encryption | Kritik◆CURLHELPERDLLCurlHelperDLL 5129d1d2 -- libcurl-8-18-0 User-Agent-CurlHelper-1-0-Windows Bearer-token auth=Bearer TbcString Dll6-dll csdnimg-cn baidu-com CALG-RC4 CALG-AES-128 future-timestamp | Orta◆C2 ATIVOAgentTesla — digicert.com◆C2 ATIVOAsyncRAT — system.io◆C2 ATIVOAgentTesla — stem.ru◆C2 ATIVOAsyncRAT — system.io◆C2 ATIVOAsyncRAT — microsoft.com◆CVE-2021-44228Apache Log4j2 JNDI enjeksiyon açığı (Log4Shell). Uzaktan kod yürütmeye olanak ta◆CVE-2024-3400Palo Alto Networks PAN-OS GlobalProtect'te OS komutu enjeksiyonu açığı. Kimlik d◆CVE-2020-1472Netlogon Uzak Protokolü'nde ayrıcalık yükseltme açığı (Zerologon). Kimlik doğrul◆CVE-2023-20198Cisco IOS XE Web UI'de ayrıcalık yükseltme açığı. Uzaktaki kimliği doğrulanmamış◆CVE-2024-1709ConnectWise ScreenConnect kimlik doğrulama bypass açığı. Kurulum sihirbazı endpo◆
Pesquisa de segurança KEYDAL

Inteligência de ameaças de malware
Plataforma

Análise de ameaças abrangente, IOCs e relatórios de pesquisa sobre RAT, Infostealer, Backdoor e outras famílias de malware.

89386Relatórios
392Famílias
293703IOCs
68CVEs
6182C2
Famílias de malware Servidores C2 Banco de dados CVE

Últimos relatórios

02
Orta WinRARSFXDropper

SpanishSFXDropper 5c40b6c2 -- WinRAR-SFX-sfxrar-pdb Documento_digital-scr-screensaver D-BAT-launcher Spanish-interface Aceptar-Cancelar-Continuar CryptProtectMemory rsaenh-dll | Orta

SpanishSFXDropper 5c40b6c2 WinRAR SFX 1.87MB. Documento_digital.scr dropper (.scr=PE exe). D.BAT launcher. Ispanyolca arayuz. sfxrar.pdb. CryptProtectMemory. Ispanya/Latin Amerika hedefi.

winrar-sfx-dropper-sfxrar-pdbdocumento-digital-scr-fake-documentscr-screensaver-pe-executable-trickd-bat-launcher-batch-file
Continue lendo →
03
Orta WinRARSFXDropper

ItalianInvoiceSFX 668b4176 -- WinRAR-SFX-dropper Berner-Group-invoice-phishing Fattura-30-09-2025 PO_1072-exe Oct1-exe image002-jpg-distraction AES-0017 sfxzip-pdb CryptProtectMemory | Orta

ItalianInvoiceSFX 668b4176 WinRAR SFX 1.27MB. Berner Group fatura phishing (30.09.2025). Sahte: Fattura_Berner.PDF+image002.jpg. Asil: PO_1072.exe+Oct1.exe. AES-0017. sfxzip.pdb. CryptProtectMemory.

winrar-sfx-dropper-sfxzip-pdbberner-group-invoice-phishing-italianfattura-berner-fake-pdf-invoicepo-1072-exe-purchase-order-malware
Continue lendo →
04
Orta VBSLoader

VBSNetReflectionLoader 61806a90 -- VBScript-6710-lines BinaryFormatter-deserialization AAEAAAD-header PowerShell-Editor-assembly Base64-chunk-concatenation ricewithoutwatch dugshellslungs randomized-function-names | Orta

VBSNetReflectionLoader 61806a90 VBScript 237KB 6710-satir. .NET BinaryFormatter deserialization (AAEAAAD/////). PowerShell.Editor + Windows.Forms assembly. Base64 parca birlestirme. dugshellslungs ile calistirma.

vbscript-dotnet-reflection-loaderbinaryformatter-deserialization-aaeaaad-headerpowershell-editor-assembly-loadingsystem-windows-forms-dotnet-load
Continue lendo →
05
Yüksek AsusUpdateRAT

AsusUpdateRAT 624c6b56 -- ASUSTeK-Computer-disguise AsusUpdateSetup-exe JSON-C2-protocol cJSON-library hwid-ping-cmd-filemgr-fileupload-task-del InternetOpenW-HttpSendRequest cmd-exe-output-capture | Yuksek

AsusUpdateRAT 624c6b56 PE32 1.1MB. ASUSTeK Computer disguise (AsusUpdateSetup.exe). JSON C2 protokolu cJSON. hwid/ping/cmd/filemgr/fileupload/task/del. HTTP InternetOpenW+HttpSendRequest. cmd.exe output capture.

asustek-computer-update-disguiseasususupdatesetup-exe-fake-version-infojson-c2-protocol-cjson-libraryhwid-hardware-id-fingerprint
Continue lendo →
06
Kritik BlackBasta

BlackBasta Loader 65ca7ba8 -- Microsoft-Office-OSE-disguise Global-OfficeSourceEngine64Mutex ose-pdb self-modifying-ex_cod VirtualAlloc-runtime-API WinHttp-C2 SetThreadToken-DuplicateToken ecduu-obfuscated-string | Kritik

BlackBasta Loader 65ca7ba8 PE32 488KB. Microsoft Office Setup Engine (ose.pdb) kamuflagesi. Global\OfficeSourceEngine64Mutex. self-modifying .ex_cod section. VirtualAlloc+GetProcAddress runtime API. WinHttp C2. SetThreadToken.

black-basta-ransomware-loadermicrosoft-office-ose-pdb-disguiseglobal-officesourceengine64mutex-fake-mutexself-modifying-ex_cod-section-encrypted-code
Continue lendo →
07
Kritik BeastWasHere

BeastWasHere ESXi Ransomware 66f86812 -- ELF-32bit-Linux ChaCha20-encryption vim-cmd-vmsvc-getallvms VMDK-VMEM-VMXF BEASTWASHERE-marker beast-log default-key daemon-mode partial-encryption | Kritik

BeastWasHere ESXi Ransomware 66f86812 ELF32 89KB. vim-cmd vmsvc/getallvms ile ESXi VM otomasyonu. .vmdk/.vmem/.vmsd/.vmsn/.vmss/.vmxf sifreleme. BEASTWASHERE imzasi. ChaCha20. beast.log. Daemon modu.

beastwashere-esxi-ransomware-elf-linuxchacha20-stream-cipher-encryptionvim-cmd-vmsvc-getallvms-esxi-apivmdk-vmem-vmsd-vmsn-vmss-vmxf-encryption
Continue lendo →
08
Orta CurlHelperDLL

CurlHelperDLL 5129d1d2 -- libcurl-8-18-0 User-Agent-CurlHelper-1-0-Windows Bearer-token auth=Bearer TbcString Dll6-dll csdnimg-cn baidu-com CALG-RC4 CALG-AES-128 future-timestamp | Orta

CurlHelperDLL 5129d1d2 PE32 DLL 647KB libcurl 8.18.0 gomulu. User-Agent: CurlHelper/1.0. Bearer token auth. Dll6.dll TbcString C++. Cin: csdnimg.cn+baidu.com test URL. RC4+AES-128+RSA. future timestamp.

libcurl-8-18-0-embedded-dllcurlhelper-1-0-windows-unique-user-agentbearer-token-authorization-c2-authtbcstring-cpp-class-custom-string
Continue lendo →
09
Orta AutoITMalware

AutoITFTPInjector 4cc12d29 -- AutoIT3-compiled NoCmdExecute FtpOpenFileW FtpGetFileSize FTPSETPROXY VirtualAllocEx WriteProcessMemory CreateProcessAsUserW LogonUserW Wow64Disable AdjustTokenPrivileges | Orta

AutoITFTPInjector 4cc12d29 PE32 985KB AutoIT3 compiled Delphi wrapper. FtpOpenFileW+FtpGetFileSize+FTPSETPROXY. VirtualAllocEx+WriteProcessMemory injection. CreateProcessAsUserW. LogonUserW. Wow64DisableWow64FsRedirection.

autoit3-compiled-malware-scriptautoit-nocmdexecute-compile-flagftpopenfilew-ftpgetfilesize-ftp-capabilityftpsetproxy-proxy-ftp-upload
Continue lendo →
10
Orta WordVBAMacro

WordVBAMacro 58e3a3cd -- vbaProject-bin CreateObject Chr122-string-obfuscation Loop-filler mpn_F2Jws jPWM1x5r-sub-routine OOXML-word-2007-macro-dropper | Orta

WordVBAMacro 58e3a3cd Word 2007+ OOXML 243KB. vbaProject.bin VBA makro. CreateObject dropper API. Chr(122) string gizleme. Loop filler anti-analiz. Gizlenmis modul: mpn_F2Jws, Sub: jPWM1x5r.

word-vba-macro-dropper-ooxmlvbaproject-bin-compiled-vba-codecreateobject-wscript-shell-dropperchr122-string-char-concatenation-obfuscation
Continue lendo →
11
Orta DiscordCDNDropper

DiscordCDNDropper 41ed808a -- cdn.discordapp.com-attachments Jvvlpovxdup-dat-fake-extension RepositoryTokenFilter injectlast System-Net-Sockets CreateDelegate token-filter Discord-dead-drop | Orta

DiscordCDNDropper 41ed808a PE32 .NET x86 66KB. Discord CDN dead-drop: cdn.discordapp.com attachment Jvvlpovxdup.dat (.dat=gizli PE). RepositoryTokenFilter, injectlast, System.Net.Sockets.

discord-cdn-dead-drop-techniquediscordapp-com-attachment-payloaddat-extension-pe-disguiserepositorytokenfilter-token-validation
Continue lendo →
12
Orta GitHubRansomware

GitHubRansomware 3ea6df18 -- nguyenvietphat-Ransomware AES-RSA-encrypt vssadmin-delete-shadows wbadmin-delete-catalog-quiet winget-git-install svchost-exe ToBase64String torrent-spreading | Orta

GitHubRansomware 3ea6df18 PE32 .NET x86 289KB. Acik kaynak: github.com/nguyenvietphat/Ransomware. AES+RSA. vssadmin delete shadows + wbadmin delete catalog. svchost.exe.

github-public-open-source-ransomwarenguyenvietphat-ransomware-githubaes-encrypt-rsa-encrypt-hybridvssadmin-delete-shadows-all-quiet
Continue lendo →
13
Yüksek LANRansomware

LANRansomware 48877a3a -- Delphi folder-reserved-by-lan-encryptor AES-ECB-CTR dot-encrypted-extension how-to-decrypt-txt stealth-mode wipeonly-flag WSAStartup-network-scan 11-sections-TLS | Yuksek

LANRansomware 48877a3a Delphi PE32+ x64 535KB 11-section TLS. LAN network encryptor. AES-ECB+CTR. .-encrypted uzantisi. how_to_decrypt.txt. /stealth /wipeonly modlari. WSAStartup ag tarama.

delphi-lan-ransomware-network-spreaderfolder-reserved-lan-encryptor-network-shareaes-ecb-ctr-mode-encryptiondot-encrypted-extension-file-rename
Continue lendo →
14
Kritik CerberRansomware

CerberRansomware 4a2ad49c -- cerberhhyed5frqa-onion 4xTor2Web cevacont1234-gmail dot-cerber-extension auditpol-audit-disable VirtualAllocEx wallet-dat ipinfo-io 45ED-FB92 RaaS | Kritik

CerberRansomware 4a2ad49c PE32 x86 1.88MB RaaS. .cerber uzantisi. 4 Tor2Web C2 proxy (cerberhhyed5frqa.onion). auditpol.exe denetim logu devre disi. VirtualAllocEx enjeksiyonu. wallet.dat. ipinfo.io.

cerber-ransomware-raas-2016-2017cerberhhyed5frqa-onion-tor2web-c2dot-cerber-encrypted-extensionauditpol-exe-audit-log-disable
Continue lendo →
15
Kritik MazeRansomware

MazeRansomware 4263eacd -- RSA2048-ChaCha20 DECRYPT-FILES-txt WMI-Win32ShadowCopy-delete autorun-inf-USB InternetOpenA-HTTP-C2 CryptAcquireContextW 1-section-PE | Kritik

MazeRansomware 4263eacd PE32 x86 920KB 1-section. RSA-2048+ChaCha20. DECRYPT-FILES.txt. WMI Win32_ShadowCopy shadowcopy delete (cmd.exe yok). autorun.inf USB yayilim. HTTP C2.

maze-ransomware-2019-2020-rsa2048-chacha20-hybriddecrypt-files-txt-ransom-notewmi-win32shadowcopy-delete-no-cmdautorun-inf-usb-spreading
Continue lendo →
16
Kritik RemcosRAT

RemcosRAT 40079f05 -- BreakingSecurity-net ProcessHollowing NtUnmapViewOfSection EnableLUA-UAC-bypass KeyloggerInit TLS13-AES128-GCM BCryptGenRandom ClipboardMonitor AudioCapture Chrome-LoginData | Kritik

RemcosRAT 40079f05 PE32 x86 514KB. BreakingSecurity.net. Process hollowing NtUnmapViewOfSection. UAC bypass EnableLUA=0. Keylogger+Clipboard+Audio+Screenshot. Chrome Login Data. TLS 1.3.

remcos-rat-breakingsecurity-net-sellerprocess-hollowing-ntunmapviewofsectionuac-bypass-enablelua-registrykeylogger-getasynckey-hook
Continue lendo →
17
Yüksek TiGeRFirewall

TiGeRFirewall 39cbd2d2 -- Brazilian-Banking-Trojan LORDDecrypt Umbrella-flv-exe netsh-firewall-allowedprogram avicap32-webcam Adobe-Update-disguise ClipboardProxy | Yuksek

TiGeRFirewall 39cbd2d2 PE32 .NET 93KB. Brezilya banking trojan. LORDDecrypt. Umbrella.flv.exe. netsh firewall add allowedprogram. avicap32.dll webcam. Adobe Update maskesi.

tiger-firewall-brazilian-banking-trojanlorddecrypt-base64-md5-obfuscationumbrella-flv-exe-fake-media-droppernetsh-firewall-allowedprogram-bypass
Continue lendo →