AO VIVO
YAN1AVKILLERyan1AVKiller d11793433 -- net stop WinDefend taskkill wrsa Webroot AV Kill Crypto++ AES Rijndael Ransomware Sifreleme Drive Enumeration Timestomping 2 PDB Gelistirici | Kritik◆MOZELLAELFMozellaELF d77dd11f -- Mozilla Taklidi Linux ELF 64bit PyInstaller Cookie Stealer unittest.ru unittest.su Suphelici Rus TLD socket requests.cookies base64 | Orta◆GINZOINFOSTEALERGinzoInfostealer c73a91a1 -- Ginzo.pdb PDB Onay Chrome Firefox Cookie SQL Sorgusu encryptedPassword AesEngine AES Sifre Cozme Kaydedilmis Sifre Calma | Kritik◆RESOURCEDROPPERResourceDropper 9ef1cd4c -- FindResourceA LoadResource LockResource PE Gizli Kaynak Paylod, InternetOpenA InternetOpenUrlA HTTP Indirme, CryptAcquireContextA CryptGenRandom Rastgele Dosya Adi | Orta◆VBSDESERIALIZATIONVBSDeserialization 8d610d90 -- VBScript Base64 Parca Fonksiyonlari NET Seri Cozme Gadget Microsoft TextFormattingRunProperties ysoserial Sifir Click RCE | Yuksek◆QUOTEHTADROPPERQUOTEHTADropper 9fa0a886 -- QUOTE-05348-2026.pdf.hta Cift Uzanti PDF Lur, WScript.Shell Cevre Degiskeni Payload Parca Depolama MqVI5ZYptsWhg4UT AES Anahtari PowerShell Enjeksiyonu | Yuksek◆RYUKRyuk 8da85cb0 -- RyukReadMe.html Tescilli Fidye Notu, WriteProcessMemory VirtualAllocEx CreateRemoteThread Proses Enjeksiyonu, GetIpNetTable ARP Tarama, AdjustTokenPrivileges Yetki Yukseltme | Kritik◆ORDERINQUIRYJSDROPPEROrderInquiryJSDropper c3fde2b6 -- OrderInquiry070126 Siparis Sorgusu Lur, Agir JS Obfuske String Tablosu q(0x2f7) Pattern, 1.3MB Gizli Payload Tascisi | Orta◆C2 ATIVOAgentTesla — digicert.com◆C2 ATIVOAsyncRAT — system.io◆C2 ATIVOAgentTesla — stem.ru◆C2 ATIVOAsyncRAT — system.io◆C2 ATIVOAsyncRAT — microsoft.com◆CVE-2021-44228Apache Log4j2 JNDI enjeksiyon açığı (Log4Shell). Uzaktan kod yürütmeye olanak ta◆CVE-2024-3400Palo Alto Networks PAN-OS GlobalProtect'te OS komutu enjeksiyonu açığı. Kimlik d◆CVE-2020-1472Netlogon Uzak Protokolü'nde ayrıcalık yükseltme açığı (Zerologon). Kimlik doğrul◆CVE-2023-20198Cisco IOS XE Web UI'de ayrıcalık yükseltme açığı. Uzaktaki kimliği doğrulanmamış◆CVE-2024-1709ConnectWise ScreenConnect kimlik doğrulama bypass açığı. Kurulum sihirbazı endpo◆YAN1AVKILLERyan1AVKiller d11793433 -- net stop WinDefend taskkill wrsa Webroot AV Kill Crypto++ AES Rijndael Ransomware Sifreleme Drive Enumeration Timestomping 2 PDB Gelistirici | Kritik◆MOZELLAELFMozellaELF d77dd11f -- Mozilla Taklidi Linux ELF 64bit PyInstaller Cookie Stealer unittest.ru unittest.su Suphelici Rus TLD socket requests.cookies base64 | Orta◆GINZOINFOSTEALERGinzoInfostealer c73a91a1 -- Ginzo.pdb PDB Onay Chrome Firefox Cookie SQL Sorgusu encryptedPassword AesEngine AES Sifre Cozme Kaydedilmis Sifre Calma | Kritik◆RESOURCEDROPPERResourceDropper 9ef1cd4c -- FindResourceA LoadResource LockResource PE Gizli Kaynak Paylod, InternetOpenA InternetOpenUrlA HTTP Indirme, CryptAcquireContextA CryptGenRandom Rastgele Dosya Adi | Orta◆VBSDESERIALIZATIONVBSDeserialization 8d610d90 -- VBScript Base64 Parca Fonksiyonlari NET Seri Cozme Gadget Microsoft TextFormattingRunProperties ysoserial Sifir Click RCE | Yuksek◆QUOTEHTADROPPERQUOTEHTADropper 9fa0a886 -- QUOTE-05348-2026.pdf.hta Cift Uzanti PDF Lur, WScript.Shell Cevre Degiskeni Payload Parca Depolama MqVI5ZYptsWhg4UT AES Anahtari PowerShell Enjeksiyonu | Yuksek◆RYUKRyuk 8da85cb0 -- RyukReadMe.html Tescilli Fidye Notu, WriteProcessMemory VirtualAllocEx CreateRemoteThread Proses Enjeksiyonu, GetIpNetTable ARP Tarama, AdjustTokenPrivileges Yetki Yukseltme | Kritik◆ORDERINQUIRYJSDROPPEROrderInquiryJSDropper c3fde2b6 -- OrderInquiry070126 Siparis Sorgusu Lur, Agir JS Obfuske String Tablosu q(0x2f7) Pattern, 1.3MB Gizli Payload Tascisi | Orta◆C2 ATIVOAgentTesla — digicert.com◆C2 ATIVOAsyncRAT — system.io◆C2 ATIVOAgentTesla — stem.ru◆C2 ATIVOAsyncRAT — system.io◆C2 ATIVOAsyncRAT — microsoft.com◆CVE-2021-44228Apache Log4j2 JNDI enjeksiyon açığı (Log4Shell). Uzaktan kod yürütmeye olanak ta◆CVE-2024-3400Palo Alto Networks PAN-OS GlobalProtect'te OS komutu enjeksiyonu açığı. Kimlik d◆CVE-2020-1472Netlogon Uzak Protokolü'nde ayrıcalık yükseltme açığı (Zerologon). Kimlik doğrul◆CVE-2023-20198Cisco IOS XE Web UI'de ayrıcalık yükseltme açığı. Uzaktaki kimliği doğrulanmamış◆CVE-2024-1709ConnectWise ScreenConnect kimlik doğrulama bypass açığı. Kurulum sihirbazı endpo◆
Pesquisa de segurança KEYDAL

Inteligência de ameaças de malware
Plataforma

Análise de ameaças abrangente, IOCs e relatórios de pesquisa sobre RAT, Infostealer, Backdoor e outras famílias de malware.

89386Relatórios
392Famílias
293703IOCs
68CVEs
6182C2
Famílias de malware Servidores C2 Banco de dados CVE
DESTAQUE
Kritik yan1AVKiller

yan1AVKiller d11793433 -- net stop WinDefend taskkill wrsa Webroot AV Kill Crypto++ AES Rijndael Ransomware Sifreleme Drive Enumeration Timestomping 2 PDB Gelistirici | Kritik

yan1 d11793433 console PE32 x86 408KB. net stop WinDefend + taskkill wrsa* (Webroot kill). Crypto++ AES Rijndael sifreleme. Drive enumeration + timestomping. Iki PDB (user111 + cake).

yan1-avkillerransomware-componentnet-stop-windefend-windows-defender-disabletaskkill-wrsa-webroot-antivirus-killcryptopp-aes-rijndael-encryption-capability
Leia a análise completa

Últimos relatórios

04
Orta ResourceDropper

ResourceDropper 9ef1cd4c -- FindResourceA LoadResource LockResource PE Gizli Kaynak Paylod, InternetOpenA InternetOpenUrlA HTTP Indirme, CryptAcquireContextA CryptGenRandom Rastgele Dosya Adi | Orta

ResourceDropper 9ef1cd4c PE32+ x64 141KB. FindResourceA+LoadResource+LockResource PE kaynak payload. InternetOpenA+InternetOpenUrlA HTTP indirme. CryptAcquireContextA+CryptGenRandom rastgele dosya adi. CreateProcessA.

resourcedropperresource-dropperfindresourcea-loadresource-lockresource-pe-resource-extractioninternetopena-internetopenurla-http-download-wininet
Continue lendo →
05
Yüksek VBSDeserialization

VBSDeserialization 8d610d90 -- VBScript Base64 Parca Fonksiyonlari NET Seri Cozme Gadget Microsoft TextFormattingRunProperties ysoserial Sifir Click RCE | Yuksek

VBSDeserialization 8d610d90 ASCII text 237KB VBScript. Base64 parca fonksiyonlari (enddealthem pilotshotluck vs). NET seri cozme gadget TextFormattingRunProperties ysoserial RCE. Sifir click.

vbsdeserializationvbs-deserializationvbscript-base64-chunk-functions-obfuscationdotnet-deserialization-gadget-textformattingrunproperties
Continue lendo →
06
Yüksek QUOTEHTADropper

QUOTEHTADropper 9fa0a886 -- QUOTE-05348-2026.pdf.hta Cift Uzanti PDF Lur, WScript.Shell Cevre Degiskeni Payload Parca Depolama MqVI5ZYptsWhg4UT AES Anahtari PowerShell Enjeksiyonu | Yuksek

QUOTEHTADropper 9fa0a886 HTML/HTA 403KB. QUOTE-05348-2026.pdf.hta cift uzanti PDF lur. WScript.Shell cevre degiskeni P1 P2 P3 payload chunking. MqVI5ZYptsWhg4UT AES anahtari. PowerShell enjeksiyonu.

quoteh-tadropperhta-dropperquote-05348-2026-pdf-hta-double-extension-pdf-lurewscript-shell-user-environment-variable-payload-chunk-storage
Continue lendo →
07
Kritik Ryuk

Ryuk 8da85cb0 -- RyukReadMe.html Tescilli Fidye Notu, WriteProcessMemory VirtualAllocEx CreateRemoteThread Proses Enjeksiyonu, GetIpNetTable ARP Tarama, AdjustTokenPrivileges Yetki Yukseltme | Kritik

Ryuk 8da85cb0 PE32+ x64 207KB. RyukReadMe.html tescilli fidye notu. WriteProcessMemory+VirtualAllocEx+CreateRemoteThread proses enjeksiyonu. GetIpNetTable ARP tarama. AdjustTokenPrivileges yetki yukseltme.

ryukryuk-ransomwareryukreadme-html-ransom-note-confirmed-iocwriteprocessmemory-virtualallocex-createremotethread-classic-injection
Continue lendo →
08
Orta OrderInquiryJSDropper

OrderInquiryJSDropper c3fde2b6 -- OrderInquiry070126 Siparis Sorgusu Lur, Agir JS Obfuske String Tablosu q(0x2f7) Pattern, 1.3MB Gizli Payload Tascisi | Orta

OrderInquiryJSDropper c3fde2b6 JavaScript 1.3MB. OrderInquiry070126 siparis sorgusu lur. Agir JS obfuske q(0x2f7) string tablosu. 65536 karakter satir uzunlugu. Gizli dropper payload.

orderinquiryjsdropperorder-inquiry-js-dropperorderinquiry070126-js-lure-order-inquiryheavy-javascript-obfuscation-string-lookup-table
Continue lendo →
09
Orta SWIFTJSDropper

SWIFTJSDropper af743f03 -- SWIFT Payment Receipt Finansal Lur, Danca Obfuske Yorumlar Gootloader Benzeri, Marve Dizi Kodlu Payload, Landsretssagfrerne Aldatma Dizeleri | Orta

SWIFTJSDropper af743f03 ASCII text 354KB JavaScript. SWIFT Payment Receipt finansal lur. Danca obfuske yorumlar Gootloader benzeri. Marve=[132,126,104,81] dizi kodlu payload.

swiftjsdropperswift-js-dropperswift-payment-receipt-financial-lure-300danish-obfuscated-comments-gootloader-pattern
Continue lendo →
10
Kritik RansomComponent

RansomComponent ae355c32 -- vssadmin Delete Shadows Golge Kopya Yok Etme, vssadmin resize shadowstorage Yedek Engelleme, net stop Servis Durdurma, CreateRemoteThread Surec Enjeksiyonu | Kritik

RansomComponent ae355c32 PE32 x86 100KB. vssadmin Delete Shadows golge kopya yok etme. vssadmin resize shadowstorage yedek engelleme. net stop x5 servis durdurma. CreateRemoteThread enjeksiyonu.

ransomcomponentransomware-componentvssadmin-delete-shadows-all-quiet-shadow-copy-deletionvssadmin-resize-shadowstorage-401mb-unbounded-backup-prevention
Continue lendo →
11
Yüksek XenoRAT

XenoRAT UpdateWindowns a87cf095 -- xeno rat client String Tespiti, SharpDX DirectX Ekran Yakalama, Global 7B2A1-9D2E-4F3C Mutex, AddToStartupNonAdmin Kalicilik, localto.net Tunel Relay | Yuksek

XenoRAT UpdateWindowns a87cf095 .NET PE 378KB. xeno rat client string tespiti x3. SharpDX DirectX11 DXGI ekran yakalama. Global\{7B2A1-9D2E-4F3C-8A11-B2C3D4E5F6G7} mutex. AddToStartupNonAdmin kalicilik. localto.net tunel.

xenoratxeno-ratxeno-rat-client-string-confirmed-identificationsharpdx-direct3d11-dxgi-directx-screen-capture
Continue lendo →
13
Orta ClipboardClipper

ClipboardClipper 52d0af7d -- AddClipboardFormatListener Pano Dinleme Kancasi, PE32 Console x86 1.8MB Yuksek Entropi Packed, DOS Stub Suspicious TLS Anti-Analiz | Orta

ClipboardClipper 52d0af7d PE32 console x86 1.8MB entropi 7.70 packed. AddClipboardFormatListener pano dinleme. DOS stub suspicious TLS anti-analiz. Kripto adres clipper.

clipboardclipperclipboard-clipperaddclipboardformatlistener-clipboard-api-hook-listenerpe32-console-x86-clipboard-hijacker
Continue lendo →
14
Orta ObfuscatedNETDropper

ObfuscatedNETDropper 670781d0 -- Gelecek Tarih Timestamp Anti-Analiz, AesCryptoServiceProvider RSACryptoServiceProvider NET Crypto, Efyfqp.exe Karismik Yeniden Adlandirma, Uzun Rastgele Obfuske Stringler | Orta

ObfuscatedNETDropper 670781d0 PE32 .NET x86 605KB. Gelecek tarih timestamp anti-analiz. AesCryptoServiceProvider RSACryptoServiceProvider. Efyfqp.exe karisman yeniden adlandirma. Uzun rastgele obfuske stringler.

obfuscatedneldropperobfuscated-net-dropperfuture-timestamp-anti-analysis-anti-sandboxaescryptoserviceprovider-rsacryptoserviceprovider-dotnet-crypto
Continue lendo →
15
Yüksek EncryptionSpyware

EncryptionSpyware Encryption_Project -- E:Doc My-work Encryption PDB Developer Yolu, api.2ip.ua Kurban IP Cografya Profili, GetDesktopWindow BitBlt Ekran Yakalama, WNetOpenEnumW Ag Paylasim Tarama, UuidCreate HWID Kurban Kimlik | Yuksek

EncryptionSpyware 2cf96012 PE32 x86 1.1MB OpenSSL. E:\Doc\My work\Encryption PDB developer. api.2ip.ua kurban IP cografya profili. BitBlt ekran yakalama. WNetOpenEnumW ag paylasim tarama. UuidCreate HWID kurban kimlik.

encryptionspywareencryption-spywaree-doc-my-work-cpp-git-encryption-pdb-developer-pathapi-2ip-ua-victim-ip-geolocation-profiling-dead-drop
Continue lendo →
16
Yüksek DiscordCDNDropper

DiscordCDNDropper NET_D3E0800E -- cdn.discordapp.com Jvvlpovxdup.dat Dead Drop Payload, injectlast Token Enjeksiyon Dize, RepositoryTokenFilter LoginPredicate Kimlik Dogrulama Bypass, System.Net.Sockets Ag Baglantisi | Yuksek

DiscordCDNDropper 41ed808a PE32 .NET 66KB. cdn.discordapp.com Jvvlpovxdup.dat dead drop payload. injectlast token enjeksiyon. RepositoryTokenFilter LoginPredicate kimlik bypass. System.Net.Sockets.

discordcdndropperdiscord-cdn-dropperdiscord-dead-drop-payload-deliverycdn-discordapp-com-jvvlpovxdup-dat-attachment-dead-drop
Continue lendo →
17
Kritik ProcessHollowingLoader

ProcessHollowingLoader cool_project_lol -- D:Usersvirtual Malware projects cool project lol PDB OPSEC Hatasi, NtUnmapViewOfSection SetThreadContext Process Hollowing, Benign GUI Resource MZ Enjeksiyon Debug Kaniti, LoaderBootstrap dll Payload Yukleme Zinciri | Kritik

ProcessHollowingLoader 2eac9624 PE32+ x64 1.5MB. D:\Users\virtual\Malware\projects\cool project lol PDB OPSEC hatasi. NtUnmapViewOfSection SetThreadContext process hollowing. Benign GUI resourceMZ enjeksiyon debug kaniti. LoaderBootstrap.dll zincir.

processhollowingloaderprocess-hollowing-loadercool-project-lol-pdb-opsec-developer-faild-users-virtual-desktop-malware-projects-pdb-path-developer-machine
Continue lendo →
18
Kritik LANRansomware

LANRansomware 48877a3a -- folder_reserved_by_lan_encryptor LAN Ag Sifreleme, EncryptECB DecryptECB AES ECB Modu, is_stealth cmd_list Gizli Mod Bayraklari, wipeonly Silme Modu, TMonitor.PW C2 Domain | Kritik

LANRansomware 48877a3a PE32+ x64 535KB Delphi. folder_reserved_by_lan_encryptor LAN sifreleme. EncryptECB DecryptECB AES ECB. is_stealth cmd_list gizli mod. wipeonly silme modu. TMonitor.PW C2.

lanransomwarelan-ransomwaredelphi-ransomwarefolder-reserved-by-lan-encryptor-network-drive-encryption
Continue lendo →
19
Kritik SMBWorm2

SMBWorm2 Work_Report_2026 -- 196.251.107.104 Payload Sunucu Uc Ayri EXE Indirme, NetShareEnum NetServerEnum SMB Yayilma, Global dsfdsoijbvoxiUHUokpoCVS9XVF848 Mutex, Work_Report_2026.pdf.lnk LNK Enfeksiyon Vektoru | Kritik

SMBWorm2 Work_Report_2026 PE32 x86 174KB. 196.251.107.104 payload sunucu uc ayri EXE indir. NetShareEnum NetServerEnum SMB yayilma. Global dsfdsoijbvoxiUHUokpoCVS9XVF848 mutex. Work_Report_2026.pdf.lnk LNK enfeksiyon.

smbworm2smb-worm-2work-report-2026-lnk-lure196-251-107-104-c2-payload-server-ip-ioc
Continue lendo →
20
Yüksek TrojanizedWhatsApp

TrojanizedWhatsApp Blockchain1.apk -- WhatsApp Marka Klonlama Blockchain Yedek, BIP-39 Kripto Tohum Kelime Listesi Cuzdani Bosaltici, Kredi Karti Odeme Formu Maestro Vade Tarihi, Ekran Goruntüsü Kamera Izinleri | Yuksek

TrojanizedWhatsApp Blockchain1.apk 4.6MB Android. WhatsApp marka klonlama Blockchain yedek. BIP-39 kripto tohum kelime listesi cuzdani bosaltici. Kredi karti odeme formu Maestro. Ekran goruntusu izinleri.

trojanizedwhatsapptrojanized-whatsappblockchain1-apk-android-malwarewhatsapp-brand-cloning-blockchain-replacement-all-strings
Continue lendo →