Análise de ameaças abrangente, IOCs e relatórios de pesquisa sobre RAT, Infostealer, Backdoor e outras famílias de malware.
KoiLoader 478KB sd4.ps1 PowerShell downloader. 37.49.226.113/index.php C2. 0xc2 0x48 0x96 XOR key bytes dizisi.
BruteRatel C4 696KB steam_monitor_02F90000.dll Steam izleme kili. DLL ismine gömülü bellek adresi 0x02F90000. IsDebuggerPresent.
Havoc C2 1.1MB beacon. vboxguest vboxmouse vmware UC VM tespit. Global GUID mutex 7f3a9c2e. DlpCommunicationChannel browser DLP bypass.
ZLoader 526KB HexaPort.dll. INJECTDATA web inject sablon. Banking trojan browser enjeksiyonu. GetTickCount64 IsDebuggerPresent.
NanoCore 1MB Scan#250226HPJetstar.exe HP yazici tarama lure. PDB Administrator Desktop Client FqStwIZtCP pINX.
CryptBot 6MB shark2.bin Delphi stealer. x8D8.io C2 domain. 2c2p2 90C2r c2t stealer config substring. MSH_WHEELSUPPORT Delphi.
RecordBreaker Raccoon v2 1.7MB. press kullanici PDB. LUWKTVNBABYKEYXOEQJLDVKGWJYYXUU 32-karakter config key. BABYKEY markeri.
Socks5Systemz 3.4MB proxy botnet. Apfe.GG C2 .GG domain. Desktop ResourceLocale International CIS lokasyon kontrolu.
WarmCookie 1.4MB Invoice fatura ZIP. 3.7MB JS extractor. Office.js API kutuphanesi. _ust_be_20_Section_ JS obfuskated degisken. Invoice lure.
DarkGate 1.9MB 7z arshiv. 8Z9f.gg C2 domain .GG Guernsey TLD. c2 substring referanslari O/c2k [.c22 xhPc2T.
Meduza Stealer 1.5MB RUN.exe generik isim. @c2/$ C2 URL yolu. NtQuerySystemInformation NtQueryInformationProcess anti-debug.
Latrodectus 2MB temp.tmp MSI kilik. wazij.com/sel.php C2 gate. NtQueryInformationProcess GetTickCount IsDebuggerPresent. MSI dropper.
Remcos 1.2MB SCAN DOC LOI.r00 RAR first volume lure. PDB svch0st.877.exe svchost typosquat. AbbsChevis@protonmail.com. NtQuerySemaphore.
ScreenConnect 1KB invitedGuests.bat davet listesi. hbdhfijnsgjnds.top DGA C2. ConnectWise meşru RMM araç kötüye kullanim.
ValleyRAT 1.9MB Cin dil paketi kili. wmic path Win32_ComputerSystem get HypervisorPresent WMI VM tespit. .cc kaynak dosya stringleri.
DCRat 1MB sostener1.vbs Ispanyolca VBScript dropper. geutqmonpmjthuux.Ru 15-karakter DGA benzeri C2. LATAM hedefleme.
Pikabot 1.4MB LisectAVT_24003_G1B_54.exe kampanya. NtQueryObject NtQuerySystemInformation GetTickCount64. Socket C2 hata stringleri.
NetSupportRAT 201KB Rate_RATE_AGR_Jun29.exe Haziran 29 teklif anlasma lure. IMCPBLGFEPGLGD uzun kodlanmis config string.
LimeRAT 399KB kalyanonlinematkaapp.exe Kalyan Matka Hint yasadisi piyango. kalyanonlinematkaapp.in.net/tai-app-kubet C2. vmware vboxhook.
SocGholish 262 byte mini stager. seattlemysterylovers.com Seattle kitapci sitesi gizli payload URL. Drive-by download.