EN DIRECT
CHROMEB STEALERChromeB Stealer: iloveboats9.vip Panel Bağlantılı Çok Modüllü Tarayıcı Hırsızı◆WINRARSFXDROPPERSpanishSFXDropper 5c40b6c2 -- WinRAR-SFX-sfxrar-pdb Documento_digital-scr-screensaver D-BAT-launcher Spanish-interface Aceptar-Cancelar-Continuar CryptProtectMemory rsaenh-dll | Orta◆WINRARSFXDROPPERItalianInvoiceSFX 668b4176 -- WinRAR-SFX-dropper Berner-Group-invoice-phishing Fattura-30-09-2025 PO_1072-exe Oct1-exe image002-jpg-distraction AES-0017 sfxzip-pdb CryptProtectMemory | Orta◆VBSLOADERVBSNetReflectionLoader 61806a90 -- VBScript-6710-lines BinaryFormatter-deserialization AAEAAAD-header PowerShell-Editor-assembly Base64-chunk-concatenation ricewithoutwatch dugshellslungs randomized-function-names | Orta◆ASUSUPDATERATAsusUpdateRAT 624c6b56 -- ASUSTeK-Computer-disguise AsusUpdateSetup-exe JSON-C2-protocol cJSON-library hwid-ping-cmd-filemgr-fileupload-task-del InternetOpenW-HttpSendRequest cmd-exe-output-capture | Yuksek◆BLACKBASTABlackBasta Loader 65ca7ba8 -- Microsoft-Office-OSE-disguise Global-OfficeSourceEngine64Mutex ose-pdb self-modifying-ex_cod VirtualAlloc-runtime-API WinHttp-C2 SetThreadToken-DuplicateToken ecduu-obfuscated-string | Kritik◆BEASTWASHEREBeastWasHere ESXi Ransomware 66f86812 -- ELF-32bit-Linux ChaCha20-encryption vim-cmd-vmsvc-getallvms VMDK-VMEM-VMXF BEASTWASHERE-marker beast-log default-key daemon-mode partial-encryption | Kritik◆CURLHELPERDLLCurlHelperDLL 5129d1d2 -- libcurl-8-18-0 User-Agent-CurlHelper-1-0-Windows Bearer-token auth=Bearer TbcString Dll6-dll csdnimg-cn baidu-com CALG-RC4 CALG-AES-128 future-timestamp | Orta◆C2 ACTIFAgentTesla — digicert.com◆C2 ACTIFAsyncRAT — system.io◆C2 ACTIFAgentTesla — stem.ru◆C2 ACTIFAsyncRAT — system.io◆C2 ACTIFAsyncRAT — microsoft.com◆CVE-2021-44228Apache Log4j2 JNDI enjeksiyon açığı (Log4Shell). Uzaktan kod yürütmeye olanak ta◆CVE-2024-3400Palo Alto Networks PAN-OS GlobalProtect'te OS komutu enjeksiyonu açığı. Kimlik d◆CVE-2020-1472Netlogon Uzak Protokolü'nde ayrıcalık yükseltme açığı (Zerologon). Kimlik doğrul◆CVE-2023-20198Cisco IOS XE Web UI'de ayrıcalık yükseltme açığı. Uzaktaki kimliği doğrulanmamış◆CVE-2024-1709ConnectWise ScreenConnect kimlik doğrulama bypass açığı. Kurulum sihirbazı endpo◆CHROMEB STEALERChromeB Stealer: iloveboats9.vip Panel Bağlantılı Çok Modüllü Tarayıcı Hırsızı◆WINRARSFXDROPPERSpanishSFXDropper 5c40b6c2 -- WinRAR-SFX-sfxrar-pdb Documento_digital-scr-screensaver D-BAT-launcher Spanish-interface Aceptar-Cancelar-Continuar CryptProtectMemory rsaenh-dll | Orta◆WINRARSFXDROPPERItalianInvoiceSFX 668b4176 -- WinRAR-SFX-dropper Berner-Group-invoice-phishing Fattura-30-09-2025 PO_1072-exe Oct1-exe image002-jpg-distraction AES-0017 sfxzip-pdb CryptProtectMemory | Orta◆VBSLOADERVBSNetReflectionLoader 61806a90 -- VBScript-6710-lines BinaryFormatter-deserialization AAEAAAD-header PowerShell-Editor-assembly Base64-chunk-concatenation ricewithoutwatch dugshellslungs randomized-function-names | Orta◆ASUSUPDATERATAsusUpdateRAT 624c6b56 -- ASUSTeK-Computer-disguise AsusUpdateSetup-exe JSON-C2-protocol cJSON-library hwid-ping-cmd-filemgr-fileupload-task-del InternetOpenW-HttpSendRequest cmd-exe-output-capture | Yuksek◆BLACKBASTABlackBasta Loader 65ca7ba8 -- Microsoft-Office-OSE-disguise Global-OfficeSourceEngine64Mutex ose-pdb self-modifying-ex_cod VirtualAlloc-runtime-API WinHttp-C2 SetThreadToken-DuplicateToken ecduu-obfuscated-string | Kritik◆BEASTWASHEREBeastWasHere ESXi Ransomware 66f86812 -- ELF-32bit-Linux ChaCha20-encryption vim-cmd-vmsvc-getallvms VMDK-VMEM-VMXF BEASTWASHERE-marker beast-log default-key daemon-mode partial-encryption | Kritik◆CURLHELPERDLLCurlHelperDLL 5129d1d2 -- libcurl-8-18-0 User-Agent-CurlHelper-1-0-Windows Bearer-token auth=Bearer TbcString Dll6-dll csdnimg-cn baidu-com CALG-RC4 CALG-AES-128 future-timestamp | Orta◆C2 ACTIFAgentTesla — digicert.com◆C2 ACTIFAsyncRAT — system.io◆C2 ACTIFAgentTesla — stem.ru◆C2 ACTIFAsyncRAT — system.io◆C2 ACTIFAsyncRAT — microsoft.com◆CVE-2021-44228Apache Log4j2 JNDI enjeksiyon açığı (Log4Shell). Uzaktan kod yürütmeye olanak ta◆CVE-2024-3400Palo Alto Networks PAN-OS GlobalProtect'te OS komutu enjeksiyonu açığı. Kimlik d◆CVE-2020-1472Netlogon Uzak Protokolü'nde ayrıcalık yükseltme açığı (Zerologon). Kimlik doğrul◆CVE-2023-20198Cisco IOS XE Web UI'de ayrıcalık yükseltme açığı. Uzaktaki kimliği doğrulanmamış◆CVE-2024-1709ConnectWise ScreenConnect kimlik doğrulama bypass açığı. Kurulum sihirbazı endpo◆
Recherche en sécurité KEYDAL

Renseignement sur les menaces malware
Plateforme

Analyses de menaces complètes, IOC et rapports de recherche sur RAT, Infostealer, Backdoor et autres familles de malwares.

89386Rapports
392Familles
293703IOC
68CVE
6182C2
Familles de malwares Serveurs C2 Base CVE

Derniers rapports

02
Orta WinRARSFXDropper

SpanishSFXDropper 5c40b6c2 -- WinRAR-SFX-sfxrar-pdb Documento_digital-scr-screensaver D-BAT-launcher Spanish-interface Aceptar-Cancelar-Continuar CryptProtectMemory rsaenh-dll | Orta

SpanishSFXDropper 5c40b6c2 WinRAR SFX 1.87MB. Documento_digital.scr dropper (.scr=PE exe). D.BAT launcher. Ispanyolca arayuz. sfxrar.pdb. CryptProtectMemory. Ispanya/Latin Amerika hedefi.

winrar-sfx-dropper-sfxrar-pdbdocumento-digital-scr-fake-documentscr-screensaver-pe-executable-trickd-bat-launcher-batch-file
Continuer la lecture →
03
Orta WinRARSFXDropper

ItalianInvoiceSFX 668b4176 -- WinRAR-SFX-dropper Berner-Group-invoice-phishing Fattura-30-09-2025 PO_1072-exe Oct1-exe image002-jpg-distraction AES-0017 sfxzip-pdb CryptProtectMemory | Orta

ItalianInvoiceSFX 668b4176 WinRAR SFX 1.27MB. Berner Group fatura phishing (30.09.2025). Sahte: Fattura_Berner.PDF+image002.jpg. Asil: PO_1072.exe+Oct1.exe. AES-0017. sfxzip.pdb. CryptProtectMemory.

winrar-sfx-dropper-sfxzip-pdbberner-group-invoice-phishing-italianfattura-berner-fake-pdf-invoicepo-1072-exe-purchase-order-malware
Continuer la lecture →
04
Orta VBSLoader

VBSNetReflectionLoader 61806a90 -- VBScript-6710-lines BinaryFormatter-deserialization AAEAAAD-header PowerShell-Editor-assembly Base64-chunk-concatenation ricewithoutwatch dugshellslungs randomized-function-names | Orta

VBSNetReflectionLoader 61806a90 VBScript 237KB 6710-satir. .NET BinaryFormatter deserialization (AAEAAAD/////). PowerShell.Editor + Windows.Forms assembly. Base64 parca birlestirme. dugshellslungs ile calistirma.

vbscript-dotnet-reflection-loaderbinaryformatter-deserialization-aaeaaad-headerpowershell-editor-assembly-loadingsystem-windows-forms-dotnet-load
Continuer la lecture →
05
Yüksek AsusUpdateRAT

AsusUpdateRAT 624c6b56 -- ASUSTeK-Computer-disguise AsusUpdateSetup-exe JSON-C2-protocol cJSON-library hwid-ping-cmd-filemgr-fileupload-task-del InternetOpenW-HttpSendRequest cmd-exe-output-capture | Yuksek

AsusUpdateRAT 624c6b56 PE32 1.1MB. ASUSTeK Computer disguise (AsusUpdateSetup.exe). JSON C2 protokolu cJSON. hwid/ping/cmd/filemgr/fileupload/task/del. HTTP InternetOpenW+HttpSendRequest. cmd.exe output capture.

asustek-computer-update-disguiseasususupdatesetup-exe-fake-version-infojson-c2-protocol-cjson-libraryhwid-hardware-id-fingerprint
Continuer la lecture →
06
Kritik BlackBasta

BlackBasta Loader 65ca7ba8 -- Microsoft-Office-OSE-disguise Global-OfficeSourceEngine64Mutex ose-pdb self-modifying-ex_cod VirtualAlloc-runtime-API WinHttp-C2 SetThreadToken-DuplicateToken ecduu-obfuscated-string | Kritik

BlackBasta Loader 65ca7ba8 PE32 488KB. Microsoft Office Setup Engine (ose.pdb) kamuflagesi. Global\OfficeSourceEngine64Mutex. self-modifying .ex_cod section. VirtualAlloc+GetProcAddress runtime API. WinHttp C2. SetThreadToken.

black-basta-ransomware-loadermicrosoft-office-ose-pdb-disguiseglobal-officesourceengine64mutex-fake-mutexself-modifying-ex_cod-section-encrypted-code
Continuer la lecture →
07
Kritik BeastWasHere

BeastWasHere ESXi Ransomware 66f86812 -- ELF-32bit-Linux ChaCha20-encryption vim-cmd-vmsvc-getallvms VMDK-VMEM-VMXF BEASTWASHERE-marker beast-log default-key daemon-mode partial-encryption | Kritik

BeastWasHere ESXi Ransomware 66f86812 ELF32 89KB. vim-cmd vmsvc/getallvms ile ESXi VM otomasyonu. .vmdk/.vmem/.vmsd/.vmsn/.vmss/.vmxf sifreleme. BEASTWASHERE imzasi. ChaCha20. beast.log. Daemon modu.

beastwashere-esxi-ransomware-elf-linuxchacha20-stream-cipher-encryptionvim-cmd-vmsvc-getallvms-esxi-apivmdk-vmem-vmsd-vmsn-vmss-vmxf-encryption
Continuer la lecture →
08
Orta CurlHelperDLL

CurlHelperDLL 5129d1d2 -- libcurl-8-18-0 User-Agent-CurlHelper-1-0-Windows Bearer-token auth=Bearer TbcString Dll6-dll csdnimg-cn baidu-com CALG-RC4 CALG-AES-128 future-timestamp | Orta

CurlHelperDLL 5129d1d2 PE32 DLL 647KB libcurl 8.18.0 gomulu. User-Agent: CurlHelper/1.0. Bearer token auth. Dll6.dll TbcString C++. Cin: csdnimg.cn+baidu.com test URL. RC4+AES-128+RSA. future timestamp.

libcurl-8-18-0-embedded-dllcurlhelper-1-0-windows-unique-user-agentbearer-token-authorization-c2-authtbcstring-cpp-class-custom-string
Continuer la lecture →
09
Orta AutoITMalware

AutoITFTPInjector 4cc12d29 -- AutoIT3-compiled NoCmdExecute FtpOpenFileW FtpGetFileSize FTPSETPROXY VirtualAllocEx WriteProcessMemory CreateProcessAsUserW LogonUserW Wow64Disable AdjustTokenPrivileges | Orta

AutoITFTPInjector 4cc12d29 PE32 985KB AutoIT3 compiled Delphi wrapper. FtpOpenFileW+FtpGetFileSize+FTPSETPROXY. VirtualAllocEx+WriteProcessMemory injection. CreateProcessAsUserW. LogonUserW. Wow64DisableWow64FsRedirection.

autoit3-compiled-malware-scriptautoit-nocmdexecute-compile-flagftpopenfilew-ftpgetfilesize-ftp-capabilityftpsetproxy-proxy-ftp-upload
Continuer la lecture →
10
Orta WordVBAMacro

WordVBAMacro 58e3a3cd -- vbaProject-bin CreateObject Chr122-string-obfuscation Loop-filler mpn_F2Jws jPWM1x5r-sub-routine OOXML-word-2007-macro-dropper | Orta

WordVBAMacro 58e3a3cd Word 2007+ OOXML 243KB. vbaProject.bin VBA makro. CreateObject dropper API. Chr(122) string gizleme. Loop filler anti-analiz. Gizlenmis modul: mpn_F2Jws, Sub: jPWM1x5r.

word-vba-macro-dropper-ooxmlvbaproject-bin-compiled-vba-codecreateobject-wscript-shell-dropperchr122-string-char-concatenation-obfuscation
Continuer la lecture →
11
Orta DiscordCDNDropper

DiscordCDNDropper 41ed808a -- cdn.discordapp.com-attachments Jvvlpovxdup-dat-fake-extension RepositoryTokenFilter injectlast System-Net-Sockets CreateDelegate token-filter Discord-dead-drop | Orta

DiscordCDNDropper 41ed808a PE32 .NET x86 66KB. Discord CDN dead-drop: cdn.discordapp.com attachment Jvvlpovxdup.dat (.dat=gizli PE). RepositoryTokenFilter, injectlast, System.Net.Sockets.

discord-cdn-dead-drop-techniquediscordapp-com-attachment-payloaddat-extension-pe-disguiserepositorytokenfilter-token-validation
Continuer la lecture →
12
Orta GitHubRansomware

GitHubRansomware 3ea6df18 -- nguyenvietphat-Ransomware AES-RSA-encrypt vssadmin-delete-shadows wbadmin-delete-catalog-quiet winget-git-install svchost-exe ToBase64String torrent-spreading | Orta

GitHubRansomware 3ea6df18 PE32 .NET x86 289KB. Acik kaynak: github.com/nguyenvietphat/Ransomware. AES+RSA. vssadmin delete shadows + wbadmin delete catalog. svchost.exe.

github-public-open-source-ransomwarenguyenvietphat-ransomware-githubaes-encrypt-rsa-encrypt-hybridvssadmin-delete-shadows-all-quiet
Continuer la lecture →
13
Yüksek LANRansomware

LANRansomware 48877a3a -- Delphi folder-reserved-by-lan-encryptor AES-ECB-CTR dot-encrypted-extension how-to-decrypt-txt stealth-mode wipeonly-flag WSAStartup-network-scan 11-sections-TLS | Yuksek

LANRansomware 48877a3a Delphi PE32+ x64 535KB 11-section TLS. LAN network encryptor. AES-ECB+CTR. .-encrypted uzantisi. how_to_decrypt.txt. /stealth /wipeonly modlari. WSAStartup ag tarama.

delphi-lan-ransomware-network-spreaderfolder-reserved-lan-encryptor-network-shareaes-ecb-ctr-mode-encryptiondot-encrypted-extension-file-rename
Continuer la lecture →
14
Kritik CerberRansomware

CerberRansomware 4a2ad49c -- cerberhhyed5frqa-onion 4xTor2Web cevacont1234-gmail dot-cerber-extension auditpol-audit-disable VirtualAllocEx wallet-dat ipinfo-io 45ED-FB92 RaaS | Kritik

CerberRansomware 4a2ad49c PE32 x86 1.88MB RaaS. .cerber uzantisi. 4 Tor2Web C2 proxy (cerberhhyed5frqa.onion). auditpol.exe denetim logu devre disi. VirtualAllocEx enjeksiyonu. wallet.dat. ipinfo.io.

cerber-ransomware-raas-2016-2017cerberhhyed5frqa-onion-tor2web-c2dot-cerber-encrypted-extensionauditpol-exe-audit-log-disable
Continuer la lecture →
15
Kritik MazeRansomware

MazeRansomware 4263eacd -- RSA2048-ChaCha20 DECRYPT-FILES-txt WMI-Win32ShadowCopy-delete autorun-inf-USB InternetOpenA-HTTP-C2 CryptAcquireContextW 1-section-PE | Kritik

MazeRansomware 4263eacd PE32 x86 920KB 1-section. RSA-2048+ChaCha20. DECRYPT-FILES.txt. WMI Win32_ShadowCopy shadowcopy delete (cmd.exe yok). autorun.inf USB yayilim. HTTP C2.

maze-ransomware-2019-2020-rsa2048-chacha20-hybriddecrypt-files-txt-ransom-notewmi-win32shadowcopy-delete-no-cmdautorun-inf-usb-spreading
Continuer la lecture →
16
Kritik RemcosRAT

RemcosRAT 40079f05 -- BreakingSecurity-net ProcessHollowing NtUnmapViewOfSection EnableLUA-UAC-bypass KeyloggerInit TLS13-AES128-GCM BCryptGenRandom ClipboardMonitor AudioCapture Chrome-LoginData | Kritik

RemcosRAT 40079f05 PE32 x86 514KB. BreakingSecurity.net. Process hollowing NtUnmapViewOfSection. UAC bypass EnableLUA=0. Keylogger+Clipboard+Audio+Screenshot. Chrome Login Data. TLS 1.3.

remcos-rat-breakingsecurity-net-sellerprocess-hollowing-ntunmapviewofsectionuac-bypass-enablelua-registrykeylogger-getasynckey-hook
Continuer la lecture →
17
Yüksek TiGeRFirewall

TiGeRFirewall 39cbd2d2 -- Brazilian-Banking-Trojan LORDDecrypt Umbrella-flv-exe netsh-firewall-allowedprogram avicap32-webcam Adobe-Update-disguise ClipboardProxy | Yuksek

TiGeRFirewall 39cbd2d2 PE32 .NET 93KB. Brezilya banking trojan. LORDDecrypt. Umbrella.flv.exe. netsh firewall add allowedprogram. avicap32.dll webcam. Adobe Update maskesi.

tiger-firewall-brazilian-banking-trojanlorddecrypt-base64-md5-obfuscationumbrella-flv-exe-fake-media-droppernetsh-firewall-allowedprogram-bypass
Continuer la lecture →
18
Yüksek NimMalware

NimMalware 3de6a48a -- winim5.7.48 puppy4.9.4 allowAnyHttpsCertificate zippy4.9.8 WinHttpSendRequest mingw-gcc-9.3 sinc-shellapi-windef 18-sections TLS | Yuksek

NimMalware 3de6a48a PE32 x86 811KB MinGW GCC 9.3. winim 5.7.48 + puppy 4.9.4 (allowAnyHttpsCertificate) + zippy. WinHttpSendRequest. 18 section TLS.

nim-programming-language-malwarewinim-5-7-48-windows-api-bindingspuppy-4-9-4-http-client-libraryallowanyhttpscertificate-ssl-bypass
Continuer la lecture →