EN DIRECT
QUASARRATQuasarRAT140 3b16f98e -- QuasarClient1.4.0 MouseKeyHook-v5.6 YandexPassReader FirefoxPassReader WinSCPDecrypt schtasks Protobuf-net IpGeoLocation ChromiumDecryptor | Kritik◆COOLPROJECTLOADERCoolProjectLoader 2eac9624 -- virtual-developer cool-project-lol Injected-benign-GUI-resourceMZ LoaderBootstrap MemoryMappedFiles AES-payload net48-stub | Yuksek◆QUASARSTEALERQuasarStealer 2e6fbd14 -- QuasarRAT ChromePassReader EdgePassReader BravePassReader FirefoxPK11SDR YandexPassReader FileZilla WinSCP ChromiumDecryptor DecryptAesGcm | Yuksek◆DIDDYWAREJAVARATDiddywareJavaRAT 2e18f573 -- s1gnal-dev BrowserGrabber DiscordGrabber SteamGrabber WebhookSender StealerCore RAT-modules Java-stealer | Yuksek◆MEDUSARANSOMWAREMedusaRansomware 2e62a782 -- CMedusaCrypt BCryptEncrypt RSA DoubleExtortion VeeamKill WBEngine Zoolz PDB-GazeRelease TOR-Decrypt | Kritik◆TRICKBOTMULTIDROPPERTrickBotMultiDropper 12454a32 -- TrickBotXMRMiner apifoxovskyru CPUMinerThread BrokenShield revShell SteamGhost AsusShellcode PayloadDownload 1226byexyz | Kritik◆ALLATORIJAVARATAllatoriJavaRAT 1d5bea0a -- Allatori-Obfuscated Java IIlIlllIIII JNA Advapi32 Shell32 IPHlpAPI Cfgmgr32 Windows-API Java-Native-Access | Yuksek◆SVCHOSTVNCINJECTORSvchostVNCInjector 16278643 -- ReflectiveLoader MapDLL VncMT svchost-inject CreateToolhelp32Snapshot Process32FirstW CreateFileMappingW MapViewOfFile IsWow64Process | Kritik◆C2 ACTIFAgentTesla — digicert.com◆C2 ACTIFAsyncRAT — system.io◆C2 ACTIFAgentTesla — stem.ru◆C2 ACTIFAsyncRAT — system.io◆C2 ACTIFAsyncRAT — microsoft.com◆CVE-2021-44228Apache Log4j2 JNDI enjeksiyon açığı (Log4Shell). Uzaktan kod yürütmeye olanak ta◆CVE-2024-3400Palo Alto Networks PAN-OS GlobalProtect'te OS komutu enjeksiyonu açığı. Kimlik d◆CVE-2020-1472Netlogon Uzak Protokolü'nde ayrıcalık yükseltme açığı (Zerologon). Kimlik doğrul◆CVE-2023-20198Cisco IOS XE Web UI'de ayrıcalık yükseltme açığı. Uzaktaki kimliği doğrulanmamış◆CVE-2024-1709ConnectWise ScreenConnect kimlik doğrulama bypass açığı. Kurulum sihirbazı endpo◆QUASARRATQuasarRAT140 3b16f98e -- QuasarClient1.4.0 MouseKeyHook-v5.6 YandexPassReader FirefoxPassReader WinSCPDecrypt schtasks Protobuf-net IpGeoLocation ChromiumDecryptor | Kritik◆COOLPROJECTLOADERCoolProjectLoader 2eac9624 -- virtual-developer cool-project-lol Injected-benign-GUI-resourceMZ LoaderBootstrap MemoryMappedFiles AES-payload net48-stub | Yuksek◆QUASARSTEALERQuasarStealer 2e6fbd14 -- QuasarRAT ChromePassReader EdgePassReader BravePassReader FirefoxPK11SDR YandexPassReader FileZilla WinSCP ChromiumDecryptor DecryptAesGcm | Yuksek◆DIDDYWAREJAVARATDiddywareJavaRAT 2e18f573 -- s1gnal-dev BrowserGrabber DiscordGrabber SteamGrabber WebhookSender StealerCore RAT-modules Java-stealer | Yuksek◆MEDUSARANSOMWAREMedusaRansomware 2e62a782 -- CMedusaCrypt BCryptEncrypt RSA DoubleExtortion VeeamKill WBEngine Zoolz PDB-GazeRelease TOR-Decrypt | Kritik◆TRICKBOTMULTIDROPPERTrickBotMultiDropper 12454a32 -- TrickBotXMRMiner apifoxovskyru CPUMinerThread BrokenShield revShell SteamGhost AsusShellcode PayloadDownload 1226byexyz | Kritik◆ALLATORIJAVARATAllatoriJavaRAT 1d5bea0a -- Allatori-Obfuscated Java IIlIlllIIII JNA Advapi32 Shell32 IPHlpAPI Cfgmgr32 Windows-API Java-Native-Access | Yuksek◆SVCHOSTVNCINJECTORSvchostVNCInjector 16278643 -- ReflectiveLoader MapDLL VncMT svchost-inject CreateToolhelp32Snapshot Process32FirstW CreateFileMappingW MapViewOfFile IsWow64Process | Kritik◆C2 ACTIFAgentTesla — digicert.com◆C2 ACTIFAsyncRAT — system.io◆C2 ACTIFAgentTesla — stem.ru◆C2 ACTIFAsyncRAT — system.io◆C2 ACTIFAsyncRAT — microsoft.com◆CVE-2021-44228Apache Log4j2 JNDI enjeksiyon açığı (Log4Shell). Uzaktan kod yürütmeye olanak ta◆CVE-2024-3400Palo Alto Networks PAN-OS GlobalProtect'te OS komutu enjeksiyonu açığı. Kimlik d◆CVE-2020-1472Netlogon Uzak Protokolü'nde ayrıcalık yükseltme açığı (Zerologon). Kimlik doğrul◆CVE-2023-20198Cisco IOS XE Web UI'de ayrıcalık yükseltme açığı. Uzaktaki kimliği doğrulanmamış◆CVE-2024-1709ConnectWise ScreenConnect kimlik doğrulama bypass açığı. Kurulum sihirbazı endpo◆
Recherche en sécurité KEYDAL

Renseignement sur les menaces malware
Plateforme

Analyses de menaces complètes, IOC et rapports de recherche sur RAT, Infostealer, Backdoor et autres familles de malwares.

89386Rapports
392Familles
293703IOC
68CVE
6182C2
Familles de malwares Serveurs C2 Base CVE
À LA UNE
Kritik QuasarRAT

QuasarRAT140 3b16f98e -- QuasarClient1.4.0 MouseKeyHook-v5.6 YandexPassReader FirefoxPassReader WinSCPDecrypt schtasks Protobuf-net IpGeoLocation ChromiumDecryptor | Kritik

QuasarRAT v1.4.0 tam istemci 441KB. Quasar.Client + Quasar.Common 1.4.0. MouseKeyHook fare+klavye hook. YandexPassReader/FirefoxPassReader/WinSCPDecrypt. schtasks persistence.

quasar-rat-v1-4-0-open-source-ratquasar-client-recovery-browsersmousekeyhook-pgma-v5-6-keyloggeryandex-pass-reader-recoveryfirefox-pk11sdr-pass-reader
Lire l'analyse complète

Derniers rapports

02
Yüksek CoolProjectLoader

CoolProjectLoader 2eac9624 -- virtual-developer cool-project-lol Injected-benign-GUI-resourceMZ LoaderBootstrap MemoryMappedFiles AES-payload net48-stub | Yuksek

CoolProjectLoader 2eac9624 PE32+ .NET 907KB. Gelistirici: virtual, proje: cool project lol. Injected benign GUI resourceMZ. LoaderBootstrap 2-asamali yukleyici. MemoryMappedFiles.

cool-project-lol-malware-loadervirtual-developer-desktop-malware-projectsinjected-benign-gui-resource-av-bypassloaderbootstrap-two-stage-dotnet
Continuer la lecture →
03
Yüksek QuasarStealer

QuasarStealer 2e6fbd14 -- QuasarRAT ChromePassReader EdgePassReader BravePassReader FirefoxPK11SDR YandexPassReader FileZilla WinSCP ChromiumDecryptor DecryptAesGcm | Yuksek

QuasarStealer 2e6fbd14 PE32 59KB. Quasar.Client.Recovery.FtpClients. Chrome/Edge/Brave/Firefox/Yandex sifre hırsızı. FileZilla+WinSCP FTP. DecryptAesGcm+PK11SDR_Decrypt.

quasar-rat-client-recovery-modulechromiumdecryptor-chrome-edge-bravefirefoxdecryptor-pk11sdr-decryptyandex-browser-ya-passman-stealer
Continuer la lecture →
04
Yüksek DiddywareJavaRAT

DiddywareJavaRAT 2e18f573 -- s1gnal-dev BrowserGrabber DiscordGrabber SteamGrabber WebhookSender StealerCore RAT-modules Java-stealer | Yuksek

DiddywareJavaRAT 2e18f573 JAR 554KB. Gelistirici: s1gnal. DiddywareClient. BrowserGrabber (Chrome/Firefox/Edge/Brave) + DiscordGrabber + SteamGrabber + WebhookSender Discord C2.

diddyware-java-rat-s1gnal-developerbrowser-grabber-chrome-firefox-edge-bravediscord-token-grabber-discordgrabbersteam-account-grabber-steamgrabber
Continuer la lecture →
06
Kritik TrickBotMultiDropper

TrickBotMultiDropper 12454a32 -- TrickBotXMRMiner apifoxovskyru CPUMinerThread BrokenShield revShell SteamGhost AsusShellcode PayloadDownload 1226byexyz | Kritik

TrickBotMultiDropper 12454a32 PE32+ x64 332KB. TrickBot miner api.foxovsky.ru/gate/connection.php. CPUMinerThread. BrokenShield PDB. 8 C2 IP. 1226bye.xyz:280.

trickbot-xmr-miner-cpuminerthreadapi-foxovsky-ru-gate-connection-phpbroken-shield-injection-dllsteamhook-steam-ghost-injection
Continuer la lecture →
08
Kritik SvchostVNCInjector

SvchostVNCInjector 16278643 -- ReflectiveLoader MapDLL VncMT svchost-inject CreateToolhelp32Snapshot Process32FirstW CreateFileMappingW MapViewOfFile IsWow64Process | Kritik

SvchostVNCInjector out.dll 439KB. Export: SvchostInjector.x64.dll::MapDLL. ReflectiveLoader. Vnc_MT. CreateToolhelp32Snapshot svchost.exe. MapViewOfFile. Cobalt Strike BOF benzeri.

reflective-dll-injection-cobalt-strike-stylesvchost-process-injectionvnc-remote-desktop-capturemapdll-export-reflective
Continuer la lecture →
10
Yüksek WTSSessionHijacker

WTSSessionHijacker 068af801 -- WTSEnumerateSessionsW WTSQueryUserToken LogonUserW AuthzAddSidsToContext ClearEventLogA ControlService RDP Token Theft 300KB Encrypted rsrc | Yuksek

WTSSessionHijacker 068af801 PE32 x86 396KB. WTSEnumerateSessionsW WTSQueryUserToken. LogonUserW + AuthzAddSidsToContext SID eskalasyon. ClearEventLogA. 300KB sifreli rsrc payload.

wts-rdp-session-hijackingwts-enumeratesessionsw-wts-queryusertokenlogonuserw-credential-authauthzaddsidstocontext-authzinitializecontextfromsid-sid-escalation
Continuer la lecture →
11
Kritik JSDropperLoader

JSDropper 06cd8dcf -- XOR Custom AES-256 Modified SBOX PowerShell MSBuild Hollow OmniCascade QuartzMediator WScript ADODB ConvertFrom-Base28 XLoader ModiLoader | Kritik

JSDropper 06cd8dcf JS 804KB. 3 katman: XOR + Ozel AES-256 (degis SBOX) + PSLoader. MSBuild.exe hollow. OmniCascade assembly. WScript.Shell.Run ADODB.Stream.

javascript-dropper-malwarexor-obfuscation-key-20-142custom-aes256-nonstandard-sbox-rconmsbuild-exe-process-hollowing
Continuer la lecture →
12
Yüksek PSLoaderDLL

PSLoaderDLL 05c72e77 -- WMI PowerShell bypass nop hidden Execution HTTP Multipart POST macOS Chrome User-Agent null.jsbin.com Fake Origin tpp0 tpp1 Custom Extension | Yuksek

PSLoaderDLL 05c72e77 PE32 DLL x86 413KB. WMI process call create PowerShell -bypass -nop -hidden. HTTP POST multipart macOS Chrome UA. Origin: null.jsbin.com. .tpp0/.tpp1 extensions.

psloaderdllwmi-process-call-create-powershell-executionpowershell-executionpolicy-bypass-nop-w-hiddenhttp-multipart-post-form-upload
Continuer la lecture →
13
Kritik RussianDelphiRansomware

RussianDelphiRansomware 0442cfab -- shopping-na-divane.ru shoptorgvlg.ru inst.php C2 Plaintext Johnmen.24@aol.com Email IOC FGIntRSA RSA ENCRYPTSTART ENCRYPTENDED Delphi | Kritik

Russian Delphi ransomware 0442cfab .Ransomware extension 379KB. C2: shopping-na-divane.ru + shoptorgvlg.ru /inst.php. Email: Johnmen.24@aol.com. FGIntRSA RSA. ENCRYPTSTART/ENCRYPTENDED markers.

russian-delphi-ransomwareshopping-na-divane-ru-c2-russian-domainshoptorgvlg-ru-c2-volgograd-russiainst-php-c2-endpoint
Continuer la lecture →
14
Kritik RagnarLocker

RagnarLockerRansomware 041fd213 -- RAGNAR SECRET Confirmed CryptEncrypt File Encryption GetDriveTypeW Drive Enumeration OpenProcessToken DuplicateTokenEx Privilege Escalation | Kritik

RagnarLocker 041fd213 PE32 GUI x86 818KB entropy 7.97. RAGNAR SECRET string onay. CryptEncrypt dosya sifreleme. GetDriveTypeW drive enumeration. OpenProcessToken DuplicateTokenEx privilege escalation.

ragnar-locker-ransomwareragnar-secret-string-confirmedcryptacquirecontextw-cryptencrypt-windows-crypto-apigetdrivetypew-findnextfilew-drive-file-enumeration
Continuer la lecture →
16
Orta FTPInjectorLoader

FTPInjectorLoader 00f01750 -- VirtualAllocEx WriteProcessMemory Process Injection FtpOpenFileW HTTP InternetSendRequest XOR CryptAcquireContextA AdjustTokenPrivileges | Orta

FTPInjectorLoader 00f01750 PE32 GUI x86 1.4MB. VirtualAllocEx WriteProcessMemory process injection. FtpOpenFileW FtpGetFileSize FTP kanal. HttpSendRequest HTTP. XOR + CryptAcquireContextA.

ftpinjectorloaderprocess-injectionvirtualallocex-writeprocessmemory-injection-confirmedftpopenfilew-ftpgetfilesize-ftp-channel
Continuer la lecture →
17
Yüksek EternityStealer

EternityStealer 025e74a9 -- Eternity.exe Confirmed ConfuserEx AES Sifreleme Win32Clipboard Pano Hijack BTC ETH Kripto Degistirme AesCryptoServiceProvider ICryptoTransform | Yuksek

EternityStealer 025e74a9 .NET PE32 x86 63KB. Eternity.exe string ile onay. ConfuserEx obfuskasyon. AesCryptoServiceProvider AES-CBC. Win32Clipboard + Clipboard Manager BTC pano hijack.

eternity-stealereternity-exe-string-confirmedconfuserex-obfuscation-random-namespaceaescryptoserviceprovider-icryptotransform-aes-cbc-encryption
Continuer la lecture →
18
Yüksek SteamMonitorStealer

SteamMonitorStealer c6433d9a -- steam_monitor_02F90000.dl Steam Hesap Izleme DLL IsDebuggerPresent Anti-Debug WSAStartup Ag Baglanti XOR Obfuske String cmd.exe | Yuksek

SteamMonitorStealer c6433d9a PE32 DLL x86 696KB packed 7.04 entropi. steam_monitor Steam hesap hedef. IsDebuggerPresent anti-debug. WSAStartup ag. XOR obfuske string. cmd.exe start.

steammonitorstealersteam-stealersteam-monitor-02f90000-dl-filename-iocsteam-gaming-platform-credential-theft
Continuer la lecture →
20
Yüksek FalseXmrigRAT

FalseXmrigRAT f38504f5 -- NtUnmapViewOfSection Process Hollowing AVICAP32 Webcam GdipFree Screenshot FtpPutFileA FTP Exfil URLDownloadToFileA UPX Packed xmrig Kimligiyle Taklitci | Yuksek

FalseXmrigRAT f38504f5 UPX PE32 x86 355KB. NtUnmapViewOfSection process hollowing. AVICAP32 webcam. GdipFree screenshot. FtpPutFileA FTP exfil. URLDownloadToFile. xmrig madenci taklidi.

falsexmrigratprocess-hollowingntunmapviewofsection-process-hollowing-confirmedavicap32-dll-capgetdriverdescriptiona-webcam-access
Continuer la lecture →