🧠 Malware analyst & reverse engineer 🦠 Ransomware, loaders, stealers & RATs 🔬 Reverse engineering • crypto • tooling 📍 Technical research. No buzzwords.
Joined May 2025
- Tweets779
- Following190
- Followers1.2K
- Likes4K
ShadowOpCode retweeted
⚠️@NetflixIT #Phishing
red-netf[.]dcsscs[.]top
👇
netflix[.]renew-service01373[.]net
RELATED
xitter.cf/skocherhan/status/2070…
#fraud #malware #CyberSecurity #InfoSec #Italy #IT
ShadowOpCode retweeted
#Deobfuscation of a Dynamic #Phishing JS Payload: the script dynamically spoofs the target's branding in real-time, implements a dual-submission password check, and redirects to the legitimate domain to evade suspicion
#InfoSec #CyberSecurity
ShadowOpCode retweeted
A PyInstaller loader uses PowerShell to bypass policies, profiles the victim's IP, and ensures persistence. It runs the #Efimer malware which exfiltrates via Tor.
See images for details (JS #Deobfuscation)
#Malware #Crypto #Stealer #ReverseEngineering
xitter.cf/skocherhan/status/2021…
ShadowOpCode retweeted
🎣subito.it Phishing
subito-verifica[.]help ( Created 20 hours ago‼️)
👇
subito[.]id-28923[.]help
#Phishing #Infosec #CyberSecurity #ThreatAlert
ShadowOpCode retweeted
⚠️ @PosteItaliane Phishing site
According to VT punto-poste[.]online was created on 2026-01-24 (2 hours ago !!)
Found Telegram Bot hxxps[:]//api[.]telegram[.]org/bot8120410501:AAEqvNP32lhexgk_xSMvtSfFfk5b8M9q0nU/sendMessage
@AgidCert @JAMESWT_WT @guelfoweb @skocherhan
ShadowOpCode retweeted
DLL Loader utilizing TEA-based decryption routine and process hollowing. It uses anti-analysis techniques including system firmware tables enum and advanced shellcode-based CPUID execution. Flag 1 indicates the presence of a VM env and execution stops
xitter.cf/JAMESWT_WT/status/2007…
#booking spread #Aotera > #asyncrat via Vlc DllSideLoading
👇
⛔️admin-extranet-information.]com/?ref=889988
👇
⛔️willyprosty.]com/bpyosuiq
👇
⛔️bestcruisetravelinsurance.]com/maishywuqoskfa.zip
✅Samples
bazaar.abuse.ch/browse/tag/b…
cc @k3dg3 @500mk500 @skocherhan
ShadowOpCode retweeted
Interesting killchain:
PowerShell loader to reconstruct the NetSupport RAT from an embedded JSON payload containing the binaries of the required files. Execution is proxied through explorer.exe to mask the malicious origin
xitter.cf/JAMESWT_WT/status/2003…
1/2 #booking #fakecaptcha #clickfix>#netsupport
⏬
Aggiornamento Vi chiediamo di rispondere entro 24 ore
👇
⛔️accountspagemain-com
uri.html
vpv.html
👇
⛔️77.90.60.32
123.txt
y.GRE (netsupport)
👇
Gateway
⛔️rentalsmcx.]com:443
⛔️185.39.19.]95:443
cc @k3dg3 @500mk500 @skocherhan
ShadowOpCode retweeted
Phishing "Pedaggio non pagato"
autostde[.]com domain created today (2025-11-19)
@AgidCert
@JAMESWT_WT @illegalFawn @guelfoweb @AndreaDraghetti @marsomx_
ShadowOpCode retweeted
Caminho Loader Malware Analysis
#CaminhoLoader #malware #ThreatIntel
@smica83
@ShadowOpCode
xitter.cf/smica83/status/1988537…
ShadowOpCode retweeted
HTA file deobfuscation from the "fake DMCA report" phishing campaign. Key features shown in the screenshots
@_JohnHammond @vxunderground @ShadowOpCode
xitter.cf/_JohnHammond/status/19…
Yesterday folks got a phishing email for a fake DMCA report-- myself included. Caught me at a good time so I could record poking at the scam and the malware it leads to: ultimately infostealer malware (the usual) from a fake domain & clearly AI slop site: youtu.be/IzKjL16-sgY
ShadowOpCode retweeted
🚫 Il dominio è stato dismesso!
Dalle 04:50 di oggi il team Abuse di @Hostinger lo ha disattivato; attualmente non è più raggiungibile.
Come ci segnala l’utente @ShadowOpCode su X, questa mattina il codice della pagina è stato modificato: ora viene inviata una richiesta GET a un dominio esterno ospitato su #Supabase, una piattaforma open-source che offre database.
ShadowOpCode retweeted
Come ci segnala l’utente @ShadowOpCode su X, questa mattina il codice della pagina è stato modificato: ora viene inviata una richiesta GET a un dominio esterno ospitato su #Supabase, una piattaforma open-source che offre database.
🇮🇹 #Phishing sulla verifica del permesso di soggiorno prende di mira i cittadini stranieri in #Italia
📅 Il dominio registrato il 13 ottobre 2025, giorno successivo all’avvio del sistema.
ℹ️ Approfondimenti 👇
🔗 cert-agid.gov.it/news/phishi…
ShadowOpCode retweeted
Saw some report on a information stealer named MaksStealer, or MaksRat, or something.
Written in Java, multi-staged, delivered from some Minecraft place. The dude makes it pretty clear he's just a kid, probably around 17 years old. He seems pretty happy Threat Intelligence and Malware Analysts have looked at his work.
Proud of you, kid. You shouldn't facilitate crime and steal peoples identities and/or credentials, or operate a Malware-as-a-Service campaign, but the code looks pretty solid. You get a cat for being a clever kid.
ShadowOpCode retweeted
🚨Alert: Internet Archive abused as hosting service for stealthy malware delivery
🔍This delivery chain is another example of legitimate and trusted services being abused for malware delivery: it starts with a JScript loader launching a PowerShell script which then downloads a PNG image file from the Internet Archive (archive.org). The PowerShell loader then extracts and launches an obfuscated .NET loader in memory, which launches Remcos RAT.
In a nutshell:
📜PowerShell loader launched via JScript pulls .NET loader - embedded in an image - from archive.org
🌐.NET loader is encoded in RGB values of individual pixels of a Bitmap contained in the original PNG
🔑.NET loader creates persistence via registry key and launches final Remcos RAT payload
🔐 payload uses "Duck DNS" DynDNS provider for C2
Check out VMRay's Dynamic Analysis report to get insights on behavior and detections: vmray.com/analyses/_vt/65502…
Sample SHA256: 655025f2ea7fd15e7ee70b73b2e35f22b399b19130139345344f7a34fd592905
.NET loader SHA256: a777f34b8c2036c49b90b964ac92a74d4ac008db9c3ddfa3eb61e7e3f7c6ee8a
Remcos payload (memory dump) SHA256: ca68cc3f483f1737197c12676c66b7cc9f836ba393ac645aa5d3052f29cdb2e0
ShadowOpCode retweeted
#databreach Hotel italiani 🇮🇹
Un nuovo nome del turismo italiano si aggiunge alla lista delle precedenti perdite di dati, con documenti di identità di cittadini in vendita su forum underground!
#Astoria Suite #Hotel
☠️ sempre “mydocs”
🗃️20,8K Passaporti e ID
ShadowOpCode retweeted
LeetStealer #MalwareAnalysis
In-depth analysis of Leet Stealer and its RAT module, featuring reverse engineering of the malicious code and live execution of the RAT. The images highlight the core functionalities of both components
#LeetStealer #Infosec #ThreatIntelligence
ALT Leet Stealer - Stealer Component
ALT Leet Stealer - RAT Component
ShadowOpCode retweeted
#MaksStealer #Java #Stealer
87 Samples Related to👇
⛔️C2👇
www.makslove[.xyz
www.mavenrat[.xyz
makslibraries[.fun
👇
bazaar.abuse.ch/browse/tag/m…
#MaksStealer #Java #Stealer is BACK
MD5: c337a275334395209a2c8d7696149bbb
Dropped: 44a6da190ab1592c6df62bfedd408143
New C2: www.mavenrat[.xyz (2025-05-23)
🔻 Signature: "HelloImMaxIm17yoILoveMakingRATs..."
🔻 Debug: in 🇷🇺
Same TTPs as: xitter.cf/ShadowOpCode/status/19…
@JAMESWT_WT #malware
