_re_fox (@_re_fox) header
_re_fox (@_re_fox) profile picture

_re_fox

@_re_fox
Joined November 2019
  • Tweets280
  • Following20
  • Followers1.2K
89Media
Photo by _re_fox (@_re_fox)Photo by _re_fox (@_re_fox)Photo by _re_fox (@_re_fox)Photo by _re_fox (@_re_fox)Photo by _re_fox (@_re_fox)Photo by _re_fox (@_re_fox)Photo by _re_fox (@_re_fox)Photo by _re_fox (@_re_fox)Photo by _re_fox (@_re_fox)Photo by _re_fox (@_re_fox)
#malware #DOUBLEBACK c41e2c2cc5843cedd79162c73787d4de XOR key for config: 0x000001bf C2: https://greeklife242[.]com/admin8/client.php https://cdnprojects[.]net/admin8/client.php
6
9
#malware rtf template injection IDEAS 2022.doc - 35eadf808d958c01bd4b6b18a3ade34e Template -> http://log[.]bookservices[.]xyz/Ods9Z6420zj7Y9H3/OsVoOaari3CP2x4i.php
2
1
5
#malware template injection 17efa6a9b3547aaad4588c07f9773e6a - ( ගුවන් හමුදා සේවා පුද්ගලයින් අනුයුක්ත කර ගැනීම.doc) Template: http://records.hibiscus[.]live/NDnD7RdekyhSrhPE/KOighzucGWiCq6hR.php 146.70.29[.]251
3
7
1
19
Copy of template: a2b3599d36c2ab1317b4560931f689cb virustotal.com/gui/file/5b6c…
1
1
3
Linux .desktop entry #malware 09857e9e3676ee079de645e7dd4a65ec - Def_Coop_Mtg.odt.desktop Decoy: http://www.mea[.]gov[.]in/Portal/CountryNews/11790_Press_Statement_EAM_visit_5_September.docx DL and exec: http://178.18.249[.]42/mtg.sh -> http://178.18.249[.]42/calendar
1
2
4
calendar - b87cd60214a804b29ab091b73e864884 (pyinstaller) Entrypoint: client_socket.pyc
1
1
3
client_socket C2: 178.18.249.42:8082 command execution and the following built in commands: - pg - send "ok" - cd - chdir - ls - listdir - lldf - sendFile - llda - sendAllFiles - lldd - sendDirectoryFiles
1
3
#malware #cobaltstrike 8bb1f74efaa8b736764b38e8f50706e8 (新建文件夹 (2).docx) Template Injection -> http://rainy-autumn[.]top/Doc1.dotm (91b39d68a67bb067209faebf8bb25dee) containing macro with shellcode C2: 81.70.203[.]138/onJ5
Image from _re_fox (@_re_fox)
3
4
14
#malware #cobaltstrike Same decoy 745eecaf3a17d34de29fbe990df899af (好东西.docx) Template Injection -> http://121.196.184[.]210:8000/123.docm
1
4
And another c069fa3ee33e661dcb6a27c89548a487 (李彤彤简历-90sec.docx) Template Injection -> http://167.179.70[.]183:8080/diaoyu.dotm
3
#malware Call-for-Proposal-DGSP-COAS-Chair-Excellance[.]zip Containing #lnk 261fa3263efc672ed853c7b327b64d70 mshta -> iiieyehealth[.]com Drops winidr.exe (76f427732d65127b631822e84158fab3) C2 http://161.97.142[.]96/htt_p app.any.run/tasks/1e78d9b8-e…
Image from _re_fox (@_re_fox)
1
8
#malware #lnk COVID_19_Test_Result.zip Containing LNK (Password_Document.xml_;.lnk) that launches pass.vbs (b73cfb56875355db0cea8b3b0b251a2f) C2: transfermychoice[.]com (129.146.45[.]144)
2
3
9
Similar decoy 380726ce279bf46bb942732b246272a1 (resume.docx) Template Injection -> https://fort-communications[.]com/view/index.php (1c15a93806ee6bfa079cb5f92b61ff58) Drops license.vbs (ad08b919f3f427e082128739cf72447e) C2: adsclickboost[.]com/key/license/gate.php
Image from _re_fox (@_re_fox)
1
2
#APT #Gamaredon (b059248480fe52bb07296d0b67ffaf88) arhiv.rar containing Microsoft Word Document.docx.lnk (aefc6e9a78a78fcde75a1fd64e6c0c61) mshta -> email-gov[.]site/puzzled/updates.html
1
4
9
#APT #Gamaredon arhiv.rar (75ae7cde900541d2ebd9fd8c8032d9c8) containing Microsoft Word Document.docx.lnk (7227d052bd1e4a00b8a3ba32e2ac7cd2) mshta -> email-gov[.]site/encouragement/updates.html (195.161.114[.]130) app.any.run/tasks/ca666b4c-2…
File analysis · MD5: 75AE7CDE900541D2EBD9FD8C8032D9C8 · No threats detected - Interactive analysis...

File analysis · MD5: 75AE7CDE900541D2EBD9FD8C8032D9C8 · No threats detected - Interactive analysis...

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run
1
7
Using the same decoy doc: 808b723dee90b29721f7a400b17f419e -> 144.34.243[.]45/Microsoft office.docm b9a3d5ebba6d184ff84ef18b5ea99319 -> 144.34.243[.]45/Microsoft office.docm adb6b28eca587767cf60535e5dfbfc63 -> github[.]com/Valerian7/cs/blob/main/Doc1.dotm
1
1
#malware COVID_19_Result.zip (c8dba24e5550cbbea350776067d270db) Contains Document_Password.xml_;.lnk ( a9e1dde21d8ed9473aef11fb36421a9f) which launches License.vbs (902d0d515a5a3b687e5e7fdc62bb6f58) Comms to speedtestofwifi[.]com (104.26.14[.]17) app.any.run/tasks/a67d0b4b-8…
File analysis · MD5: C8DBA24E5550CBBEA350776067D270DB · Malicious activity - Interactive analysis...

File analysis · MD5: C8DBA24E5550CBBEA350776067D270DB · Malicious activity - Interactive analysis...

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run
1
7
8
#malware #Gamaredon f69122c6f70990f75dc0886f0befaf5e План СПА на 2020 рік.docx Template Injection - > http://raggina[.]space/BC855646D052/spool/boot/aCxBBz.dot
Image from _re_fox (@_re_fox)
3
15
#malware 2ed12bb3b6a6f6af26010e258b52f10b desglose.docx Template Injection -> http://194.36.190[.]41:8000/template.dotm w/macro (fd73fbc3f67f412b749501835e40ee44) Drops exe C:\Windows\Temp\tex_doc.pdf (f6c08c1c6c4d4e889de8b18510102f4d) Internal name of "sharp_RunDLLDonut.dll"
1
4
1
12
#malware บัญชี.นศ.ปี63[.]zip 2a312897fa7fdccc965dc9f081802310 Contains #lnk passwd(1).txt[.]lnk 72cc80886ac3a72c11e43d91b9b4ce3f PS -> DL & Exec .bat -> http://lib2[.]md[.]chula[.]ac[.]th/files/static/robots.txt
2
2
9
.bat script drops http://lib2[.]md[.]chula[.]ac[.]th/files/static/x86/mscore-thx86.dll and https://github[.]com/dmarcus1337/helloworld/raw/main/config.ini.txt.lnk.lnk
1
1
2
Triggering on #CobaltStrike Dll -> gpupdate.exe -> c2: 161.200.107[.]99 app.any.run/tasks/6699879a-4…
File analysis · MD5: 5123F37E5543E688352A302A439A281A · Malicious activity - Interactive analysis...

File analysis · MD5: 5123F37E5543E688352A302A439A281A · Malicious activity - Interactive analysis...

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run
1
4
Load more