f you're using any of those Monster A19 wifi lightbulbs (monsterilluminessence . com) be aware your data appears to be going to @splunk cloud.
Remote
James_inthe_box
@james_inthe_box@infosec.exchange
mastodon 4.8.0-alpha.3+glitch635 Followers
178 Following
45 Posts
Joined November 07, 2022
Couple #screenconnect droppers at:
https:// doc. papperldoculess\.top/edocument/
In light of recent LLM's breaking out of their guardrails and doing damage, I felt compelled to write this.
https://gist.github.com/silence-is-best/e8fe274d219fc509ed950286deeae502
Replying to @jabster28@mace.lol
Handful of IOC's for those .js #purelogs #stealer #malspams:
https://app.any.run/tasks/43e561e4-707a-4189-8b4c-d4795b2451a6
Exfil port is 4449
Calls hidden Edge
Calls hidden Chrome
#clickfix to #vidar (among other things) via:
http:// www\.apcconstruction\.com/
https://app.any.run/tasks/4599dbb0-1041-43f3-b127-a42cfc7ca60e
A csv formatted list of #malspam campaigns that crossed my path in July to include #malware type, subjects, c2's, hashes, and email exfil addresses:
https://gist.github.com/silence-is-best/48b613e82bf64f1fd8b9a231ccdd590b
#retrohunt
Replying to @wdormann@infosec.exchange
@wdormann@infosec.exchange @mjg59@nondeterministic.computer Honestly I always thought secure boot was the secondary objective...primary being Windows OS Lock in.
Replying to @james_inthe_box@infosec.exchange
Got tired of mucking with these miserable #screenconnect msi's so here's a #suricata rule to catch the initial check via sni:
https://gist.github.com/silence-is-best/29afec335264313e9bf5bfa1c6e60144
https://app.any.run/tasks/73887f39-a8ac-4702-a67d-36465caca294
cc @da_667@infosec.exchange
An interesting development with #PureLogStealer ....seen this twice now where the Edge flag is invalid:
https://app.any.run/tasks/992252ed-c867-4ad9-8b3f-f53c9ca8451b
Replying to @netresec@infosec.exchange
@netresec@infosec.exchange Aye it's very consistent 
Replying to @jerry@infosec.exchange
@jerry@infosec.exchange To all those that continue to use LLM's....this is the path you have chosen.
Replying to @AAKL@infosec.exchange
@AAKL@infosec.exchange Ya windows being windows :D
Replying to @wdormann@infosec.exchange
@wdormann@infosec.exchange PHM is absolutely a book -> movie kinda film.
Some fresh #raton
https://app.any.run/tasks/d020658f-dbca-4a1c-bfec-557db23a332d
C:\Users\Cristian\Desktop\NewRaton\DONOTDELETE\Commands.pdb
An on time (yay) csv formatted list of #malspam campaigns that crossed my path in April to include #malware type, c2, hash, subject, and email exfil addresses:
https://gist.github.com/silence-is-best/bc95a949f272f8c5487d057bbd74d14f
Replying to @RecklessPush38671@infosec.exchange
Replying to @nixCraft@mastodon.social
@nixCraft@mastodon.social I'll be waiting for 26.04.1 ;)
Replying to @pmelson@infosec.exchange
Replying to @0xfeedc0fe@infosec.exchange
@0xfeedc0fe Aye...and that's right where I found it ;)
#nanocore......#ransomware ..?
https://app.any.run/tasks/0f06cf0b-8417-4e7d-83db-0fd384472772
No files actually encrypted though 🤔
#unknown panel associated with:
bf777e4dee6918d2373ba83433b4a7530d6e69465a1b6107ef4fd43f4ea60ec4
Replying to on mastodon.world
@signalapp@mastodon.world Where are they stored? What's the encryption level? Who has access?
Replying to @0xfeedc0fe@infosec.exchange
@0xfeedc0fe Huh....that's really odd.
Replying to @threatinsight@infosec.exchange
@threatinsight@infosec.exchange Spot on takeaway.
Much hatred for the latest #Wireshark
Replying to @Heidi@infosec.exchange
@Heidi So...SO spot on...
Replying to @james_inthe_box@infosec.exchange
@signalapp@mastodon.world Sometimes, not responding speaks volumes.
#medusahvnc in a js -> autoit:
https://app.any.run/tasks/86ddc895-ed72-4eae-8c9c-f1e7b81abaf9
Replying to @0x00string@infosec.exchange
PSA: If you're seeing links that literally start with _wildcard_ in #malspam, these are dropping #screenconnect (usual relay c2) via #zoom update lure.
1f7ab5418d489fdd2fb392ada3accc77c13586f94f059ee8e5cc83c0974b614b
Replying to @da_667@infosec.exchange
@da_667@infosec.exchange Awesome!
Replying to @malmoeb@infosec.exchange
@malmoeb That's a good find.
Replying to @campuscodi@mastodon.social
Replying to @FirehaK@infosec.exchange
@FirehaK Good eye! I saw some lateral movement and scanning as well...busy binary!
Replying to @da_667@infosec.exchange
@da_667@infosec.exchange Awesome!