NDA0E

💢 Low-Detection MSI Dropper Delivers #Malware – #ExploreWithANYRUN ⚠️ A recently developed #dropper is an #MSI file containing a #password-protected RAR archive 📌 Both the sample and #C2 domains have a very low detection rate on #VirusTotal 🔗 virustotal.com/gui/domain/ge… 📤 The dropper sends requests to the get-license4[.]com and get-license2[.]com resources, with the example of the following content: IsICS=0&LangCode=5875&AwaitTmp=17&Kiid=81257 ⚙️ After execution, it asks the user to confirm that they are not a robot by clicking the "OK" button. It then displays the 'Sending collected data' message 📝 Now the server’s returning only the '0a' string. It may be intended to return the password for its content 🤖 We named it #RobotDropper because it requires the user to confirm that they are human 👉 app.any.run/tasks/9e428266-9… We've observed it dropping #Lumma and #Stealc: 👉 app.any.run/tasks/185bc3b0-1… Find more samples by these #TILookup requests: 👉 intelligence.any.run/analysi… 👉 intelligence.any.run/analysi… 🐼 Special thanks to @RussianPanda9xx for providing the initial sample in her tweet! Analyze and investigate the latest #malware and #phishing threats with #ANYRUN 🛡️

Iranian threat actors are using phishing sites that impersonate @mellatbankiran to distribute #GossRAT through a download page claiming to be the bank's mobile app. Using @censysio DNS records i found over 100 domains to have been involved, most of them using .buzz as their TLD.

Crunexy Stealer C2: shaderify[.]xyz Distribution site: shaderify[.]com Web download > Shaderify_Beta.rar > ShaderifyBeta 1.4.0.exe Shaderify_Beta.rar 03751e8ea2f5db0fe27e1f2bcba62762 ShaderifyBeta 1.4.0.exe 4200f0d5579cdf7a6e27f1fff4b661e0 #Crunexy #Stealer

http://91.92.242.200/3.txt who can debunk this encoded Potential malware? its on the malicious asn 394711, Limenet