Scarlet Shark Security (@ScarletSharkSec) header
Scarlet Shark Security (@ScarletSharkSec) profile picture

Scarlet Shark Security

@ScarletSharkSec

Digital Security Intelligence

 Washington D.C.
scarletshark.com
Joined January 2020
  • Tweets347
  • Following1.8K
  • Followers628
64Media
Photo by Scarlet Shark Security (@ScarletSharkSec)Photo by Scarlet Shark Security (@ScarletSharkSec)Photo by Scarlet Shark Security (@ScarletSharkSec)Photo by Scarlet Shark Security (@ScarletSharkSec)Photo by Scarlet Shark Security (@ScarletSharkSec)Photo by Scarlet Shark Security (@ScarletSharkSec)Photo by Scarlet Shark Security (@ScarletSharkSec)Photo by Scarlet Shark Security (@ScarletSharkSec)Photo by Scarlet Shark Security (@ScarletSharkSec)Photo by Scarlet Shark Security (@ScarletSharkSec)
MetaMask #phishing hXXps://kyc.auth-host.info/
1
1
3
596
DHL delivery failure themed #phishing hXXps://accomplish-delivery.change-server.info Threat actors are using email addresses from a NameCheep data breach after August 2022.
1
1
673
Anyone seeing #Socgholish using localsys-shield[.]com today?
1
2
Office 365 #Phishing hXXps://www.winkzigos.net/ Links to: hXXps://medialathe.com/From/
Image from Scarlet Shark Security (@ScarletSharkSec)
1
3
1
7
#ICEDID sample tria.ge/220809-t2v6lschgk ZIP -> ISO -> [BAT, JS, DLL] C2: abegelkunic[.]com
1
5
11
Quick correction there was a LNK in the ISO disk image as well.
SMS Phishing [US Post]-The delivery address is abnormal, please fill in the correct delivery address: hXXps://usp-acvxbero.us Link is user-agent filtered.
Image from Scarlet Shark Security (@ScarletSharkSec)
1
3
5
#Emotet E5 sample tria.ge/220629-rt5c7sbhc2 Payloads hXXps://bosny.com/aspnet_client/3HKzQi/ hXXps://blessingsource.com/wp-admin/mX05YNbiSuwRhURh/ hXXp://dhcmart.com/js/izJrXjec/ hXXp://cabans.com/CeudWYRQEzZgrHPcI/qY1HHnP5Av3fvb11s/
1
QakBot sample tria.ge/220628-wbfpcabccj Hijacked Email Thread -> .html -> .zip -> .lnk Payload hXXp://146.70.79.52/whenYouGive.dat

 11ae9e0230e6081227a89b1c885cccead75c42b3a1fca36793121309b3ea8c7b | Triage™

Check this report malware sample 11ae9e0230e6081227a89b1c885cccead75c42b3a1fca36793121309b3ea8c7b, with a score of 7 out of 10.

tria.ge
3
5
#Emotet E4 #malware sample tria.ge/220606-skddssdebr/be… Payloads hXXp://nationco-op.org/css/8wv7lB5/ hXXp://lightmyfire.in/demo/RIkAFgTFVuaI05r2/ hXXp://www.nexxdecor.vn/apk/zy8GkZ/
1
2
Unknown #malware sample tria.ge/220422-q9el2scgc5 Payloads hXXps://www.escueladecinemza.com.ar/_installation/IBlj/ hXXps://ciencias-exactas.com.ar/old/Bupubz1trh/

 f9863ee19e038e25e7a72678e2aa5ba4bbd55db755a41016a0fbd5bd6b37b129 | Triage™

Check this report malware sample f9863ee19e038e25e7a72678e2aa5ba4bbd55db755a41016a0fbd5bd6b37b129, with a score of 10 out of 10.

tria.ge
1
1
1
#Instagram #phishing metaappealforms[.]com
Image from Scarlet Shark Security (@ScarletSharkSec)
1
New BulletProftLink / Anthrax #phishing exfil domain: etools[.]page Back-end server IP and credential verification from: 20.98.246[.]177
3
1
1
Etrade #phishing hXXp://onlie8-verify.com/
Image from Scarlet Shark Security (@ScarletSharkSec)
1
#Xloader #Malware tria.ge/220418-rbygyadhh9 8aa8e14e287dd1cdb86c2b743cc7f6a9c6e011dabebf85e8268825a3522f9ef4 IoCs in link.
1
PII #Phishing Lure: Payroll platform change Attached PDF File name: PaychexRegForm.pdf SHA254: 57da453bb4eb95559913ede982a0916595a2849023b27355837378af5d90638b Phishing page: hxxps://mspings.com/new-payroll-form/
Image from Scarlet Shark Security (@ScarletSharkSec)
Image from Scarlet Shark Security (@ScarletSharkSec)
Image from Scarlet Shark Security (@ScarletSharkSec)
2
1
#Remcos #malware sample tria.ge/220407-qr9pgaggd3 C2 eaidali.ddns[.]net

remcos | c0c4ba53306de86e58d082d8a5c5b0b609beb0174120b1e12089fdf639b80a2d | Triage™

Check this remcos report malware sample c0c4ba53306de86e58d082d8a5c5b0b609beb0174120b1e12089fdf639b80a2d, with a score of 10 out of 10.

tria.ge
#Emotet epoch4 #malware sample tria.ge/220324-y4jmtadhh5 Lure IRS Form IoCs In the link.
Image from Scarlet Shark Security (@ScarletSharkSec)
5
10
New #formbook #malware sample tria.ge/220321-vp2y3adce2 IoCs in link
1
Microsoft 365 #phishing Lure: DocuSign Redirect and captcha: [subdomain][.]quarantinemailstat[.]com Phishing: login.docusharing[.]xyz Validated from: 178.62.64[.]205
Image from Scarlet Shark Security (@ScarletSharkSec)
Image from Scarlet Shark Security (@ScarletSharkSec)
Image from Scarlet Shark Security (@ScarletSharkSec)
2
2
Load more