🧠 Malware analyst & reverse engineer 🦠 Ransomware, loaders, stealers & RATs 🔬 Reverse engineering • crypto • tooling 📍 Technical research. No buzzwords.
Joined May 2025
- Tweets779
- Following190
- Followers1.2K
- Likes4K
🚨ALERT🚨
PhantomStealer4 has a #ransomware module.
AES-256-CBC + HMAC-SHA256, .phantom files, FTP key escrow and file deletion.
Disabled in this build (RansomCheckBox = false)
Bazaar👇
bazaar.abuse.ch/sample/13cee…
Just uploaded 203 #RGBLoader samples to MalwareBazaar, all discovered through hunting with my custom #YARA rule! 🔬
The samples are now available to the malware research community under the RGBLoader tag.
🔗 bazaar.abuse.ch/browse/tag/R…
#MalwareAnalysis #ThreatHunting
NEW generalized #YARA rule for #RGBLoader
👇
yaraify.abuse.ch/search/yara…
xitter.cf/ShadowOpCode/status/21…
⚠️NOT tested against FP, consider it a beta⚠️
🚨ALERT🚨
#RGBLoader is a new .NET Loader embedding bitmap pixels to conceal successive stages.
French/Viet fake program
RGBLoader > Cassandra Protector > final payload
>Deployed a YARA rule
>hunted 24 samples
>extractor script produced
>extracted malicious artifacts
Bazaar👇
hxxps://katfiore[.]com (not personally validated as compromised at the moment, just reported)
hxxps://xenseyu[.]com/hex/dr7kggqq4y
hxxps://xenseyu[.]com/p?id=b5b1eb33425d9811d17ff3045684db5a993a9a68&k=0c1507711b004009
cc @shalkie @tobersotski
🚨ALERT🚨
#RGBLoader is a new .NET Loader embedding bitmap pixels to conceal successive stages.
French/Viet fake program
RGBLoader > Cassandra Protector > final payload
>Deployed a YARA rule
>hunted 24 samples
>extractor script produced
>extracted malicious artifacts
Bazaar👇
hxxps://github[.]com/gpt-6-astra/gpt-6-astra.github.io/releases/tag/Astra
@malwrhunterteam @vxunderground @skocherhan @tobersotski
Support #scam
"Your computer has virus"
Starts at full screen with a scary and loud alarm sound
@MsftSecIntel @illegalFawn @JAMESWT_WT @tobersotski
#threatintel #IoC
hxxps://nozazisoda.z11.web.core.windows.net/gx/index.html?phone=%2B1-844-959-2863#
🤡🤡🤡Vulnerable to XSS🤡🤡🤡
🚨 Malvertising / Trading Scam campaign spotted🚨
Promoting a fake trading platform through misleading ads and fake news-style content.
The flow pushes victims to register and deposit a minimum of €250.
hxxps://g-globalapp[.]com
#ThreatIntel #Malvertising #Scam #CyberSecurity
