threat hunter | profile art credit @vxunderground @pancak3lullz
Joined February 2020
- Tweets73
- Following232
- Followers682
- Likes73
monty retweeted
Just released my modified version of the #OpenCTI connector that imports the data from #C2Tracker by @_montysecurity .
Still working on the docker component but the #python script works great.
#ThreatIntel, #HuntingAdversaryInfrastructure
github.com/cybersheepdog/ope…
C2-Tracker Update ❗️Censys support for C2-Tracker is currently disabled as searches are migrated to the new Platform syntax. Many of the queries will need to be removed in the process. Feel free to contribute new searches by opening an issue at github.com/montysecurity/C2-…
Dropped a new tool for malware researchers. It is used to continuously ingest, analyze, and alert on samples given a set of yara rules. Out of the box it works with @abuse_ch MalwareBazaar recent uploads but it's modular so you can add more sources
github.com/montysecurity/Yar…
monty retweeted
Happy to have contributed to the great C2 tracker by @_montysecurity github.com/montysecurity/C2-… with a query to hunt Atlandida Stealer on Shodan and Census :)
Big changes to C2 Tracker ‼️
- Added support for Censys searches 🎉
- Updates weekly on Mondays (modeled after Censys/Shodan scanning frequency)
- Added multiple new C2s/malware/botnets
github.com/montysecurity/C2-…
Dropped a new blog on hunting APT41 🐼 one of my favorite ones to put together, full of hunts for common TTPs and just things you should probably be hunting for anyway 🎯
montysecurity.medium.com/hun…
From #OSINT to Disk: Wave Stealer Analysis
montysecurity.medium.com/fro…
#WaveStealer #MalwareAnalysis #CTI #ThreatIntel
New #WaveStealer spotted in the wild, possibly a variant of bby stealer.
Sold by a French-speaking threat actor "sudry" (aka svvdry) on Telegram/Discord for a few dollars.
C2:
wavebysudryez.]fr
wave-assistant.]com
Files created:
\Temp\wavestealer\
tria.ge/240423-zzq2rsca28/be…
⬇️
Just released a #Python script for interacting with the @abuse_ch Malware Bazaar collection and finding samples that meet multiple criteria
github.com/montysecurity/mal…
I showcase it here hunting #CobaltStrike samples
montysecurity.medium.com/hun…
Put out a post dissecting this file. Used it as an example to learn the very basics of analyzing APK files and share my process along the way.
montysecurity.medium.com/stu…
Good find! Added this to C2 Tracker 🎯
github.com/montysecurity/C2-…
Hey :)
@shodanhq makes the hunting process for Sliver C2 a bit easier than before. You can now search for online servers using the search query product, like so:
shodan.io/search?query=produ…
Happy Hunting 😊
Looks like Shodan added "product:Havoc" as a search - CC @C5pider
shodan.io/search?query=produ…
Hunting Sandworm Team's TTPs - montysecurity.medium.com/hun…
Happy Hunting 🎯
Posted a write-up on this and, with some luck, we got the source code of the infostealer that it drops
montysecurity.medium.com/fro…
#CTI #ThreatIntel #Malware
Big update to C2 Tracker 📢 added 17 new tools/malware and retired some lower fidelity ones
github.com/montysecurity/C2-…
#CTI #ThreatIntel
Added #Meduza Stealer to C2 Tracker 🎯
Shodan Search
http.html_hash:1368396833
IOCs: github.com/montysecurity/C2-…
#Meduza Stealer is not dead!
Search for C2 panels on @fofabot :
icon_hash="-559608920"
en.fofa.info/result?qbase64=…
Some New panels:
193.233.133.81
146.70.161.13
77.105.147.136
185.106.94.31
212.113.116.56
89.185.85.132
95.181.173.235
95.181.173.8
95.181.173.233
89.185.85.34
👀👇
Posted a small write up on extracting the LNK payload from this one. "Evasion by Annoyance: When LNK Payloads Are Too Long"
montysecurity.medium.com/eva…
"npp_Installer_58627.iso": 713c18376e5474a643f03014170230125035cb39f731afdef1e8f3ab50122e93
The .lnk (40MB+ 😂) : 5f4111aa4909efe4ef2bafb56756b33ce4ddcf8f62715e6ae4e649200733c6ff
The .exe: 48f8a032fbb92214c064dd36057d13d96b6aaa64f34a006cd4c51cb4442fe673
@1ZRR4H
One of these things is not like the other 👀 Cobalt Strike infra map
@Y_NeXRo
@MichalKoczwara
