M4lcode @M4lcode

Malware researcher exploring malware, APT groups, and their campaigns across the wild. | Threat Researcher @dexpose_io | Blog Author @anyrun_app & @cyber5w m4lcode.github.io Egypt Joined February 2023

Tweets

176
Followers

651
Following

313
Likes

1K

M4lcode @M4lcode

2 weeks ago

Just published a deep dive into APT27 (Emissary Panda/Iron Tiger/Lucky Mouse), a Chinese state-sponsored cyber-espionage group active since 2010, known for spear-phishing, watering-hole attacks and exploitation of internet-facing applications. dexpose.io/threat-actor-p…

4 44 90 10K 41

Download Image

ANY.RUN @anyrun_app

2 months ago

🚨#ANYRUN’s TI Feeds now offer a connector for Microsoft Sentinel Get fresh, filtered #IOCs from the latest attacks worldwide, updated every 2 hours and enriched with sandbox analyses Expand incident monitoring, boost detection rate, and slash MTTR 👇 any.run/cybersecurity-…

0 5 12 4K 1

Muhammad Hasan Ali @muha2xmad

2 months ago

As-salamu Alaykum I wrote 3 #yara rules about #RedLine stealer , #ArrowRAT, and #MilleniumRat. RedLine:github.com/muha2xmad/yara… ArrowRAT:github.com/muha2xmad/yara… MilleniumRat:github.com/muha2xmad/yara…

1 3 10 4K 1

M4lcode @M4lcode

3 months ago

PureLogs is live. A new challenge created by me. good luck

Gameel Ali 🤘 @MalGamy12

3 months ago

PureLogs is live. A new challenge created by me. good luck

3 14 65 8K 18

Download Image

0 0 15 4K 2

Mohamed Sultan @mSult4n

3 months ago

Just published a new blog post on how Microsoft’s “Mouse Without Borders” can be abused for data exfiltration & lateral movement. Features KAPE Target, C# scripts, and a BOF as a poc: 0xsultan.github.io/dfir/Exfiltrat…

2 11 25 6K 13

M4lcode @M4lcode

4 months ago

Open directory spotted: 20.243.255[.]185 Hosting multiple suspicious files, including: shell_le: Metasploit ELF payload - recently submitted to VirusTotal. true.png: PNG file with embedded VBScript (1/61 on VT) - recently submitted to VirusTotal main_mips: ELF binary flagged…

2 10 42 8K 16

Download Image

M4lcode @M4lcode

4 months ago

#clickfix #booking #fakecaptcha bokparthub[.]click → (Under Construction) apartmenr-di16[.]click → PowerShell (files.catbox.moe/09fd7c[.]txt) → LightYellow4.zip → LightYellow4.pfx Hex-based ZIP reconstructed → payload cleaned → executed via regsvr32.exe abuse (LOLBins)

0 3 16 3K 6

Download Image

Gameel Ali 🤘 @MalGamy12

5 months ago

We’re excited to announce the launch of malops.io , a platform built by analysts, for analysts and it’s completely free. You can join and enjoin with our frist challenge about RokRat Loader.

11 54 173 17K 102

Download Image

M4lcode @M4lcode

6 months ago

Lately, I've been working on analyzing several stealers and a PE injector. Take a look 😃 Fileless pe injector uses reflective loading : blog.dexpose.io/analysis-of-ar… Purelogger: blog.dexpose.io/purelogger-dee… Salat Stealer: blog.dexpose.io/understanding-… Flesh Stealer: blog.dexpose.io/flesh-stealer-…

2 32 111 5K 62

Download Image

vx-underground @vxunderground

6 months ago

37 241 3K 117K 114

Download Image

M4lcode @M4lcode

6 months ago

FExcited to share that ANY.RUN now supports Android OS inside its interactive sandbox! You can analyze APK behavior in real time, right in the cloud. 🔥 Available for ALL plans (yes, even free!). 📷 Let’s check it out together! app.any.run/?utm_source=x_…

1 1 14 455 4

Download Image

M4lcode @M4lcode

8 months ago

Fake job interviews are a growing attack vector One example here is InvisibleFerret, a malware from North Korea, that targets tech professionals See detailed analysis of its code and collect IOCs to avoid infection by @MauroEldritch any.run/cybersecurity-… @anyrun_app