Pyvonix @Pyv0nix

Security Research • If all persons who can do something are in the bad side, the game could not be balanced. World Golf Village, FL Joined July 2012

Tweets

99
Followers

185
Following

278
Likes

1K

Pyvonix @Pyv0nix

7 years ago

#opendir: http://hokoog[.]com/yo/ I think I like these little guys that make your life easier by letting access to to their webshell. @JAMESWT_MHT @James_inthe_box @ViriBack

2 5 13 0 0

Download Image

Pyvonix @Pyv0nix

7 years ago

#opendir: aitelong[.]top/amadi/ contents: .exe and .hta malware: #lokibot #pony For this episode of "chose your malware", I offer a wide range of files. @James_inthe_box

1 5 12 0 0

Download Image

Besides developing malware, they make poetry... Oh wait. It's lyrics of Nerd Ambition by YTCracker. Malware: #tinynuke Payload: coriolis[.]site/facture/ Panel: 4s65xlo930ubyjz8dlcm[.]com/admin/login.php

1 1 3 0 0

Download Image

Pyvonix @Pyv0nix

7 years ago

Second stage dropper hosted on: pomf.pyonpyon[.]moe/befqki.doc Find different payload on #opendir: irishlebanese[.]com/wp-admin/images/eight/ It's seen like files aren't on Virus Total, yet. @malwrhunterteam @ViriBack

4 15 29 0 1

Download Image

Gigamon | Security @gigamonsecurity

7 years ago

Our Security Research Team has identified a zero-day #vulnerability in Adobe Flash that enables an attacker to execute code on a victims computer. #0day #networksecurity ow.ly/6plP50hBDMp

1 91 115 0 3

Download Image

Pyvonix @Pyv0nix

7 years ago

Current wave of #dropper but i'm not sur about the payload... Do you have more info? @malwrhunterteam @James_inthe_box @ViriBack All info: pastebin.com/iQXsPvXR

0 0 5 0 1

Download Image

Pyvonix @Pyv0nix

7 years ago

Today the presentation of my POC: a solution who collect and identify threats ✓ scalable solution ✓ automatically collect links ✓ identify the threat ✓ design a "user friendly" interface Thank to @benkow_ and @ViriBack for them great job who help me for identification

0 0 2 0 0

Download Image

Pyvonix @Pyv0nix

8 years ago

Amazing PO_.doc: RTF HASH: d6122adcf1bc34f293fed334d928f25dda5a76e53226c89a7bdb4c869c734ec8 It's NOT a dropper but an "all inclusive package" with all what he needs Behavior: #Ransomware + #Persistance Request: test1[.]ru/newbuild/t.php (may be a test ?) @malwrhunterteam

2 10 21 0 1

Download Image

Pyvonix @Pyv0nix

8 years ago

Website compromised: mcts-qatar[.]com Url used for delivering payload: mcts-qatar[.]com/wp-content/plugins/de6.exe Well, it's not your first time: urlhaus.abuse.ch/host/mcts-qata… … May be it's time to upgrade your Wordpress extensions or you deliberately host malware?

0 0 0 0 0

Pyvonix @Pyv0nix

8 years ago

Wave of office document. mimetype: RTF Dropper use CVE-2017-11882 with eqnedt32.exe Domain with payload: b.reich[.]io (/jsdrjs.exe or /kdhqfz.png) Paypload: Password Stealer #lokibot Panel: detini.nut[.]cc cc @ViriBack @malwrhunterteam

0 6 12 0 0

Pyvonix @Pyv0nix

8 years ago

Malware from: sendspace[.]com/file/6fjyyf He embed and use the @ImminentMethods solution (Cf. official website : imminentmethods.net ). Sample behavior: Keylogging C&C: DUJANADEC.djaoke[.]ga (no reponse) C&C infos :urlquery.net/report/924a8f3…

1 0 1 0 0

Download Image

Pyvonix @Pyv0nix

8 years ago

Dropper dowload payload from @github : github[.]com/yeahtheboys19892/beets/raw/master/beets/bin.exe Payload: AutoIT Keylogger Hash: 49475fa8074b25cd6aeb06551fa1f8544cdbc90e8d479858802a6510bb205d67 Behavior: drop 'nthwytulqctogyqrypoegivdc1696780.png'