campaign image
Exploit of Romcom RAT's
RAT Romcom

The RomCom RAT is a malicious software program used by a threat actor to remotely control compromised systems, often by impersonating well-known brands and deploying fake versions of legitimate software through phishing campaigns.

Domains Source Last Update
aaa.stage.16549040.dns.alleivice.com SOCRadar 2023-01-31
teoresp.com SOCRadar 2023-01-31
advanced-ip-scaner.com SOCRadar 2023-01-31
tinheranter.com SOCRadar 2023-01-31
optasko.com SOCRadar 2023-01-31
cuba4ikm4jakjgmkeztyawtdgr2xymvy6nvgw5cglswg3si76icnqd.onion SOCRadar 2023-01-31
witorophron.com SOCRadar 2023-01-31
combinedresidency.org SOCRadar 2023-01-31
leftthenhispar.ru SOCRadar 2023-01-31
nastylgilast.com SOCRadar 2023-01-31
thehentoftbet.ru SOCRadar 2023-01-31
toftoflethens.com SOCRadar 2023-01-31
notfiled.com SOCRadar 2023-01-31
tycahatit.ru SOCRadar 2023-01-31
kurvalarva.com SOCRadar 2023-01-31
otinrofha.ru SOCRadar 2023-01-31
babbedidndu.ru SOCRadar 2023-01-31
you-supported.com SOCRadar 2023-01-31
johntotrepwron.com SOCRadar 2023-01-31
reninparwil.com SOCRadar 2023-01-31
vu42i55fqimjx6koo7oqh3zzvy2xghqe7ot4h2ftcv2pimbauupjyqyd.onion SOCRadar 2023-01-31
nagirlstylast.com SOCRadar 2023-01-31
fabickng.ru SOCRadar 2023-01-31
advanced-ip-scanners.com SOCRadar 2023-01-31
torsketronand.ru SOCRadar 2023-01-31
tandugolastsp.com SOCRadar 2023-01-31
ningwitjohnno.ru SOCRadar 2023-01-31
dgtlocean.com SOCRadar 2023-01-31
4qzm.com SOCRadar 2023-01-31
facabeand.com SOCRadar 2023-01-31
Hashes Source Last Update
4de5d433af5701462517719ce097bb4c0e5676c9 SOCRadar 2023-01-31
eaced2fcfdcbf3dca4dd77333aaab055345f3ab4 SOCRadar 2023-01-31
550f42c5b555893d171285dc8b15b4b5 SOCRadar 2023-01-31
3e3a7116eeadf99963077dc87680952cca87ff4fe60a552041a2def6b45cbeea SOCRadar 2023-01-31
4c32ef0836a0af7025e97c6253054bca SOCRadar 2023-01-31
05681ff7cae6b28f5714628a269caa5115da49c94737ce82ec09b4312e40fd26 SOCRadar 2023-01-31
ac09cbfee4cf89d7b7a755c387e473249684f18aa699eb651d119d19e25bff34 SOCRadar 2023-01-31
3e6f9e73ca7bf856c3f5aeb44dc793ec4927b842 SOCRadar 2023-01-31
cf6ec2999b5d67df89a5350dfcff611d SOCRadar 2023-01-31
de239ac43508c4fd4c9069a9b6a4a3f8 SOCRadar 2023-01-31
1b943afac4f476d523310b8e3afe7bca761b8cbaa9ea2b9f01237ca4652fc834 SOCRadar 2023-01-31
b5d202456ac2ce7d1285b9c0e2e5b7ddc03da1cbca51b5da98d9ad72e7f773b8 SOCRadar 2023-01-31
e80d80521238008bf6f429e072eaf6030c06e2d3123d03ea9b36f5a232a1ec90 SOCRadar 2023-01-31
d907be57b5ef2af8a8b45d5f87aa4773 SOCRadar 2023-01-31
f8144fa96c036a8204c7bc285e295f9cd2d1deb0379e39ee8a8414531104dc4a SOCRadar 2023-01-31
13ab5762ff5023163b1ca7c7749112b3673cd3db SOCRadar 2023-01-31
a1649dec72c316587b10d92993aee1ec SOCRadar 2023-01-31
a304497ff076348e098310f530779002a326c264 SOCRadar 2023-01-31
f538b035c3de87f9f8294bec272c1182f90832a4e86db1e47cbb1ab26c9f3a0b SOCRadar 2023-01-31
d1a84706767bfb802632a262912e95a8 SOCRadar 2023-01-31
10a5612044599128981cb41d71d7390c15e7a2a0c2848ad751c3da1cbec510a2 SOCRadar 2023-01-31
0afed8d1b7c36008de188c20d7f0e2283251a174261547aab7fb56e31d767666 SOCRadar 2023-01-31
d0bbbc1866062f9a772776be6b7ef135d6c5e002 SOCRadar 2023-01-31
5f187393acdeb67e76126353c74b6080d3e6ccf28ae580658c670d8b6e4aacc1 SOCRadar 2023-01-31
02a733920c7e69469164316e3e96850d55fca9f5f9d19a241fad906466ec8ae8 SOCRadar 2023-01-31
3a8b7c1fe9bd9451c0a51e4122605efc98e7e4e13ed117139a13e4749e211ed0 SOCRadar 2023-01-31
2f93bf6feb96aa13973cb923abcf402d3d829cb6 SOCRadar 2023-01-31
04972228302e569da856e4fa45f679ed SOCRadar 2023-01-31
9959e90d255c0221e9754db53e321ab4c7434488 SOCRadar 2023-01-31
1817cc163482eb21308adbd43fb6be57fcb5ff11fd74b344469190bb48d8163b SOCRadar 2023-01-31
f31620e7e22a30f408e5d683922f5029 SOCRadar 2023-01-31
1a21a1e626fd342e794bcc3b06981d2c SOCRadar 2023-01-31
9aa1f37517458d635eae4f9b43cb4770880ea0ee171e7e4ad155bbdee0cbe732 SOCRadar 2023-01-31
596eaef93bdcd00a3aedaf6ad6d46db4429eeba61219b7e01b1781ebbf6e321b SOCRadar 2023-01-31
3d4502066a338e19df58aa4936c37427feecce9ab8d43abff4a7367643ae39ce SOCRadar 2023-01-31
7e00bfb622072f53733074795ab581cf6d1a8b4fc269a50919dda6350209913c SOCRadar 2023-01-31
db3b1f224aec1a7c58946d819d729d0903751d1867113aae5cca87e38c653cf4 SOCRadar 2023-01-31
e0d89c88378dcb1b6c9ce2d2820f8d773613402998b8dcdb024858010dec72ed SOCRadar 2023-01-31
ee2f71faced3f5b5b202c7576f0f52b9 SOCRadar 2023-01-31
cb933f1c913144a8ca6cfcfd913d6d28 SOCRadar 2023-01-31
61971d3cbf88d6658e5209de443e212100afc8f033057d9a4e79000f6f0f7cc4 SOCRadar 2023-01-31
4e4eca58b896bdb6db260f21edc7760a SOCRadar 2023-01-31
542d144a73322a30ceabb002851515a80611bf6c SOCRadar 2023-01-31
99c7cad7032ec5add3a21582a64bb149 SOCRadar 2023-01-31
5f5c18e98e5c8a5a50a1e122221f61dd SOCRadar 2023-01-31
67fe9e515686c2d8cf7eeab0c37a04426599352c SOCRadar 2023-01-31
9f61259c966f34d89b70af92b430ae40dd5f1314ee6640d16e0b7b0f4f385738 SOCRadar 2023-01-31
33fe4c6f5e7803bc0b9d977abd8b816712cbf300 SOCRadar 2023-01-31
0f385cc69a93abeaf84994e7887cb173e889d309a515b55b2205805bdfe468a3 SOCRadar 2023-01-31
a2511c5c2839bfbdf9c0f84f415d5eae168456e5d3f77f1becdbcd69fba4daa4 SOCRadar 2023-01-31
d5dab3f20d47bf4ca4910949015844d660e99ca9 SOCRadar 2023-01-31
141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944 SOCRadar 2023-01-31
952b34f6370294c5a0bb122febfaa80612fef1f32eddd48a3d0556c4286b7474 SOCRadar 2023-01-31
d1ff26ea3d2d2ced4b7e76d971a60533817048d7 SOCRadar 2023-01-31
1807549af1c8fdc5b04c564f4026e41790c554f339514d326f8b55cb7b9b4f79 SOCRadar 2023-01-31
08eb4366fc0722696edb03981f00778701266a2e57c40cd2e9d765bf8b0a34d0 SOCRadar 2023-01-31
a7c207b9b83648f69d6387780b1168e2f1eabd23ae6e162dd700ae8112f8b96c SOCRadar 2023-01-31
6310a2063687800559ae9d65cff21b0a SOCRadar 2023-01-31
01242b35b6def71e42cc985e97d618e2fabd616b16d23f7081d575364d09ca74 SOCRadar 2023-01-31
2eb3ef8a7a2c498e87f3820510752043b20cbe35b0cbd9af3f69e8b8fe482676 SOCRadar 2023-01-31
f5db51115fa0c910262828d0943171d640b4748e51c9a140d06ea81ae6ea1710 SOCRadar 2023-01-31
7b6f996cc1ad4b5e131e7bf9b1c33253 SOCRadar 2023-01-31
23cea76078dd3829bd2b7e00f2bfe2ad SOCRadar 2023-01-31
7c003b4f8b3c0ab0c3f8cb933e93d301 SOCRadar 2023-01-31
c9d3b29e0b7662dafc6a1839ad54a6fb SOCRadar 2023-01-31
8e64bacaf40110547b334eadcb0792bdc891d7ae298fbfff1367125797b6036b SOCRadar 2023-01-31
b9afe016dbdba389000b01ce7645e7eea1b0a50827cded1cbaa48fbc715197bb SOCRadar 2023-01-31
0c2ffed470e954d2bf22807ba52c1ffd1ecce15779c0afdf15c292e3444cf674 SOCRadar 2023-01-31
ab1ed31825763c481f54bd8a94d73777 SOCRadar 2023-01-31
1f842f84750048bb44843c277edeaa8469697e97c4dbf8dc571ec552266bec9f SOCRadar 2023-01-31
86ed4544eeca78dc64881a916fe1e1f73dc17f7b SOCRadar 2023-01-31
250cb957728dba0f3ae2c1c1e9bae241 SOCRadar 2023-01-31
8b8dff5d30802fd79b76ee1531e7d050184a07570201ef1cd83a7bb8fa627cb0 SOCRadar 2023-01-31
1d142c36c6cdd393fe543a6b7782f25a9cbafca17a1cfa0f3fc0f5a9431dbf3f SOCRadar 2023-01-31
d1ea4f54c19d332b01553fa8e9a838c2a4dabfb1 SOCRadar 2023-01-31
8284421bbb94f3c37f94899cdcd19afd SOCRadar 2023-01-31
b160bd46b6efc6d79bfb76cf3eeacca2300050248969decba139e9e1cbeebf53 SOCRadar 2023-01-31
3252965013ec861567510d54a97446610edba5da88648466de6b3145266386d9 SOCRadar 2023-01-31
236f5de8620a6255f9003d054f08574b SOCRadar 2023-01-31
4fc9202ff84ef84b8c5e6140b66ac3d04570daf886a7f1ae31661ade882f963e SOCRadar 2023-01-31
068117b406940ac510ed59efd1d7c7651f645a31bd70db6de16aba12c055aae6 SOCRadar 2023-01-31
79d6b1b6b1ecb446b0f49772bf4da63fcec6f6bfc7c2e1f4924cb7acbb3b4f53 SOCRadar 2023-01-31
8a3d71c668574ad6e7406d3227ba5adc5a230dd3057edddc4d0ec5f8134d76c3 SOCRadar 2023-01-31
867d41458d94e985f6b3e2bae1dfb75e14cbc57f SOCRadar 2023-01-31
62d99110a03c33157a2c844ed5ddec11 SOCRadar 2023-01-31
0d5e3483299242bf504bd3780487f66f2ec4f48a7b38baa6c6bc8ba16e4fb605 SOCRadar 2023-01-31
01971269ca3083f292f6978511b51a0f90eb1ddb SOCRadar 2023-01-31
2896c334f4ef21aec24596ae13f9b692 SOCRadar 2023-01-31
bff4dd37febd5465e0091d9ea68006be475c0191bd8c7a79a44fbf4b99544ef1 SOCRadar 2023-01-31
4306c5d152cdd86f3506f91633ef3ae7d8cf0dd25f3e37bec43423c4742f4c42 SOCRadar 2023-01-31
f1103e627311e73d5f29e877243e7ca203292f9419303c661aec57745eb4f26c SOCRadar 2023-01-31
8a06c836c05537fcd8c600141073132d28e1172d SOCRadar 2023-01-31
6d5ca42906c60caa7d3e0564b011d20b87b175cbd9d44a96673b46a82b07df68 SOCRadar 2023-01-31
7d82030186936aa9fb21256d9593d992 SOCRadar 2023-01-31
f7013ce417fcba0f36c4b9bf5f8f6e0e2b14d6ed33ff4d384c892773508e932e SOCRadar 2023-01-31
03c835b684b21ded9a4ab285e4f686a3 SOCRadar 2023-01-31
8bebb8830366bd649c488903ef8f4e166965276d SOCRadar 2023-01-31
c646199a9799b6158de419b1b7e36b46c7b7413d6c35bfffaeaa8700b2dcc427 SOCRadar 2023-01-31
246dfe16a9248d7fb90993f6f28b0ebe87964ffd2dcdb13105096cde025ca614 SOCRadar 2023-01-31
6345ac3f61b9f4ce64e82d3896baf1fa SOCRadar 2023-01-31
2841848ef59dfe7137e15119e4c9ce5e873e3607 SOCRadar 2023-01-31
25a089f2082a5fcb0f4c1a12724a5521 SOCRadar 2023-01-31
ba83831700a73661f99d38d7505b5646 SOCRadar 2023-01-31
5d304ea1a9f3c8fbe147a74b64f3390e848ba04a SOCRadar 2023-01-31
241ce8af441db2d61f3eb7852f434642739a6cc3 SOCRadar 2023-01-31
0cf6399db55d40bc790a399c6bbded375f5a278dc57a143e4b21ea3f402f551f SOCRadar 2023-01-31
4b5eefa1727b97b6f773be3937a8cc390f0434ddc2f01dc24b68b690fafbcc93 SOCRadar 2023-01-31
88d13669a994d2e04ec0a9940f07ab8aab8563eb845a9c13f2b0fec497df5b17 SOCRadar 2023-01-31
571f8db67d463ae80098edc7a1a0cad59153ce6592e42d370a45df46f18a4ad8 SOCRadar 2023-01-31
9b546bd99272cf4689194d698c830a2510194722 SOCRadar 2023-01-31
209ffbc8ba1e93167bca9b67e0ad3561c065595d SOCRadar 2023-01-31
b14341b1ffe9e2730394b9066c6829b4e2f59a4234765ae2e97cfc6d4593730a SOCRadar 2023-01-31
25ebe54beb3c422ccd2d90aa8ae89087f71b0bed SOCRadar 2023-01-31
72a60d799ae9e4f0a3443a2f96fb4896 SOCRadar 2023-01-31
abe9635adbfee2d2fbaea140625c49abe3baa29c44fb53a65a9cda02121583ee SOCRadar 2023-01-31
aa3f37a75d3ba2ee74955c06eb308ad0cd6bca2e SOCRadar 2023-01-31
5cd95b34782ca5acf8a34d9dc184cb880a19b6edcaf4a4553fa0619b597c2f50 SOCRadar 2023-01-31
74fbf3cc44dd070bd5cb87ca2eed03e1bbeec4fec644a25621052f0a73abbe84 SOCRadar 2023-01-31
a7172aef66bb12e1bb40a557bb41e607 SOCRadar 2023-01-31
a17c21b909c56d93d978014e63fb06926eaea8e7 SOCRadar 2023-01-31
857f28b8fe31cf5db6d45d909547b151a66532951f26cda5f3320d2d4461b583 SOCRadar 2023-01-31
f869e8fbd8aa1f037ad862cf6e8bbbf797ff49556fb100f2197be4ee196a89ae SOCRadar 2023-01-31
bd270853db17f94c2b8e4bd9fa089756a147ed45cbc44d6c2b0c78f361978906 SOCRadar 2023-01-31
af4523186fe4a5e2833bbbe14939d8c3bd352a47a2f77592d8adcb569621ce02 SOCRadar 2023-01-31
310afba59ab8e1bda3ef750a64bf39133e15c89e8c7cf4ac65ee463b26b136ba SOCRadar 2023-01-31
3fe1a3aaca999a5db936843c9bdfea14 SOCRadar 2023-01-31
9d3b268416d3fab4322cc916d32e0b2e8fa0de370acd686873d1522306124fd2 SOCRadar 2023-01-31
75b55bb34dac9d02740b9ad6b6820360 SOCRadar 2023-01-31
fd87ca28899823b37b2c239fbbd236c555bcab7768d67203f86d37ede19dd975 SOCRadar 2023-01-31
ecefd9bb8b3783a81ab934b44eb3d84df5e58f0289f089ef6760264352cf878a SOCRadar 2023-01-31
a839b2a598fc598044f9814873d7fc84 SOCRadar 2023-01-31
09e04ba053edcf4ca38541cbd735568945a5948d SOCRadar 2023-01-31
Ipv4s Source Last Update
37.44.253.21 SOCRadar 2023-01-31
217.79.43.148 SOCRadar 2023-01-31
79.141.169.220 SOCRadar 2023-01-31
31.184.198.111 SOCRadar 2023-01-31
204.13.164.118 SOCRadar 2023-01-31
192.137.100.96 SOCRadar 2023-01-31
154.35.175.225 SOCRadar 2023-01-31
222.252.53.33 SOCRadar 2023-01-31
64.52.169.174 SOCRadar 2023-01-31
216.45.55.3 SOCRadar 2023-01-31
31.184.198.84 SOCRadar 2023-01-31
31.184.198.90 SOCRadar 2023-01-31
141.98.87.124 SOCRadar 2023-01-31
159.203.70.39 SOCRadar 2023-01-31
37.120.193.123 SOCRadar 2023-01-31
31.44.184.84 SOCRadar 2023-01-31
31.184.198.74 SOCRadar 2023-01-31
185.153.199.168 SOCRadar 2023-01-31
69.30.232.138 SOCRadar 2023-01-31
62.210.54.235 SOCRadar 2023-01-31
64.235.39.82 SOCRadar 2023-01-31
107.189.10.143 SOCRadar 2023-01-31
185.153.199.163 SOCRadar 2023-01-31
128.31.0.39 SOCRadar 2023-01-31
131.188.40.189 SOCRadar 2023-01-31
37.120.247.39 SOCRadar 2023-01-31
103.27.203.197 SOCRadar 2023-01-31
38.108.119.121 SOCRadar 2023-01-31
31.184.198.82 SOCRadar 2023-01-31
31.44.184.100 SOCRadar 2023-01-31
92.222.172.39 SOCRadar 2023-01-31
192.137.101.205 SOCRadar 2023-01-31
209.76.253.84 SOCRadar 2023-01-31
157.245.70.127 SOCRadar 2023-01-31
31.184.198.80 SOCRadar 2023-01-31
104.238.134.63 SOCRadar 2023-01-31
209.127.187.245 SOCRadar 2023-01-31
86.59.21.38 SOCRadar 2023-01-31
216.45.55.30 SOCRadar 2023-01-31
84.17.52.135 SOCRadar 2023-01-31
185.153.199.164 SOCRadar 2023-01-31
194.109.206.212 SOCRadar 2023-01-31
31.184.198.83 SOCRadar 2023-01-31
108.170.31.115 SOCRadar 2023-01-31
199.58.81.140 SOCRadar 2023-01-31
185.153.199.169 SOCRadar 2023-01-31
149.255.35.131 SOCRadar 2023-01-31
31.184.194.42 SOCRadar 2023-01-31
170.39.212.69 SOCRadar 2023-01-31
193.34.167.17 SOCRadar 2023-01-31
195.54.160.149 SOCRadar 2023-01-31
45.32.229.66 SOCRadar 2023-01-31
193.23.244.244 SOCRadar 2023-01-31
213.32.39.43 SOCRadar 2023-01-31
45.91.83.176 SOCRadar 2023-01-31
45.164.21.13 SOCRadar 2023-01-31
31.184.198.86 SOCRadar 2023-01-31
185.153.199.162 SOCRadar 2023-01-31
31.184.192.44 SOCRadar 2023-01-31
45.86.162.34 SOCRadar 2023-01-31
31.44.184.82 SOCRadar 2023-01-31
46.17.106.230 SOCRadar 2023-01-31
212.192.241.230 SOCRadar 2023-01-31
31.184.198.85 SOCRadar 2023-01-31
192.137.101.46 SOCRadar 2023-01-31
92.222.172.172 SOCRadar 2023-01-31
94.103.9.79 SOCRadar 2023-01-31
185.153.199.176 SOCRadar 2023-01-31
23.227.198.246 SOCRadar 2023-01-31
103.114.163.197 SOCRadar 2023-01-31
167.71.175.165 SOCRadar 2023-01-31
31.184.199.82 SOCRadar 2023-01-31
171.25.193.9 SOCRadar 2023-01-31
104.217.8.100 SOCRadar 2023-01-31
192.137.100.98 SOCRadar 2023-01-31
144.172.83.13 SOCRadar 2023-01-31
Cves Source Last Update
CVE-2022-24521 SOCRadar 2023-01-31
CVE-2020-1472 SOCRadar 2023-01-31
Emails Source Last Update
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
[email protected] SOCRadar 2023-01-31
Domains Insert Date

MITRE ATT&CK TECHNIQUES

Cuba ransomware actors use the ATT&CK techniques listed in Table 6. Note: For details on TTPs listed in the table, see FBI Flash Indicators of Compromise Associated with Cuba Ransomware.

Resource Development

Technique Title

ID

Use

Compromise Infrastructure: Domains

T1584.001

Cuba ransomware actors use compromised networks to conduct their operations.

Initial Access

Technique Title

ID

Use

Valid Accounts

T1078

Cuba ransomware actors have been known to use compromised credentials to get into a victim’s network.

External Remote Services

T1133

Cuba ransomware actors may leverage external-facing remote services to gain initial access to a victim’s network.

Exploit Public-Facing Application

T1190

Cuba ransomware actors are known to exploit vulnerabilities in public-facing systems.

Phishing

T1566

Cuba ransomware actors have sent phishing emails to obtain initial access to systems.

Execution

Technique Title

ID

Use

Command and Scripting Interpreter: PowerShell

T1059.001

Cuba ransomware actors have used PowerShell to escalate privileges.

Software Deployment Tools

T1072

Cuba ransomware actors use Hancitor as a tool to spread malicious files throughout a victim’s network.

Privilege Escalation

Technique Title

ID

Use

Exploitation for Privilege Escalation

T1068

Cuba ransomware actors have exploited ZeroLogon to gain administrator privileges.

Defense Evasion

Technique Title

ID

Use

Impair Defenses: Disable or Modify Tools

T1562.001

Cuba ransomware actors leveraged a loader that disables security tools within the victim network.

Lateral Movement

Technique Title

ID

Use

Remote Services Session: RDP Hijacking

T1563.002

Cuba ransomware actors used RDP sessions to move laterally.

Credential Access

Technique Title

ID

Use

Credential Dumping: LSASS Memory

T1003.001

Cuba ransomware actors use LSASS memory to retrieve stored compromised credentials.

Steal or Forge Kerberos Tickets: Kerberoasting

T1558.003

Cuba ransomware actors used the Kerberoasting technique to identify service accounts linked to active directory.

Command and Control

Technique Title

ID

Use

Proxy: Manipulate Command and Control Communications

T1090

Industrial Spy ransomware actors use HTTP/HTTPS proxy via a C2 server to direct traffic to avoid direct connection. 

REF

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". 

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Run Windows 10 in Safe Mode with Networking

Extract the downloaded archive and run the Autoruns.exe file.

Extract Autoruns.zip archive and run Autoruns.exe application

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Refresh Autoruns application results

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

Delete malware in Autoruns

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Search for malware and delete it

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.


The world of cyber threats is constantly evolving, and it's important for individuals and organizations to stay informed about the latest dangers. One threat that has recently emerged is the RomCom RAT (Remote Access Trojan). In this post, we'll discuss what the RomCom RAT is, how it operates, and how you can protect yourself from it.

What is the RomCom RAT?

The RomCom RAT is a type of malware that allows an attacker to gain remote access and control of a compromised system. The attackers behind the RomCom RAT have been found to use the reputation of well-known brands, such as SolarWinds, KeePass, and PDF Technologies, to carry out their attacks. This makes it difficult for victims to recognize the threat and take appropriate action.

How Does the RomCom RAT Operate?

The RomCom threat actor uses a scheme that involves imitating the original legitimate HTML code, registering similar malicious domains, altering legitimate applications, uploading the malicious bundles to fake websites, sending targeted phishing emails, and potentially using additional infection vectors. In preparation for an attack, the RomCom threat actor will perform the following steps: scraping the original legitimate HTML code from the vendor to spoof, registering a malicious domain similar to the legitimate one, altering a legitimate application, uploading the malicious bundle to a decoy website, and deploying targeted phishing emails to the victims.

Who is at Risk of a RomCom RAT Attack?

Currently, Ukraine appears to be the primary target of RomCom RAT attacks, but some English-speaking countries, such as the United Kingdom, are also being targeted. Given the location of the targets and the current geopolitical situation, it's unlikely that the RomCom RAT threat actor is motivated by cybercrime.
File Name Description Actions
0408-Threat-ReportV17.pdf DELIVERING ACTIONABLE AND CONTEXTUALIZED INTELLIGENCE TO INCREASE CYBER RESILIENCE
APT Name Aliases Target Countries Source Countries Total IOCs
RomCom
Storm-0978
None
timeline History Timeline

  • Fri, 14 Jul 2023 11:15:04 GMT
    New Report Added

    Blackberry Threat-ReportV17 report added.

  • Tue, 04 Jul 2023 00:00:00 GMT
    RomCom Threat Actor Suspected of Targeting Ukraine's NATO Membership Talks at the NATO Summit
    On July 4, the BlackBerry Threat Research and Intelligence team found two malicious documents submitted from an IP address in Hungary, sent as lures to an organization supporting Ukraine abroad, and a document targeting upcoming NATO Summit guests who may also be providing support to Ukraine. Go to Link
  • Tue, 31 Jan 2023 09:34:10 GMT
    New IOC's Added

    Total 295 IOC's added.

  • Tue, 31 Jan 2023 09:32:28 GMT
    New Apt Groups Added

    New APT Groups added.

  • Tue, 31 Jan 2023 09:10:24 GMT
    Created!

    New Campaign created.

  • Mon, 10 Oct 2022 00:00:00 GMT
    Evasion Tecniques
    On October 10, 2022, the threat actor improved evasion techniques by obfuscation of all strings, execution as a COM object, and others.Go to Link
  • Sat, 23 Jul 2022 00:00:00 GMT
    Advanced IP Scanner
    Once the victim installs a Trojanized bundle, it drops RomCom RAT to the system. 
newspaper Dark Web News

dark web image
Spark RAT is Shared

 In a hacker forum monitored by SOCRadar, an alleged RAT tool share is detected which is called Spark RAT. https://image.socradar.com/screenshots/2024/06/14/962465a7-bfc5-44ac-9a90-19184630f099.pngSpark is a free, web-based, cross-platform and full-featured RAT (Remote Administration Tool) that allow you to control all your devices via browser anywhere ! PLEASE ONLY USE FOR TESTING ! https://image.socradar.com/screenshots/2024/06/14/0151bab1-1c20-41c5-9684-ea6a7d5f00df.pngHOW TO USE :​ ​ Open executable to create network path in your computer Configuration file config.json should be placed in the same directory as the executable file. Example: { "listen": ":**", "salt": "**", "auth": { "username": "**" }, "log": { "level": "info", "path": "./logs", "days": 7 } } listen required, format: IP:Port salt required, length <= 24 after modification, you need to re-generate all clients auth optional, format: username:password hashed-password is highly recommended format: $algorithm$hashed-password, example: $sha256$11223344556677AABBCCDDEEFF supported algorithms: sha256, sha512, bcrypt if you don't follow the format, password will be treated as plain-text log optional level optional, possible value: disable, fatal, error, warn, info, debug path optional, default: ./logs days optional, default: 7 Run executable and browse to http://IP:Port to access the web interface. Generate a client and run it on your target device. Enjoy! https://image.socradar.com/screenshots/2024/06/14/fca4e6eb-c223-49b9-9815-12c3ce1f4b6d.pngDownload: https://**


dark web image
New Rat is on Sale

In a hacker forum monitored by SOCRadar, a new rat sale is detected. https://image.socradar.com/screenshots/2024/06/11/57a41f65-8821-4b61-83e3-ef790c67dd1c.png⭐VIPER ANDROID RAT ⭐ BEST ANDROID REMOTE CONTROL 彡 The only secure Phone is one that's powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards 🥬 Viper Android Remote Tool 🥬 ✅ A model of excellence in the market for monitoring an unlimited number of Android devices. Prepare to be captivated by its feature-rich features that will exceed your expectations. ✅ sets a new benchmark in darknet monitoring software, offering you super expertise in dark skills. ​ Special Features​ Quick screen control Hidden auto-resolution permissions PIN code to unlock screen in one click Keyboard that can be unlocked by pressing keys Password repeater to bypass face lock and pattern lock Crypto WALLET stealer (seed phrase stealer + direct cryptocurrency transfer) Coinbase,Trustwallet, Hidden screen control | custom text layout vnc | Keylogger to capture all passwords, chats, typed texts Black screen for hidden phone control (disable the victim's phone and you can control it hidden) Screen reader to bypass black screen of banking or crypto apps Read SMS Send SMS Call history Contact Manager File Manager Disable apps Live broadcast from camera Live microphone (talk/listen) Delete/Download files/Folder Crypto Clipper (safely changed the copied wallet address to your own wallet address) And much more....... 📲 Tested up to Android 14 ✅ Bypass antiviruses ✅ Bypass game protection ✅ No pop-up window during automatic permission resolution. ✅ Anti-deletion


dark web image
New Murrra1n RAT Tool Share is Detected

In a hacker forum monitored by SOCRadar, a new alleged Murrra1n RAT tool share is detected. https://image.socradar.com/screenshots/2024/06/05/42495f98-edf6-4968-b4e8-4f342b6b9926.pnghttps://image.socradar.com/screenshots/2024/06/05/4d0f73f6-4ce6-46c6-bc8b-40f87547e03d.pnghttps://image.socradar.com/screenshots/2024/06/05/09a48a1b-574f-4743-a423-7dae6ac92a2e.pngNow the client and modules will not work on workstations CIS countries (Belarus, Ukraine, Russia, etc.) MuRra1N RAT is translated into four languages (Russian, English, Ukrainian, German) Added anti-drain system on VT and other services. Support for 2 operating modes: Pastebin URL and No-IP: Free Dynamic DNS (https: //www.noip.com,www.bestfree.ru,dyn.com/dns) Removed PDF instructions (no longer needed) Installer removed Informative panel of logs Built-in port checker (TCP, UDP) Encryption algorithm changed Fixed bug in determining system bit rate. Fixed error in determining the license key in the module "System Manager" Added geolocation definition in the module "System Manager" New functionality: Feedback via telegram to choose from: (Notifications of new connections or full collection of information: GEO System information browser data collection (Chromium, Edge, Firefox) Collect potentially important files from the desktop from "My documents" and user folders create a screenshot and webcam (if any) Added option to collect from more than 60 programs FTP Gaming Mail Mesenger VPN Crypto wallets added (Armory, Atomic, Bytecoin,Ethereum, Exodus, Jaxx, ZCASH) The basic size of the client is 550 ~ 570kb Plugin libraries have been optimized 2 Watchdog modes 1 mode-Auxiliary process 2 mode-Through the scheduler Added ForkBomb option (On PC the heap of processes is created, as a result arises memory overflow that hangs PC) Added BSOD option (Causes blue screen of death (BSOD))







dark web image
A New Android RAT is on Sale

 In a hacker forum monitored by SOCRadar, a new andoid RAT sale is detected. https://image.socradar.com/screenshots/2024/05/09/d8c40df0-f382-469e-9fb2-b1fd610b14c5.pngAndroid RAT is the best on the market tg channel : https://** contact tg : https://** 1 month 1500 usd 2 month 2500 usd ~ Screen control ~ Hidden automatic permissions ~ Lock / unlock the screen but sometimes the first time may not unlock the password or pattern for this there is a button to reset the memory and recapture. there is also a solution to capture by giving the victim a phishing pattern or pin code to unlock. also you can see the pin code in the keylogger. ~ Keyboard for keystroke unlocking ~ Ransomeware (full phone lock and display message and QR code to pay money. ~ Black screen to silently control your phone ~ Text readers on screen ~ Anti-Uninstall ~ SMS Interception ~ Calls, Contacts, ~ File Manager - 11 crypto-injections (trustwallet, metamask, binance, exodus, bybit, huobi, sberbank, coinbase, kucoin, etc.) waits until the victim decides to log into the application and issues a phish request instead of the original application to capture logs. ~Enable / disable applications ~Live Camera (Front / Back) ~Live Microphone (talk / listen) ~Keylogger to capture all passwords, but it happens that not all passwords are captured or the victim may have a face ID or a finger to enter a particular application. - Screen Reader is a black screen reader for bypassing black screen in applications like revolution or smart id or authenticator. There are also issues with the crypto apk, as we are always trying to improve our crypto to bypass the protection of top banks, because it happens that Google does not detect the virus, but Sberbank for example does. Crypt can fall off because of some client to whom you will throw and he will not install and will send there to Google or to the virus total. In the panel it will be possible to make yourself an apk as much as you want plus I will give the latest actual method of crypto with the help of programs so that you can make yourself several apks. If the crypto falls off, all the clients that you put this particular apk with this crypto will disappear because they will also start detecting. And the victim can always stop you from turning off the phone or pulling out the SIM card or turning off the Internet or start clicking all the buttons when you turn off the screen, you have full access but the victim can stop you from doing anything so you have to learn how to do it. and so much more. Translated with ** (free version) https://image.socradar.com/screenshots/2024/05/09/4870bafb-15c2-4823-8d04-6086dd039d45.png


dark web image
New Razor RAT/Malware Tool is on Sale

In a hacker forum monitored by SOCRadar, a new alleged Razor RAT/Malware tool sale is detected. https://image.socradar.com/screenshots/2024/06/03/5f14c366-3321-4a3c-ad63-2dcddf9944fb.pnghttps://image.socradar.com/screenshots/2024/06/03/80c1cfef-f2e8-4ecd-89d1-0e917849dff0.pnghttps://image.socradar.com/screenshots/2024/06/03/58f72f61-bb20-4b43-a88e-5a4b8c325878.pnghttps://image.socradar.com/screenshots/2024/06/03/f928306d-f0c1-4345-8a03-0c1f381a7b6f.pngRAZOR NATIVE C++/ASM RAT/MALWARE POWERTOOL FOR A VARIETY OF CYBERSECURITY PROJECTS. HARDCODED BOT FEATURES: 32-BIT EXE INJECTS/RUNS ON BOTH 32/64 BIT ARCHITECTURES "EVASION OPTIONS" - KILL BOT/PAUSE CONNECTIONS WHEN NAMED THREAT IS DETECTED OPTIONAL INSTALLATION OPTIONAL MELTING/WIPING OF EXE FROM START LOCATION OPTIONAL PERSISTENCE WITH REGISTRY, SCHEDULED TASK, OR START FOLDER OPTIONAL WINDOWS DEFENDER EXCLUSIONS OPTIONAL AUTO ELEVATION DURING BOT EXECUTION OPTIONAL SELF DESTRUCTION OF EXE AT GIVEN DATE OPTIONAL TEST MODE ADDITIONAL FEATURES: ENCRYPTION MANAGER - BULK FILE ENCRYPTION WITH MULTI DRIVE SUPPORT (NEW: MAY 2024) INSTANT DOWNLOADER - DOWNLOAD/EXECUTE PAYLOADS FROM THE WEB ON BOT START INSTANT PASSWORD RECOVERY - RECOVER PASSWORDS TO WEB (HTTP/S) ON BOT START (APPS BELOW) PASSWORD RECOVERY THROUGH MANAGER (APPS BELOW) COOKIE RECOVERY THROUGH MANAGER (APPS BELOW) WEBCAM CAPTURE WITH LOGGING MICROPHONE AUDIO CAPTURE WITH LOGGING OFFLINE KEYLOGGER LIVE KEYLOGGER - VIEW KEYSTROKES IN REALTIME SCREEN CAPTURE WEB BROWSER HISTORY VIEWER REMOTE SHELL FILE EXPLORER WITH THUMBNAIL VIEWER DROPPER - DROP FILE FROM URL TO REMOTE FILE SYSTEM DOWNLOAD AND EXECUTE THROUGH MANAGER CLIPBOARD EDITOR WITH LOGGING REVERSE PROXY OPEN WEBSITE/BROWSE TO URL REMOTE DESKTOP REMOTE BROWSER (WIN10: CHROME, EDGE, BRAVE. WIN11: CHROME, BRAVE) CAPTURE PROCESS MEMORY (MDMP) PROCESS MANAGER SHOW REMOTE MESSAGE SERVICE MANAGER (CREATE, START, STOP, DELETE) PROGRAM MANAGER (MSI) REGISTRY EDITOR REMOTE SYSTEM LOCK/REBOOT/SHUTDOWN GET/SET WALLPAPER REMOTE WINDOW CONTROL REMOTE WAV PLAYER LOCAL TEXT TO REMOTE SPEECH PASSWORD RECOVERY APPS: CHROME, OPERA, BRAVE, EDGE CHROMIUM, FIREFOX. VIVALDI, FOXMAIL, WIFI COOKIE RECOVERY APPS: GOOGLE CHROME. ONE TIME PAYMENT, LIFETIME ACCESS: $80 PAY WITH BITCOIN, MONERO, ETHEREUM, LITECOIN, USDT, PAYPAL. REQUEST A PAYMENT ADDRESS BY STARTING A CONTRACT OR BY CONTACTING: EMAIL:******** TELEGRAM: T.ME/******* PREREQUISITES: IT IS INFERRED THAT USERS OF THE SOFTWARE HAVE PRIOR TECHNICAL EXPERIENCE. TERMS: SALES ARE FINAL THIS THREAD IS NOT INTENDED FOR TECHNICAL SUPPORT, PLEASE USE THE INFO PROVIDED AFTER PURCHASE. PLEASE KEEP ANY CRITICISM POSTED AS CONSTRUCTIVE AS POSSIBLE. KINDLY FORWARD ANY QUESTIONS TO:*********



dark web image
A New Fingerless Rat is on Sale

In a hacker forum monitored by SOCRadar, a new alleged Fingerless RAT sale is detected. https://image.socradar.com/screenshots/2024/05/02/6cfd35fc-ea4b-41bd-a028-3179646dd736.pngPrice $150,000 Contacts t.me/******* Rakuzan(name corrected): Solution for Remote Welcome to the future of remote management and support. We are pleased to introduce you to Rakuzan - your reliable tool for effective remote work and troubleshooting technical problems. Whether you're an IT professional, a system administrator, or just an account manager, our software is designed to make your job easier. Key features of the program: 1. Convenient Connection Rakuzan offers instant connection to remote devices. Now you can solve the problems of your clients or employees from anywhere in the world. There is no longer any need to wait or physically visit the client - everything is in your hands. 2. Security at the Highest Level We understand how important data security is. That's why our program uses high-level encryption to ensure your data and communications are protected. Your clients and employees can be assured of confidentiality. Since our code is directly merged through the official white production, as a result we have safe and secure traffic that travels ONLY through our VPS/VDS through an encrypted protocol, in contrast to the official white software which drives traffic through the off-server and is tracked. Due to this, we always have only fresh and relevant program material with all updates 3. Multifunctionality Our program supports a variety of platforms and operating systems. You can remotely manage Windows, macOS, and Linux devices. In addition, our program offers teamwork tools to facilitate coordination between teams. 4. Interactive Control The program includes functionality for interactive control, allowing you not only to remotely control devices, but also exchange files, send messages and run scripts. Everything you need for effective support is in one place. With our program you will get full access to the client’s computer without his knowledge, with full access on behalf of the administrator (registry, computer management, etc.), and it is also possible to open various programs in secret from the client, for example, such as WhatsApp, Telegram, Chrome and others you need 5. Flexible Pricing We offer fixed and fair prices to suit your needs and budget. Regardless of the size of your business, we will find a suitable plan that will allow you to make the most of our software in your business. 6. Secretiveness in working with clients “With the advent of the Internet on the client’s computer, we have full access to his PC” We have done almost everything to make the program as invisible as possible in use for the client, because the application is active from the initialization of the Ethernet adapter in the client’s BIOS, and also Rakuzan works without any icons or shortcuts, it works only on the basis of one service, we are currently searching and developing Ways to hide the installer from Applications in Windows settings. Our program also supports such functions as: - “silent” connection to the client - simple implementation to the client - the ability to observe, listen, record the client’s screen (possible in semi-automatic mode) - report on connect-disconnect activity, who connected where when - flexible configuration rights of workers on the server side - the ability to pick up and download files to the client past his desktop (that is, we can pick up files and the client does not have any copy window) - information about the client (IP addresses external and internal, motherboard\laptop model, what applications installed, what processes are currently running, etc.) - the ability to organize clients by groups\subgroups\name, etc. - there is no need for the client to always be on the same network, if the client changes the network, it will still automatically connect to the server and you can will work with it - the application runs as a service, so when you turn on the PC it starts immediately after the system starts - it is possible to install the client on Linux, MacOS systems -And much more ________________________________________ Why waste time and resources on complex processes? With our program you will get a fast, secure and versatile tool that will make your work easier and improve customer support. Learn more about our capabilities and start using this program today. Contact us for special offers and a trial version of the program. We are ready to help you take a step forward in the world of remote work and technical support, as well as improve the quality of your business.



dark web image
Reaper Android Rat V6 is on Sale

 In a hacker forum monitored by SOCRadar, a new Reaper andoid RAT V6 sale is detected. https://image.socradar.com/screenshots/2024/04/29/c8079c6d-8b21-4e32-9805-2fe08cf95627.pngApk Support on version 14. (tested on android 14) Smooth Hidden Vnc Control (show text during control) Layout vnc control (stable no lag) Screen Reader | With this feature, you can enter any banking Application and withdraw Money, L'Screen Text Logger + controller (that Helps you to monitor or control every single bank and crypto transaction) bypass black screen problem. See wallet seed phrases. Screen Capturer | show all Tasks live with controllable screen : one click unlock() Pin Unlock Pattern Unlock Apk ?? Lpin and pattern lock (uto detect) Remove captured lock data (if did not capture the lock password correctly then make again ready to capture again in just one click) Super Fast keylogger (Record pin, pattern, passwords, (record all Credentials) Phisher link | the help you to redirect any real or phishing link that can Grab all credentials we provide 500 + latest injections including Crypto and banks. Wallets much more (Crypto Clipper: support 40+ wallets | Btc, eth, BNB, trc20, trc25 more, that help you to Replace your wallet into Receiver wallet address ( (You Get All Crypto Funds that the victim can send anywhere) Read Live Notifications !! Auto Delete Apk using Command (No Traces) Anti-Uninstall SMS interceptions Calls, Contacts, () File manager © Enable/Disable Apps Live Camera (Front/Back) Live microphone (Speak/listen) And many more.......



dark web image
New Obelix RAT Tool Sale is Detected

In a hacker forum monitored by SOCRadar, a new alleged Obelix RAT tool sale is detected. https://image.socradar.com/screenshots/2024/05/03/4ebe8b13-34d3-40de-9407-24a8737107e0.pnghttps://image.socradar.com/screenshots/2024/05/03/d5387c28-bed2-4db2-8f27-fc1e5649b6e2.pnghttps://image.socradar.com/screenshots/2024/05/03/bfca5ee7-5ec5-4964-b854-6bcb89549445.pnghttps://image.socradar.com/screenshots/2024/05/03/807750e8-b4ae-4cf8-9bb7-8185d710b107.pngOBELIX REMOTE ACCESS TOOL FOR WINDOWS 10/11. Dedicated To Remote Access, Surveillance, And Security Projects. NATIVE CORE CODED FROM SCRATCH IN FAST C++. Current Features UAC BYPASS - Option To Attempt Automatic Bot Elevation. INTERACTIVE ELEVATION - Option To Request Remote Bot Elevation. PERSISTENCE - Registry, Start Folder, Or Scheduled Task. WINDOWS DEFENDER - Option To Exclude Paths In Windows Defender. PROCESS INJECTION - Option To Inject Bot. INSTANT DOWNLOAD - Pull Payloads From The Web And Execute During Bot Launch INSTANT PASSWORD RECOVERY - Recover Passwords From 9 Apps And Deliver To HTTP/S During Bot Launch PASSWORD RECOVERY - Chrome, Edge, Opera, Brave, Firefox, Vivaldi, FoxMail, ThunderBird IMAP, WIFI REMOTE BROWSERS - Navigate Websites & Click Links (Win10: Chrome, Edge, Brave. Win11: Chrome, Brave) REMOTE WEBCAM - View And Log Remote Webcam MICROPHONE CAPTURE - Capture And Log Remote Microphone Audio FILE EXPLORER - Explore, Upload, Download, View Thumbnails, And More REMOTE PROCESS LIST - List And Terminate Processes Remotely REVERSE PROXY - Browse Websites From The Remote Computer OFFLINE KEYLOGGER - Capture Keystrokes And Deliver To FTP FILE DROPPER - Download A File From URL To Remote Computer REGISTRY EDITOR - Access Remote Registry CLIPBOARD EDITOR - Access Remote Clipboard + Logger DOWNLOAD & EXECUTE - Download & Execute Files From URL To Remote Computer REMOTE LOCK/LOGOFF - Lock, Reboot, Shutdown Remote Workstation REMOTE SCREEN - View Remote Screen REMOTE SHELL - Execute Commands Remotely REMOTE DESKTOP - Access Remote Desktop REMOTE SERVICES - Create, Start, Stop, Delete Remote Services REMOTE PROGRAMS - View And Uninstall MSI Installed Products LOCAL TEXT TO REMOTE SPEECH - Have Your Written Text Spoken Remotely REMOTE BROWSER HISTORY - List History Database For Chrome, Edge, Opera REMOTE WALLPAPER - View And Change Remote Wallpaper REMOTE WAV PLAYER - Play A Wav File Remotely REMOTE MESSAGE - Display A Message On The Remote Screen REMOTE MEMORY DUMP - Download Remote Application Memory In MDMP Format NEXT ADDITION - COOKIE RECOVERY FOR CHROME LIFETIME ACCESS! ONE TIME PAYMENT $70 - BITCOIN OR PAYPAL. GET A PAYMENT ADDRESS BY CLICKING ON THE CONTRACT BUTTON, OR REQUEST ONE FROM ******. AFTER CONFIRMED PAYMENT, PLEASE ALLOW UP TO 24 HOURS FOR DOWNLOAD INFO TO BECOME AVAILABLE. Remember to provide a valid email address. DISCLAIMER / PREREQUISITES SALES ARE FINAL. IT IS INFERRED THAT USERS HAVE PRIOR TECHNICAL EXPERIENCE WITH REMOTE ACCESS SOFTWARE. THIS THREAD IS NOT INTENDED FOR TECHNICAL SUPPORT, INSTEAD USE THE INFO PROVIDED DURING REGISTRATION. PLEASE KEEP ANY CRITICISM POSTED AS CONSTRUCTIVE AS POSSIBLE. ******


dark web image
New RAT & Botnet Setup Service Sale is Detected

In a hacker forum monitored by SOCRadar, a new alleged RAT & Botnet setup service sale is detected. https://image.socradar.com/screenshots/2024/05/03/17d5e8a9-21e4-4287-aeed-cd3458bf9c79.pnghttps://image.socradar.com/screenshots/2024/05/03/0f2de97b-d335-45eb-934d-f2e9f8025644.pngNo Fancy Thread Designs for now. We Make Money using Botnets & RATs and the color is always GREEN ! HOW TO MAKE MONEY USING RAT & BOTNET SETUP ? -- LEARN FROM EXPERT ! Are you Looking for help to setup a successful and profitable malware network ? You are looking at a premium service. The goal is to setup an environment with the method of automatated spreading & earnings in CRYPTO. After Spending thousands of dollar on multiple forums myself, I have gained experience to help you all. What do you receive after purchase ? 1. RAT or Botnet Setup (Depending upon your requirement) - Everyone have a different goal. There is a RAT & Botnet available to meet all your goals. Mining, Loader, Crypto Recovery botnets etc.. - You just have to share your goal and we will take care of everything for you. 2. Lifetime Mentoring & Support Subscription Lifetime means, you never have to pay again for a help again. I myself spent a lot of money on many forums, including here on *** too but support was ridiculous. I know the pain points, You will get a very high quality mentorship and support from me. 3. Domain & Hosting - The purchase includes domain and hosting server. 4. Spreading Method - You just have to setup the spreading method once and bot flows are automated. - You also have option to target any country, niche and behavior of slave types. - The best spreading method you can ever find is here. 5. Private Telegram Group - There is a private telegram group for all buyers - We track earnings of each member - Weekly Hall of Fame announcements - Weekly tasks & activities to sharpen your RAT & Botnet skills - Free stub SCAN [ 2 scans / member/ week ] - DIY [Do it Yourself] Video Tutorials PRICE: $199 Contact: Message me on Telegram @**** Payment Mode: Crypto ONLY - *** Contract Terms - NO Refunds


dark web image
New Rat is on Sale

In a hacker forum monitored by SOCRadar, a new rat sale is detected. https://image.socradar.com/screenshots/2024/04/08/5907fb0a-9b0f-4f1e-9bfd-ad3adfb826d7.pngAndroid RAT\Android remote control ~ Hidden automatic permissions 》 There will be no pop-ups during permissions. ~ Bank card thief + Personal information thief 》 - Easy to cash out using cards, SMS interception ~Trustwallet Thief》 Directly open the Trustwallet phishing wallet and block the original Trustwallet, password capture and 12 word seed phrases. ~ Lock Display 》 with which you can lock the victim's screen so that he cannot open the phone, cannot even see, and you can control everything ~ Automatic phone unlocking (PIN code) 》 You need to detect it once, after which the virus will remember the PIN code and unlock. ~Ready keypad for unlock screen》 Just press the buttons (0-9) and unlock easily ~Lock Screen Repeater 》 Helps you bypass face lock and pattern lock. ~ Screen Reader 》 With this feature, you can log into any banking apps and withdraw money by bypassing the black screen issue. See wallet seed phrases. ~Ransomware 》 You can lock the phone screen and display a QR code with a message about paying out money, otherwise you will not be able to use the phone. - Block Touch - Block Home Button, Block Back Button, Block Recents Button - Works even after screen is locked ~ Screen view 》 Screen control without broadcast icon About the ghost mode function With this function, you can completely turn off the victim's phone and control his phone. The victim's phone display will turn black, the touchscreen will also freeze, and none of the back or home buttons will work. How does the injection work? ~ For example, when you send a command to steal Trustwallet seed phrases, then when the victim opens TrustWallet, instantly a fake page will automatically open and ask for the seed phrases to recover the wallet, otherwise Trustwallet will not gain access. New features: ✓ 11 crypto injections: ~ Trustwallet, Metamask, Exodus wallet, Binance, Kucoin, Bybit, Coinbase exchange, Coinbase wallet, Huobi global, Blockchain, Kraken. There will be more... ✓ Direct display of the fraudulent page on the screen to collect data in real time. ✓ Injection: The scam page will be displayed every time the user wants to open the injected wallet. ✓ PIN and pattern lock for lock screen or specific apps ✓ Instantly sends all logs to a telegram bot ✓ Show custom text on screen in lock mode (covering screen with black layout) ✓ Custom Injection: Add Stealer functionality yourself as needed. ✓ Special Ransomware: Completely lock the victim's phone and display your wallet QR code to force him to pay money and show a warning message. The victim is unable to control the phone during ransomware ✓ Permission Manager: Check and request permissions if user has not provided permissions. ✓ Google 2FA Stealer: Extract all codes directly and save them on your desktop. ✅ Creation of an apk, website, placement of an installation link on your website, implementation of your creo according to your request ❗ ️ ✅ Test Guarantor ➕ ➕

















dark web image
Xeno RAT is Shared

In a hacker forum monitored by SOCRadar, Xeno RAT share is detected. https://image.socradar.com/screenshots/2023/11/01/ff07dadc-7690-411a-9b40-262d3cbdc2e3.pngWelcome to the official thread for Xeno Rat's release, a powerful and versatile remote access tool developed in C# for Windows 10 and 11. This open-source project is designed to provide you with a stable, feature-rich, and easy-to-use solution for remote computer control. Key Features Xeno Rat offers a wide range of features that set it apart from other RATs: - HVNC (Hidden Virtual Network Computing): Enjoy this premium feature for free, enhancing your remote access capabilities. - Live Microphone: Real-time audio surveillance, perfect for various use cases. - Socks5 Reverse Proxy: Proxy your internet traffic through the client with ease. - Regular Updates: The project is actively maintained, and new features are continuously added. - Built from Scratch: Xeno Rat is developed from the ground up, ensuring a unique approach to remote access. Some other features - Listen on multiple ports - Chat - Bluescreen - Message Box - Fun menu (monitor on/off, CD tray open/close, and more) - Webcam - Key Logger - Screen Control - Process Manager - File Manager - Shell - And plenty more... Legal Disclaimer Xeno Rat is intended for educational purposes only. The developer is not responsible for any misuse or damage caused by this tool. Always stay within legal and ethical boundaries. For more details and to access the project, visit Xeno Rat on GitHub. Explore the code and contribute to its development! For anyone who wants to donate, I also included a txt file with the exact same link.


dark web image
Freedom RAT is on Sale

In a hacker forum monitored by SOCRadar, a new alleged RAT sale is detected. https://image.socradar.com/screenshots/2023/10/28/b66cb6f2-3349-4e24-b2af-fa4aa2438c55.pngRemote Administrative Tool ( R.A.T ) written fully in C language ( no dependencies ) - 40 KB. Functions { Fun : - Simple MessageBox popup - Beep Sound - Empty recycle bin Power Management : - Shutdown - Restart - Sleep File Manager : - Download - Execute - Delete - Upload Task Manager : - Kill process Stealer : - Browser logins ( URL / Logins URL / Username / Password ) Screen : - Single Screnshot function ( capture all monitors on target machine - Vertical/Horizontal ) Reverse Functions : - Reverse command prompt - Reverse powershell Clipboard : - Get clipboard content - Set clipboard content Keylogger : - Live keylogger } Functions (included in Builder) { Clipper : - Bitcoin Format -> P2PKH, P2SH, BECH32/Segwit - Ethereum - Litecoin Error Message : - Fully customizable first boot error MessageBox ( Title, Content, Icon, Buttons ) Installation Folder : - Choose between 4 different path Additional : - Disable Task Manager - Persistence - Mutex - Strong anti VM + anti debug } PRICE : 1 BTC ( Garant is welcome ) COPY AVAILABLE : 1/1 Runtime Result : hxxps[://]checkzilla[.]io/scan/fa06e69c-be42-4096-829b-0b88c6d079b6 Scantime Result : hxxps[://]avcheck[.]net/id/MdhKDasbakAb What will you get after purchase ? - Full source code of client side AND also server side + builder. - Full support for installation to your server. - I am ready to explain every line of code 1 by 1 and answer all your questions ( concerning the product ). For any question concerning this product send me a PM, I will be happy to answer you. Server side screenshot : https://image.socradar.com/screenshots/2023/10/28/c45d2cb9-f616-4020-904f-8ec3a4af9599.pnghttps://image.socradar.com/screenshots/2023/10/28/74623855-ddce-4e55-ae5f-8680d7a7d85f.png


dark web image
Source Code of Linux Rootkit is on Sale

In a hacker forum monitored by SOCRadar, a new alleged source code sale is detected for Linux Rootkit. https://image.socradar.com/screenshots/2023/10/28/8d3febc9-5350-4a00-9578-842f8661ea4e.pngSyM Linux Rootkit SyM is a universal user-mode Linux rootkit that will sustainability hold root persistence across all Linux kernel versions, and will successfully bypass any EDR or rootkit detection software. SyM will also come with a plethora of features capable of stealing important files such as SQL database backups, .git, and other configuration files; And much more. Along with being the first of it's kind SyM implements some API system call hooking that has never been seen before which makes it such a unique, and undetectable rootkit experience. C&C / C2 / backdoor methods: ICMP backdoor Use a unique magic identifier to open a reverse shell accept ( ) backdoor Use a unique magic identify to open a listening TCP server PAM backdoor Direct interactive SSH backdoor with custom hidden port, username, and password Internal System Logging: SSH Log Log all incoming and outgoing SSH authorizations in plaintext by hooking pam_vprompt, read, and write API calls Execution Log Log all normal ( including root ) user command execution flow Hiding Self / Rootkit Hide all files, processes, open ports, and all connections based on unique magic identifier Hide process map files, to prevent direct mapping of process and being able to identify rootkit Hide any file, or directory of choice All rootkit master created directories and files will be kept track of, so no need to manually add or edit anything to keep it hidden! Note: It is possible to forge or fake as any other installed software, service, or similar EDR Bypass / Evasion Hooking API calls to hide it's self from / proc * / * maps as well as many other system locations Bypassing SELinux and GRSec Bypasses and hides from SentinelOne and other similar software File Stealer By scanning and keeping tracking of a user made list of interesting files and directories the rootkit is capable of stealing anything on the fly and uploading it directly to an external server Stuff like SQL databases are stolen automatically by default! Pricing Source Code: $7500 Contact Telegram



dark web image
Anubis Stealer is on Sale

In a hacker forum monitored by SOCRadar, a new stealer tool Anubis Stealer sale is detected. https://image.socradar.com/screenshots/2023/09/29/cf4d864b-4fc9-4fd9-ac67-fc693dbdb0bb.pngAnubis Stealer 💥Descriptive 💥 Program for remotely controlling Windows computers via a Telegram bot. Written in C++ language This remote access tool stands out for its exceptional features and high reliability. It supports Windows 10 and 11, both 32-bit and 64-bit operating systems. The software is developed in C/C++, featuring an independent Stub that doesn't rely on the .NET Framework. It boasts a rich set of functionalities, including cookie and password recovery, file management, remote execution, real-time and offline keylogging, remote shell access, and process management. Additionally, it supports obtaining TOKENs for Discord, Telegram, and Steam. The clipboard feature automatically replaces cryptocurrency addresses, enhancing privacy. Importantly, it includes an anti-sandbox feature that detects and counters various virtual environments and analysis tools. The Stub, ranging in size from 500KB to 600KB, ensures efficiency. In summary, this tool is user-friendly, offers a wide range of functionalities, and is suitable for various purposes, whether you need cookie recovery, password management, file transfer, or more. 💥Features💥 Cookies Recovery: This function allows you to recover cookies from popular Chrome and Firefox browsers in JSON format. Password Recovery: This feature enables the recovery of passwords from various browsers (Chrome, Firefox, Edge.) 50+ browsers。 File Manager: With the File Manager, you can upload and download files at high speed, as well as execute and delete files on the target computer. Download & Execute: This function allows you to execute files on remote computers. Remote Shell: This function lets you send commands to the remote computer's command prompt (CMD). Process Manager: With the Process Manager, you can view and terminate processes on the remote computer. TOKEN: Discord, Telegram, and Steam. Clipboard: Automatically replaces cryptocurrency addresses in the clipboard with a predefined address, likely to perform address substitution. AntiSandbox: This feature can detect the presence of virtualization or sandboxing environments like Virtualbox, VirtualMachine, Cuckoo, Anubis, ThreatExpert, Sandboxie, QEMU, and analysis tools. Spoiler: Chromium browsers Edge Edge Beta Google Chrome Google Chrome Beta Google(x86) Opera Software ChromePlus Iridium 7Star CentBrowser Chedot Vivaldi Kometa Elements Browser Epic Privacy Browser uCozMedia Sleipnir5 ChromiumViewer Citrio Coowon liebao QIP Surf Orbitum Comodo Dragon Comodo Yandex 360Browser Maxthon3 BraveSoftware K-Melon Torch Amigo Sputnik SalamWeb BlackHawk QQBrowser Slimjet GhostBrowser Xvast 360Chrome Kinza Xpom Nichrome Blisk UCBrowser Spoiler: Gecko browsers Firefox Waterfox K-Meleon Thunderbird IceDragon Cyberfox BlackHaw Pale Moon Spoiler: Auto Stealer Example https://image.socradar.com/screenshots/2023/09/29/f057555f-e4d7-480f-b2d8-5149c0d5e3fe.pnghttps://image.socradar.com/screenshots/2023/09/29/f4e699e2-e798-4c1b-9b6e-b5eab757f318.pnghttps://image.socradar.com/screenshots/2023/09/29/add014e6-6971-4a03-8634-149b91c038e4.pngSpoiler: Control Command https://image.socradar.com/screenshots/2023/09/29/32c799e1-074b-4cb2-92e3-9bc86f3ad71f.pnghttps://image.socradar.com/screenshots/2023/09/29/fb419557-0909-4d74-9601-a59f4ea06a37.png💥Builder💥 Self-delete after the first run. Add a self-startup entry. Implement a blue screen protection (immediately trigger a blue screen if the program is terminated; this feature requires administrator privileges). Automatically collect cookies, passwords, history, credit cards, bookmarks, as well as data from Telegram, Discord, Steam, and screenshots. Cease communication if a blacklisted process is detected. Activate keylogging. Manage the clipboard and replace preset wallet addresses. Implement anti-sandbox, anti-analysis, and anti-virtual machine measures. Request administrator privileges to run the program. Spoiler: Builder 6.png 💥Subscription Prices:💥 🔥1 month - $120 $39 🔥3 months - $360 $117 🔥6 months - $720 $234 🚀 Limited Time Offer: Get an Extra Month for Free! 🎁 🔥 We've got great news for you! For the first 30 customers, we're offering an exclusive deal – simply purchase our product and receive an additional month absolutely FREE! 🔥 Don't miss out on this incredible opportunity! Act fast and be one of the privileged few to benefit from this special promotion. 🔥 Grab your extended subscription today and elevate your experience with us! 🔥 Hurry, this offer won't last forever. Make the most of it! Thank you for choosing us. We appreciate your trust in our service. 💥 Accepted cryptocurrencies: 💥 BTC, ETH,TRC20 💥Contact: Telegram Channel:💥 Click Here 💥Terms of service: 💥 Click Here


dark web image
CraxsRAT V6.7 is on Sale

 In a hacker forum monitored by SOCRadar, an alleged CraxsRAT V6.7 sale is detected. https://image.socradar.com/screenshots/2023/09/20/6fc0139b-b5cd-4df1-bb68-dee092d2cc25.pnghttps://image.socradar.com/screenshots/2023/09/20/5a8e086b-975f-4bd5-b0b7-276ce15d4605.pnghttps://image.socradar.com/screenshots/2023/09/20/731a40ae-9476-438f-9b1e-9a6b4bc8d59f.pnghttps://image.socradar.com/screenshots/2023/09/20/be396d04-6df8-4699-a111-8be77dab5ee4.pnghttps://image.socradar.com/screenshots/2023/09/20/c1d06e69-3725-4930-82a7-0a4748bedf72.pngDETAILED INFORMATION AND TG FOR DEMO: @********** - !!️ 💯 ANDROID 13 WORKS AS A PROBLEMS IN ALL DEVICES. ✅ Whatsapp Click Reach. --------------------------------------------------------------- CraxsRat V6.7. New Update Attributes. File Manager 🟢Download/Install 🟢Secure Deletion Options 🟢Thumbnail/Gallery view . 🟢 Advanced search 🟢Copy/Paste 🟢Decrypt/Decode 🟢Hidden / Unhidden File 🟢 Set Wallpaper 💠Location 🟢Live Location 💠Live Screen Control 🟢Show Screen Live 🟢Control Screen (VNC) 🟢Use Keyboard 🟢 Lock / unlock screen 🟢Take silent screenshot 💠 Call Manager 🟢 Show Incoming/Outbound Call List 🟢Delete calls 💠 Send SMS 🟢 "Improve "Send SMS" feature 🟢 Send to multiple number 🟢Send from file to list 🟢Send to all people 💠 Application Manager 🟢Show Application List 🟢 Open Application 🟢 Remove Application 🟢 Disable / enable application 💠Keylogger 🟢Online/Live keylogger 🟢Offline keylogger 🟢Save to client folder 🟢Save everything 🟢even the pin of the screen lock 💠SMS Manager 🟢Show SMS List 🟢Delete SMS 💠Extra Tools 🟢 Search Number 🟢Download Linkten Apk 🟢Show Message on Screen 🟢 Clipboard 🟢 Open Link 🟢 Run Commands 🟢 Social Media Hunter 🟢 Stealer Gmail account 🟢 Ste aler Facebook account 🟢 Stealer 2FA Google 🟢Authenticator Code 💠 Permission Manager 🟢Not allowed/ not allowed Permissions checked 🟢 Ask for Permissions from the panel 🟢Request to enable accessibility 🟢 Draw in practice 💠 Account Manager 🟢 Application Email/Number Show Your Account 💠 Auto Clicker 🟢 On the screen Watch User Touch 🟢Save User Touchs 🟢 Repeat User Touchs 💠 Web Browser 🟢Web browser Monitor 🟢Web browser Html Viewer 🟢 Open link and track / save browser 💠 Injection in real app 🟢Silent control 🟢 Work like real practice 🟢 Ask for accessibility 🟢Anti killing 🟢 Anti removal 🟢 Wake up support screen 🟢 Support Permit manager 🟢Support screenshot 🟢Support lock screen 🟢 Recrypt APK 💠 Admin Rights 🟢Executive Rights Request 🟢 Lock screen 🟢 Delete Data ( delete everything ) 💠 Camera 🟢 Take Screen Image Camera 🟢 Open Front Camera 🟢Open Back Camera 🟢Take Photo 💠 Keyboard Manager (Beta) 🟢Phone keyboard 🟢Replace with Spyroid Rat custom keyboard 🟢 Support 3 languages “English – Arabic – Chinese” 🟢Record everything the victim enters 💠 Self Distraction 🟢 Automatic ( with super mode to remove apc and data 💠Microphone Capture 🟢 Listen Talk ✅ Save 💠 Notification Listener ✅Get All Notifications ✅Save 💠 Call Listener ✅Get all call notifications ✅ Save/remove call 💠 Screen Reader Skeleton view or Scan View ✅ Skip the black screen of banks and crypto application ✅Add logo window to easily copy anything from the screen


dark web image
Remote Administration Tool Sale is Detected

In a hacker forum monitored by SOCRadar, a new alleged remote administration tool sale is detected. https://image.socradar.com/screenshots/2023/09/14/33faee49-b62f-40ac-83b9-531ac2644ef5.pngHello everyone, you can find more information about software below. Remote Administration Tool Web admin panel with GUI + realtime remote clients communications One secure encrypted connection to the management server with multiple layers of https+rsa+aes Supports proxy connections over http, socks5 (also with credentials). You can create your own chain of proxy servers to connect to the management server (if your software is located deep in the network) Can be run as a service or as a current user. Universal plug-in system: command line socks5 tunnel file manager - view remote file system directories and download files mimikatz - command line as a plugin (possibly may be unstable using multiply commands with specify environment) vnc, hvnc - custom desktop viewer (under development) keylogger - simple keylogger via RegisterRawInputDevices() (under development) meterpreter - allows you to use the meterpreter module from metasploit framework (under development) screen[snapshots/recordings] - take screenshots and record user screen (under development) collection - complete system information with lost passwords (under development) webinjects - allow the operator to replace web traffic (under development) traffic tunneling - traffic tunneling without system tools (under development) Well tested under: Windows 7 with Service Pack 1 x64 - passed Windows Vista x64 - passed Windows 8.1 x64 - passed Windows 10 x64 - passed Windows 11 x64 - passed Windows Server 2008 x64 - passed Windows Server 2022 x64 - passed Windows 7 x86 - passed Windows 8.1 x86 - passed Windows 10 x86 - passed Minimum server requirements: VPS server with KVM virtualization 2 GB of RAM 1 Central processing unit Network any The TOR service for the licensing server. User Agreements and Terms: All parts of the software you use are at your own risk Messages to the support service about any warnings of the AV software after scanning the file will be ignored AV alerts can be considered at runtime if they can be reproduced in a laboratory environment. If any critical errors are found while using the software, we will try to fix them as soon as possible, depending on the type of error, and your license will be extended for the number of days from the date we receive the report (when we reproduce it in the laboratory) to the date of correction. We use escrow for every money transfer. Only you or your team can use this software package if you transfer the software to a third party, we will block your license. Refunds are not allowed Accepted payment: BTC, Monero. We not provide any bypass or privilege escalation. We not provide encryption for any binaries. After receiving the payment within the next 2 hours, you will have an archive with: web control panel - with plugins and license file of the selected plan x64/x86 executables - for execution on remote systems is about ~1Mb/~700Kb size Domain configuration file - configured for your domain (this is separate file must be copied to the specify folder on the system) Documentation - how install and use software and plugins. Plans for 30 days: Minimum Command Line File Manager Socks 5 Mimikatz 5 Domain Configurations Price: $2,990​ Since this is a raw project at the moment, and possibly can be unstable in some situations, we are adding an additional 30 days to your plan as a bonus. Thank you.


Subscribe