campaign image
Xworm Enters Through the Door Follina Left Open
Xworm Follina RAT Trojan China

Security researchers have identified a new wave of attacks using XWorm malware that exploits the Follina vulnerability. XWorm is a government-sponsored remote access trojan (RAT), the Follina vulnerability is a critical vulnerability in Microsoft Windows systems that was first disclosed in 2022.

Domains Source Last Update
huhuwarcanoefestival.com SOCRadar 2023-05-31
assignments.one SOCRadar 2023-05-31
barricks.org SOCRadar 2023-05-31
template.one SOCRadar 2023-05-31
tpaerospace.one SOCRadar 2023-05-31
codezian.com SOCRadar 2023-05-31
ftp.mgcpakistan.com SOCRadar 2023-05-31
schedule.one SOCRadar 2023-05-31
purepowerinc.net SOCRadar 2023-05-31
templa.one SOCRadar 2023-05-31
myvigyan.com SOCRadar 2023-05-31
kbowlingslaw.com SOCRadar 2023-05-31
kanaskanas.com SOCRadar 2023-05-31
stnicholaschurch.ca SOCRadar 2023-05-31
zaminkaran.ir SOCRadar 2023-05-31
invoice.one SOCRadar 2023-05-31
depotejarat.ir SOCRadar 2023-05-31
list.one SOCRadar 2023-05-31
four-quadrant.one SOCRadar 2023-05-31
direct-trojan.com SOCRadar 2023-05-31
Hashes Source Last Update
de30f2ba2d8916db5ce398ed580714e2a8e75376f31dc346b0e3c898ee0ae4cf SOCRadar 2023-05-31
b79ff504eb6ec509b8b6b870dc2f0113825d859b SOCRadar 2023-05-31
8a60cadc9c823b64a80dd294c54e8c428f7ad12f846c245d3f3df1ba49cf3c62 SOCRadar 2023-05-31
63d46c697ee100fbe7388416033ea0509130e12f144decb1a913e3dc8b82f6ba SOCRadar 2023-05-31
e1d34ad42938a777d80f3ee4c206de14021f13ab79600168b85894fdb0867b3e SOCRadar 2023-05-31
d9a1c97646872be823bce7e37325f9869daa5593f3ced37024dc5188243639be SOCRadar 2023-05-31
9bf99fc32dc69f213812c3c747e8dd41fef63ad0fd0aec01a6b399aeb10a166a SOCRadar 2023-05-31
bdc52f8983b7f034e86d1628efab5faf974e8c33ea9c3bcab0fd09ca462f8322 SOCRadar 2023-05-31
40a1bbf6cc034748781b8980771a288f300e2f79dfff9e4ac70c261b3fe96e67 SOCRadar 2023-05-31
9cd785dbcceced90590f87734b8a3dbc066a26bd90d4e4db9a480889731b6d29 SOCRadar 2023-05-31
78542b48745136d9e77896ec77c7613c4386ad81 SOCRadar 2023-05-31
35369894fad416d9b89df08dad0c0c1848e2bba5 SOCRadar 2023-05-31
28d6b3140a1935cd939e8a07266c43c0482e1fea80c65b7a49cf54356dcb58bc SOCRadar 2023-05-31
328a12fdd6b485362befb392925282451d65aa23482584a49dd5b0e126218df7 SOCRadar 2023-05-31
73dc35d1fa8d1e3147a5fe6056e01f89847441ec46175ba60b24a56b7fbdf2f9 SOCRadar 2023-05-31
07251deafd605437a25d51428aade79255036d49 SOCRadar 2023-05-31
adb237144a52fc610984bd5ae8501271c5eef8ff49eff0a9d02adf4a5e36ad3b SOCRadar 2023-05-31
656a325adc19ae5c66741fcea36e01d1bc27e5a97b800778938af37f41f811fd SOCRadar 2023-05-31
4fc40af3b2e3f96e8013a7187e5cb4ce1a00a9528823f789cb8aca09c51143c6 SOCRadar 2023-05-31
11510279023a5399f5af0495d55eba28 SOCRadar 2023-05-31
8a8c3fc54739248f595ef1941a8a47936ff45fd102d7e8d23e9d4c358d5a0d24 SOCRadar 2023-05-31
ef106973aa35c6a1e39e05c6dde63e421794faba9109a2a9cb2f9cebd363e053 SOCRadar 2023-05-31
66109a8b85766255fa950425c7962781b61c934f6926ecdb9158d50ffb533147 SOCRadar 2023-05-31
59d72ff91e94a2c762285cce3bcb3e94e8d14608c2eeecacdcd6fe720c3ad5f2 SOCRadar 2023-05-31
b5661f5b3219090ba387814b7cf8d8095cfaaca9 SOCRadar 2023-05-31
6965d759dce865196f7e06ced845f0e387c4b9f63081b394c62a3c286356b411 SOCRadar 2023-05-31
7ddb331b1930f9cd3fd7e6de43119db0bbcb20bf6d23b1fbb60db12b0d983c2f SOCRadar 2023-05-31
1005feeff2ecfe6e53f53f63a2364de8418863d83e256322ca82e939dae95e45 SOCRadar 2023-05-31
16fe58bfaee64cce35f0f9470ccfd136ee9916f5befb7e599e21cff53d4506d5 SOCRadar 2023-05-31
4b9d11ad0a32fd2d76d4d8e9256f13df37b7628df9eb50b21dd11016d0a4ca22 SOCRadar 2023-05-31
ad13c0c0dfa76575218c52bd2a378ed363a0f0d5ce5b14626ee496ce52248e7a SOCRadar 2023-05-31
702631c91a8fe86b2e75f4a6b089d00b7762ff1b SOCRadar 2023-05-31
43f4eaefc6e71f8d30b2e3749475af51ce4d6740546706113cc4785b4410a14c SOCRadar 2023-05-31
814187405811f7d0e9593ae1ddf0a43ccbd9e8a37bee7688178487eeef3860c6 SOCRadar 2023-05-31
d4fdc73d563605cadf1ded9b644f21e8dae0f65870890357e5bc554bbc66bf74 SOCRadar 2023-05-31
8276104d8d47def986063b8fbafd82ad5f4cd23862ff9ede1231cefb35115a1b SOCRadar 2023-05-31
4f527d0d250607bcab4af2ba9783c2ce8e62fdc73fd52a33771d3b6df73c49e6 SOCRadar 2023-05-31
c8e326756cc1f95ff51ffe26471df16f4131fdbca2ed14f8c8d14e21010058b9 SOCRadar 2023-05-31
2ba7d799ee3ae3755fa3dc8921b3c57924fe90cb3df2b9bb02119a5eaa77399c SOCRadar 2023-05-31
df3f2f97383d4ae897b3197e8d07f474f651a053 SOCRadar 2023-05-31
15212428deeeabcd5b11a1b8383c654476a3ea1b19b804e4aca606fac285387f SOCRadar 2023-05-31
9c9f69ccc3d0063347ae372d82dc6082 SOCRadar 2023-05-31
f0942afa08c509f58b4b9f02cae4581ebf712f2f1763f1a2ffb8f9d964e335ae SOCRadar 2023-05-31
70352ca74fa8d31d6b1779b56c4fb16834d4e4c6 SOCRadar 2023-05-31
5ff75749c2d51435855afc23501105d259ed8213cd24085e1164f056ac2c2e05 SOCRadar 2023-05-31
54a55fcf5f574e9171aaf9af8aeb58c94d327dae48ed6a586393ed63aeb6841a SOCRadar 2023-05-31
97c6223e869e8bee159767d7b1f3562e747cf4b995800122edd1fc70df7a70b7 SOCRadar 2023-05-31
1b5ec95836cd52efa853ba3fa76d0849e4094b32048952a7ac0676d34f251776 SOCRadar 2023-05-31
ae5935f9e4bf6596d5b83a2d4325ab3f454867ebbad2c7f2d19694b676f23dd2 SOCRadar 2023-05-31
3c3e24c01a675b3b17bee9c8f560a33c3ecca8c44442fd5b3dd8c0f4429f279b SOCRadar 2023-05-31
43905bff6b7bdac9698c9109764e7ac3ffddddf59b9d278c648dfd8e6b1403ac SOCRadar 2023-05-31
6a1bac8fbb30f4b98da7f7ac190fb971bf91d15b41748bc63fd9cbddb96ef189 SOCRadar 2023-05-31
01407e324f0b8090467eded47a97acbdb3ef42d0f12820cd57b0bc5b87ffe510 SOCRadar 2023-05-31
1ae5589b6c358ff11a9555a7265ba5f0709be7a865e2cf51af04eb17b2a2ce18 SOCRadar 2023-05-31
a748f4e526c1a5fed7e57887ef951e451236ee3ad39cf6161d18e5c2230aca0b SOCRadar 2023-05-31
1791dd7a7c7d0688fac3626d57221ada157c57572cf9ed46ad4cab3d28dbaf91 SOCRadar 2023-05-31
3c45a698e45b8dbb1df206dec08c8792087619e54c0c9fc0f064bd9a47a84f16 SOCRadar 2023-05-31
b6b61511ea7a36015f8002922bc20ad1f42234ab SOCRadar 2023-05-31
75819879049e80de6376f146430e63a53fc4291d21f3db930ea872b82d07c77a SOCRadar 2023-05-31
cffb01d11245792b5498c051603a279b0ad1930d SOCRadar 2023-05-31
d92b31ddf25e30e7cc34239bf45c7ec913b713c4 SOCRadar 2023-05-31
bfebd31a5ae7bb79bcf7070d1d4b3496888446cff66301c4ff1f78f06d8aa601 SOCRadar 2023-05-31
e5a33b42b71f8ac1a5371888d11a0066b49a7f0c25fe74857fa07fb0c9bdff27 SOCRadar 2023-05-31
dfb8ba6c2ac264ac73f6d2c440d2c0744c043f1d8435bb798fef5380a649fc4e SOCRadar 2023-05-31
0afe54c016f4770ad2a8690ef9a06b1f53804215 SOCRadar 2023-05-31
41c68aecada65a15f4a8bea52cc25033a1b73ff7340cd3865d55c61ded566e81 SOCRadar 2023-05-31
222b1a425f75fc7998a0bbabd52277cd82bb5ec50b75f4fb67568b3b754f5406 SOCRadar 2023-05-31
6f3491d165ac055811596f2d64ad107247e19b333d79316c0ac96c93787c1e1a SOCRadar 2023-05-31
2bfae4b7bf4dd42b7f588699952b17260376da61c530d61eceb07783b8b93331 SOCRadar 2023-05-31
db1185f24c56cadec1c85a33b0efeb2d803ff00abf4c9df1e00d860683068415 SOCRadar 2023-05-31
a5ae1b866c5d8a7b3eb8427e686cf5d0264b809ed4491b47346542bf69caab65 SOCRadar 2023-05-31
9419d7a578338a714f976fb2b9eb320049422ec7059cedcc4a8baf144c4df41b SOCRadar 2023-05-31
b5da32a803b31d769d4d330e9c923d8c2dc5da1f SOCRadar 2023-05-31
0ff4aa2eb1cd681e3b77348af935bcfc56f4b7cae48bcd826000b7ff2b82b671 SOCRadar 2023-05-31
c9047fbd8b733a3f21fb28d261c9fa4eb089335a6457c6a47636cf51a86323f2 SOCRadar 2023-05-31
3acac1bb2a028372aad7f36510028823a36c5d63eeb3a72e0c5804adec204fce SOCRadar 2023-05-31
6ced4f98cd34cc2ea725273d566ea7b7 SOCRadar 2023-05-31
ae9821a3b0f44bf6be21aaa71274c9fef3b22b9e SOCRadar 2023-05-31
4de07012796040395015b6acfab5996cebb2099bfb362da9b303246580bc41b7 SOCRadar 2023-05-31
fbc916f065157cc5a13f22453c19f7dfecc3c228 SOCRadar 2023-05-31
efd195d8ef795e123bb1c1faee77459a781c003e SOCRadar 2023-05-31
90cb95264d0b555fe9a760de404196ac183a958c9cc1aad0689598e35fbb0c3b SOCRadar 2023-05-31
e6bb0019f6aa3583c42c8e197631af09f07bdc8739442893cc8086f298929e33 SOCRadar 2023-05-31
04ce543c01a4bace549f6be2d77eb62567c7b65edbbaebc0d00d760425dcd578 SOCRadar 2023-05-31
b4dd3e93356329c076c0d2cd5ac30a806daf46006bdb81199355952e9d949424 SOCRadar 2023-05-31
7a7e76553dafc2c1b6a0d804aa540ab7a80fd77b SOCRadar 2023-05-31
fc54858ae2e48c9dbe562f68107d1928 SOCRadar 2023-05-31
6e116713f7dbf7001384a4aa15ba193cf9f9f4e2e6685ead326317a78623a57e SOCRadar 2023-05-31
c443d754153180ebeee1106d5eecf1024e063413f3f92a29c6c95a08c6f2e633 SOCRadar 2023-05-31
35b9fd8856edd443a4e27727c54dd135e26220bd SOCRadar 2023-05-31
62156e5cb9fb9ede3150c39e17999d0242a8b1f9e704e09514734891beb0f78d SOCRadar 2023-05-31
ef5a7fc0c2a301b57f0723af97faea37374b91eb3b72d8ca6ffc09a095998bb2 SOCRadar 2023-05-31
c9c522936a3b964e6926bfb73adca91f0091094964ce7a768418a705ec871502 SOCRadar 2023-05-31
377fe4e55b6dde063c15c41389f3bb5aacf95443874bdcc0d02a44d6bd793780 SOCRadar 2023-05-31
e318c01fcd1f711fd063e845ca2431012086658f SOCRadar 2023-05-31
2725a14da90a6bcbfde174df8b0e95179b617aa14ec07a2d1fc71000310ad913 SOCRadar 2023-05-31
ed67cb8a6c44871ec6ffb6517d77b5e84f00b399 SOCRadar 2023-05-31
2db74e81e02dbb8b97a8d0ba9df53aaea21ce0fba15c1ecf84847489d9469141 SOCRadar 2023-05-31
2f5304b657b07839525d7d3ef50f192cde2bcab15b8fde2a6ff264f6412290df SOCRadar 2023-05-31
7ef65d74cf65128bb37a7b21729a1406 SOCRadar 2023-05-31
06e3abeed1bc98ed56d5587e9732c9d39ea41879c250dff68ce8815953fcf7ad SOCRadar 2023-05-31
207b87124f8abe2226251eb84f033e8642418fb1 SOCRadar 2023-05-31
6d86f36b2220e8d9580e6708856fa74f37f7aa35db1a708e17ecacf0de3d5d2e SOCRadar 2023-05-31
292b5a8c61eb79633590b6b13c0b41388ccad3535b55ed822b887d6d15d61be4 SOCRadar 2023-05-31
13bf9005b428f81a2f9b85fab4b52983ccf12c77582803bce9d6fcea635e78f3 SOCRadar 2023-05-31
0d17a7f60f7f5a6d5e00ed23635dd4998a5df307 SOCRadar 2023-05-31
4746941996305743c9d0bcb96ed4b2b930355cd8782098aa5600b42131314308 SOCRadar 2023-05-31
6005529195e6afac29d8c62091ee7990e92b7a80b391b03c34c8a8fbf019fce6 SOCRadar 2023-05-31
d909a2914e3706fcc141aa5d24afddd06595774d67a2900e256fbc65ff12c64f SOCRadar 2023-05-31
b3c3599ea42551a06aaefc917b72410833b52adb9f64f7cfe0bde4b17603bd43 SOCRadar 2023-05-31
30659ba72c4977c6017c45a45909442417c5bc07e7f3a2392b352d29494cb226 SOCRadar 2023-05-31
2283c3be89eb6cbf0e1579a6e398a5d1f81a50793fcca22fbc6cbdab53dc2d31 SOCRadar 2023-05-31
23b950b209cb16b084cad87c006dc7691c60dc40 SOCRadar 2023-05-31
15f8a879534143a4169c6ecd1d56132d1908443d SOCRadar 2023-05-31
9322af1c1772c02304576f64617aae1bf178297617f635d4d036ef1d317b1c7f SOCRadar 2023-05-31
3102e1238ac6ad9f97e4faaf2b24f6df4caedde9abcf7a5c04c309a38069494e SOCRadar 2023-05-31
4b9d2f4b80ef9578711c569524694905012a8080 SOCRadar 2023-05-31
8cb57a7e1e929c48716974edf55df2e9456d1443 SOCRadar 2023-05-31
0b0c70ee1612139cf7a83847cca805689aec9fbcc587a7ef8f26aa4fb9e71295 SOCRadar 2023-05-31
d0f0380f117ed5f00295d07a7f5d90a993e6f74f0f315c9ab74b146970b5061d SOCRadar 2023-05-31
ed7d361424df5f61f4f9e0a589a158cb750dec76f1d97b0e396a00c41f7ce167 SOCRadar 2023-05-31
1a517a25d55aae6af13d025b1d1edee7fb185b90155f30e195f58cbf4c6b36fe SOCRadar 2023-05-31
63adbabf3dfde36e745f4c42979260a2e946848c SOCRadar 2023-05-31
66c045eb61f2e589b1e27db284c9c518e5d0e87dcff25b096eede7047f7dd207 SOCRadar 2023-05-31
a447fee5372ccb5a4efc5daf48f497d921a7dc01d3d4f24dd3c4319da9f55ae4 SOCRadar 2023-05-31
9a7061a539333e9f833a589197a60258ebb820bba5f1f29d5b31453e8e392d0f SOCRadar 2023-05-31
55781d120a91b71da2c51ed3657a73e819493f38 SOCRadar 2023-05-31
c59f95d9c9ff830d33fb73c2a8b0ee8be6619b6823fc23210600b9fa88a8c9d4 SOCRadar 2023-05-31
e2b70c8552b38a6b8722d614254202c346190c6a187984a4450223eb536aaf4b SOCRadar 2023-05-31
f3e6621928875a322ee7230ccf186bdaa5609118c4a6d1c2f4026adfb8e88744 SOCRadar 2023-05-31
ec614c9bd5d20f97871c22b04c3e2abb95366aa5f6e5c6a4148d35ec7b8d0d62 SOCRadar 2023-05-31
ce4611b2d2e326ff7b37acdc10636f0dcd9439ba SOCRadar 2023-05-31
Ipv4s Source Last Update
212.193.30.230 SOCRadar 2023-05-31
5.42.199.235 SOCRadar 2023-05-31
95.216.102.32 SOCRadar 2023-05-31
154.12.234.207 SOCRadar 2023-05-31
109.107.179.248 SOCRadar 2023-05-31
193.149.185.229 SOCRadar 2023-05-31
198.23.172.90 SOCRadar 2023-05-31
165.22.48.183 SOCRadar 2023-05-31
209.126.2.34 SOCRadar 2023-05-31
172.245.45.213 SOCRadar 2023-05-31
212.87.204.83 SOCRadar 2023-05-31
45.133.174.122 SOCRadar 2023-05-31
179.43.187.241 SOCRadar 2023-05-31
209.126.83.213 SOCRadar 2023-05-31
154.12.250.38 SOCRadar 2023-05-31
Cves Source Last Update
CVE-2022-30190 SOCRadar 2023-05-31
Emails Source Last Update
Domains Insert Date
TTP's
The adversary is trying to get into your network.

Initial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. Techniques used to gain a foothold include targeted spearphishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords.

Techniques
Techniques: 9
IDNameDescription
T1189Drive-by CompromiseAdversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token.
T1190Exploit Public-Facing ApplicationAdversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
T1133External Remote ServicesAdversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
T1200Hardware AdditionsAdversaries may introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.
T1566PhishingAdversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.
.001Spearphishing AttachmentAdversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
.002Spearphishing LinkAdversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
.003Spearphishing via ServiceAdversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
T1091Replication Through Removable MediaAdversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
T1195Supply Chain CompromiseAdversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.
.001Compromise Software Dependencies and Development ToolsAdversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.
.002Compromise Software Supply ChainAdversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
.003Compromise Hardware Supply ChainAdversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
T1199Trusted RelationshipAdversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
T1078Valid AccountsAdversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
.001Default AccountsAdversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.
.002Domain AccountsAdversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.
.003Local AccountsAdversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
.004Cloud AccountsAdversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management systems, such as Windows Active Directory.
Remediations
The malware remediation process starts with personnel identifying and reporting malware and any security gaps that create opportunities for malware attacks. 
Investing in resources to train personnel on reporting suspected malware can significantly reduce the risk of malware attacks. Specifically, new hire onboarding and refresher training processes help educate personnel about malware remediation steps. 
Reporting Suspected Phishing Attacks
Threat actors commonly exploit phishing attacks to deploy malware on targets’ devices (e.g., computers, phones, tablets). Phishing emails are one of the most common sources of malware attacks.
The essential malware remediation steps for reporting phishing attacks include:

Identify signs of phishing – Training personnel on how to identify common phishing attempts will help mitigate malware attacks. This is an essential cybersecurity practice for preventing phishing, as the attack targets people rather than network or security infrastructure. Personnel can identify phishing attacks based on:
Malicious links in emails, leading to unsecured websites
Links to compromised forms that request users to enter sensitive credentials
Emails of an urgent nature, albeit likely containing wording and grammatical errors
Flag phishing attempts – Once your employees have identified phishing attempts, they must flag the phishing emails by:
Forwarding emails to an internal cybersecurity team for further action
Moving emails directly to a spam folder for internal security review
Blocking sender email addresses used in previous phishing attempts
Submit phishing reports – You can also establish a security policy for employees to report phishing emails to relevant cybersecurity regulators, including:
The US Computer Emergency and Readiness Team (US-CERT), which partners with the Anti-Phishing Working Group (APWG)
Google’s Safe Browsing phishing reporting tool
Federal Trade Commission’s (FTC) fraud reporting tool
FBI’s internet crime reporting tool
Establishing a security policy for your employees to report phishing attacks is essential to the malware remediation process.
Conclusions 
Malware developers with little or no responsibilities can create malicious programs and sell them on various forums for monetary gain. Threat actors are provided with highly impactful and dangerous features, such as ransomware and HVNC modules to attract more customers. You must have a system in place to keep yourself abreast with TTPs of newly launched threats or if there are new attack techniques adopted by existing cybercriminal groups.

File Name Description Actions
12.ATIP_Analysis Report on Follina.CVE-2022-30190.Vulnerability_20220627.pdf Follina Report
APT Name Aliases Target Countries Source Countries Total IOCs
timeline History Timeline
  • Wed, 31 May 2023 09:26:48 GMT
    New Report Added

    12.ATIP_Analysis%20Report%20on%20Follina.CVE-2022-30190.Vulnerability_20220627.pdf report added.
  • Wed, 31 May 2023 09:22:56 GMT
    New IOC's Added

    Total 231 IOC's added.
  • Wed, 31 May 2023 09:09:37 GMT
    Created!

    New Campaign created.
  • Fri, 12 May 2023 00:00:00 GMT
    XWorm Malware Exploits Follina Vulnerability in New Wave of Attacks
    Cybersecurity researchers have discovered an ongoing phishing campaign that makes use of a unique attack chain to deliver the XWorm malware on targeted systems.
  • Mon, 24 Apr 2023 00:00:00 GMT
    Malicious PDF delivering XWORM 3.1 Payload
    Delivering Malicious PDF documents as email attachments is the easiest way for threat actors to get into the victim’s machine be it phishing, or embedded scripts for delivering malware payloads.
    This time SonicWall Capture Labs threat research team has observed PDF being used to deliver Xworm 3.1 malware.Go to Link
  • Thu, 20 Apr 2023 00:00:00 GMT
    XWORM RAT Security researchers warn of rapid malware proliferation
    Security experts warn about a fast-spreading malware with disturbing features. Some computers have already been infected.Go to Link
  • Tue, 30 Aug 2022 00:00:00 GMT
    XWorm RAT Found in New EvilCoder Project
    A global threat intelligence provider studied Evilcoder, a project meant for selling malicious tools to execute malicious HNVC modules and ransomware attacks online. Furthermore, it was found distributing XWorm RAT. Go to Link
     
newspaper Dark Web News
dark web image
Spark RAT is Shared

 In a hacker forum monitored by SOCRadar, an alleged RAT tool share is detected which is called Spark RAT. https://image.socradar.com/screenshots/2024/06/14/962465a7-bfc5-44ac-9a90-19184630f099.pngSpark is a free, web-based, cross-platform and full-featured RAT (Remote Administration Tool) that allow you to control all your devices via browser anywhere ! PLEASE ONLY USE FOR TESTING ! https://image.socradar.com/screenshots/2024/06/14/0151bab1-1c20-41c5-9684-ea6a7d5f00df.pngHOW TO USE :​ ​ Open executable to create network path in your computer Configuration file config.json should be placed in the same directory as the executable file. Example: { "listen": ":**", "salt": "**", "auth": { "username": "**" }, "log": { "level": "info", "path": "./logs", "days": 7 } } listen required, format: IP:Port salt required, length <= 24 after modification, you need to re-generate all clients auth optional, format: username:password hashed-password is highly recommended format: $algorithm$hashed-password, example: $sha256$11223344556677AABBCCDDEEFF supported algorithms: sha256, sha512, bcrypt if you don't follow the format, password will be treated as plain-text log optional level optional, possible value: disable, fatal, error, warn, info, debug path optional, default: ./logs days optional, default: 7 Run executable and browse to http://IP:Port to access the web interface. Generate a client and run it on your target device. Enjoy! https://image.socradar.com/screenshots/2024/06/14/fca4e6eb-c223-49b9-9815-12c3ce1f4b6d.pngDownload: https://**

dark web image
New Rat is on Sale

In a hacker forum monitored by SOCRadar, a new rat sale is detected. https://image.socradar.com/screenshots/2024/06/11/57a41f65-8821-4b61-83e3-ef790c67dd1c.png⭐VIPER ANDROID RAT ⭐ BEST ANDROID REMOTE CONTROL 彡 The only secure Phone is one that's powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards 🥬 Viper Android Remote Tool 🥬 ✅ A model of excellence in the market for monitoring an unlimited number of Android devices. Prepare to be captivated by its feature-rich features that will exceed your expectations. ✅ sets a new benchmark in darknet monitoring software, offering you super expertise in dark skills. ​ Special Features​ Quick screen control Hidden auto-resolution permissions PIN code to unlock screen in one click Keyboard that can be unlocked by pressing keys Password repeater to bypass face lock and pattern lock Crypto WALLET stealer (seed phrase stealer + direct cryptocurrency transfer) Coinbase,Trustwallet, Hidden screen control | custom text layout vnc | Keylogger to capture all passwords, chats, typed texts Black screen for hidden phone control (disable the victim's phone and you can control it hidden) Screen reader to bypass black screen of banking or crypto apps Read SMS Send SMS Call history Contact Manager File Manager Disable apps Live broadcast from camera Live microphone (talk/listen) Delete/Download files/Folder Crypto Clipper (safely changed the copied wallet address to your own wallet address) And much more....... 📲 Tested up to Android 14 ✅ Bypass antiviruses ✅ Bypass game protection ✅ No pop-up window during automatic permission resolution. ✅ Anti-deletion

dark web image
New Murrra1n RAT Tool Share is Detected

In a hacker forum monitored by SOCRadar, a new alleged Murrra1n RAT tool share is detected. https://image.socradar.com/screenshots/2024/06/05/42495f98-edf6-4968-b4e8-4f342b6b9926.pnghttps://image.socradar.com/screenshots/2024/06/05/4d0f73f6-4ce6-46c6-bc8b-40f87547e03d.pnghttps://image.socradar.com/screenshots/2024/06/05/09a48a1b-574f-4743-a423-7dae6ac92a2e.pngNow the client and modules will not work on workstations CIS countries (Belarus, Ukraine, Russia, etc.) MuRra1N RAT is translated into four languages (Russian, English, Ukrainian, German) Added anti-drain system on VT and other services. Support for 2 operating modes: Pastebin URL and No-IP: Free Dynamic DNS (https: //www.noip.com,www.bestfree.ru,dyn.com/dns) Removed PDF instructions (no longer needed) Installer removed Informative panel of logs Built-in port checker (TCP, UDP) Encryption algorithm changed Fixed bug in determining system bit rate. Fixed error in determining the license key in the module "System Manager" Added geolocation definition in the module "System Manager" New functionality: Feedback via telegram to choose from: (Notifications of new connections or full collection of information: GEO System information browser data collection (Chromium, Edge, Firefox) Collect potentially important files from the desktop from "My documents" and user folders create a screenshot and webcam (if any) Added option to collect from more than 60 programs FTP Gaming Mail Mesenger VPN Crypto wallets added (Armory, Atomic, Bytecoin,Ethereum, Exodus, Jaxx, ZCASH) The basic size of the client is 550 ~ 570kb Plugin libraries have been optimized 2 Watchdog modes 1 mode-Auxiliary process 2 mode-Through the scheduler Added ForkBomb option (On PC the heap of processes is created, as a result arises memory overflow that hangs PC) Added BSOD option (Causes blue screen of death (BSOD))

dark web image
New LightCosmos RAT Tool Share is Detected

In a hacker forum monitored by SOCRadar, a new alleged LightCosmos RAT tool share is detected. https://image.socradar.com/screenshots/2024/05/24/0e9bfd64-6a5a-4f58-8248-c0a27aa8d027.pngLightCosmos RAT

dark web image
Lime RAT is Shared

In a hacker forum monitored by SOCRadar, an alleged RAT tool share is detected which is called Lime RAT. https://image.socradar.com/screenshots/2024/05/16/e2c74603-b59e-4376-8258-dd2a2789960b.pnghttps://image.socradar.com/screenshots/2024/05/16/20491551-9dd1-449a-b95f-a7f755390ff6.pngLIME RAT - POWERFUL NON RATTED RAT!​ About this rat:Main Features .NET Coded in Visual Basic .NET, Client required framework 2.0 or 4.0 dependency, And server is 4.0 Connection Using pastebin.com as ip:port , Instead of noip.com DNS. And Also using multi-ports Plugin Using plugin system to decrease stub's size and lower the AV detection Encryption The communication between server & client is encrypted with AES Spreading Infecting all files and folders on USB drivers Bypass Low AV detection and undetected startup method Lightweight Payload size is about 25 KB Anti Virtual Machines Uninstall itself if the machine is virtual to avoid scanning or analyzing Ransomware Encrypting files on all HHD and USB with .Lime extension XMR Miner High performance Monero CPU miner with user idle\active optimizations DDoS Creating a powerful DDOS attack to make an online service unavailable Crypto Stealer Stealing Cryptocurrency sensitive data Screen-Locker Prevents user from accessing their Windows GUI And more On Connect Auto Task Force enable Windows RDP Persistence File manager Passowrds stealer Remote desktop Bitcoin grabber Downloader Keylogger Download :  https://**

dark web image
ToxicEye RAT and Stealer is Shared

 In a hacker forum monitored by SOCRadar, a new alleged RAT and stealer share is detected which is called ToxicEye. https://image.socradar.com/screenshots/2024/05/16/27bd2b2b-ff1e-473c-bcc5-a0f3cb05c935.pngFunctions:ComputerInfo, BatteryInfo, Location, Whois, ActiveWindow, Webcam, Microphone, Desktop, Keylogger, ClipboardSet, ClipboardGet, ProcessList, ProcessKill, ProcessStart, TaskManagerDisable, TaskManagerEnable, MinimizeAllWindows, MaximizeAllWindows, GetPasswords, GetCreditCards, GetHistory, GetBookmarks, GetCookies, GetDesktop, GetFileZilla, GetDiscord, GetTelegram, GetSteam, OpenCD, CloseCD, DownloadFile, UploadFile, RunFile, RunFileAdmin, ListFiles, RemoveFile, RemoveDir, MoveFile, MoveDir, CopyFile, CopyDir, Speak, Shell, MessageBox, OpenURL, SendKeyPress, NetDiscover, AudioVolumeSet, AudioVolumeGet, SetWallPaper, BlockInput, Monitor(off/on), DisplayRotate, EncryptFileSystem, DecryptFileSystem,ForkBomb, BsoD, OverwriteBootSector, Shutdown, Reboot, Hibernate, Logoff, Help, About, Uninstall. Download: https://**

dark web image
New Android Rat is on Sale

In a hacker forum monitored by SOCRadar, a new android rat sale is detected. https://image.socradar.com/screenshots/2024/05/09/bab9bc37-e7e7-429f-9579-0fe7993045f0.pngANDROID RAT 2024 - FUD ANDROID RAT 2024 - FLAME RAT

dark web image
Crax Rat are on Sale

In a hacker forum monitored by SOCRadar, a new alleged Crax Rat sale is detected. https://image.socradar.com/screenshots/2024/05/09/c40249f1-9ee5-47e1-b5e8-01e05fcbf2e4.pngHere is the Craxs Rat 7.4 Credit By ** # # # Only For An Educational Purpose Dont Hack the people # # Here is the Craxs Rat: https://** # # VT:https://** Exclamation Pass: Cracked By @**

dark web image
A New Android RAT is on Sale

 In a hacker forum monitored by SOCRadar, a new andoid RAT sale is detected. https://image.socradar.com/screenshots/2024/05/09/d8c40df0-f382-469e-9fb2-b1fd610b14c5.pngAndroid RAT is the best on the market tg channel : https://** contact tg : https://** 1 month 1500 usd 2 month 2500 usd ~ Screen control ~ Hidden automatic permissions ~ Lock / unlock the screen but sometimes the first time may not unlock the password or pattern for this there is a button to reset the memory and recapture. there is also a solution to capture by giving the victim a phishing pattern or pin code to unlock. also you can see the pin code in the keylogger. ~ Keyboard for keystroke unlocking ~ Ransomeware (full phone lock and display message and QR code to pay money. ~ Black screen to silently control your phone ~ Text readers on screen ~ Anti-Uninstall ~ SMS Interception ~ Calls, Contacts, ~ File Manager - 11 crypto-injections (trustwallet, metamask, binance, exodus, bybit, huobi, sberbank, coinbase, kucoin, etc.) waits until the victim decides to log into the application and issues a phish request instead of the original application to capture logs. ~Enable / disable applications ~Live Camera (Front / Back) ~Live Microphone (talk / listen) ~Keylogger to capture all passwords, but it happens that not all passwords are captured or the victim may have a face ID or a finger to enter a particular application. - Screen Reader is a black screen reader for bypassing black screen in applications like revolution or smart id or authenticator. There are also issues with the crypto apk, as we are always trying to improve our crypto to bypass the protection of top banks, because it happens that Google does not detect the virus, but Sberbank for example does. Crypt can fall off because of some client to whom you will throw and he will not install and will send there to Google or to the virus total. In the panel it will be possible to make yourself an apk as much as you want plus I will give the latest actual method of crypto with the help of programs so that you can make yourself several apks. If the crypto falls off, all the clients that you put this particular apk with this crypto will disappear because they will also start detecting. And the victim can always stop you from turning off the phone or pulling out the SIM card or turning off the Internet or start clicking all the buttons when you turn off the screen, you have full access but the victim can stop you from doing anything so you have to learn how to do it. and so much more. Translated with ** (free version) https://image.socradar.com/screenshots/2024/05/09/4870bafb-15c2-4823-8d04-6086dd039d45.png

dark web image
New Razor RAT/Malware Tool is on Sale

In a hacker forum monitored by SOCRadar, a new alleged Razor RAT/Malware tool sale is detected. https://image.socradar.com/screenshots/2024/06/03/5f14c366-3321-4a3c-ad63-2dcddf9944fb.pnghttps://image.socradar.com/screenshots/2024/06/03/80c1cfef-f2e8-4ecd-89d1-0e917849dff0.pnghttps://image.socradar.com/screenshots/2024/06/03/58f72f61-bb20-4b43-a88e-5a4b8c325878.pnghttps://image.socradar.com/screenshots/2024/06/03/f928306d-f0c1-4345-8a03-0c1f381a7b6f.pngRAZOR NATIVE C++/ASM RAT/MALWARE POWERTOOL FOR A VARIETY OF CYBERSECURITY PROJECTS. HARDCODED BOT FEATURES: 32-BIT EXE INJECTS/RUNS ON BOTH 32/64 BIT ARCHITECTURES "EVASION OPTIONS" - KILL BOT/PAUSE CONNECTIONS WHEN NAMED THREAT IS DETECTED OPTIONAL INSTALLATION OPTIONAL MELTING/WIPING OF EXE FROM START LOCATION OPTIONAL PERSISTENCE WITH REGISTRY, SCHEDULED TASK, OR START FOLDER OPTIONAL WINDOWS DEFENDER EXCLUSIONS OPTIONAL AUTO ELEVATION DURING BOT EXECUTION OPTIONAL SELF DESTRUCTION OF EXE AT GIVEN DATE OPTIONAL TEST MODE ADDITIONAL FEATURES: ENCRYPTION MANAGER - BULK FILE ENCRYPTION WITH MULTI DRIVE SUPPORT (NEW: MAY 2024) INSTANT DOWNLOADER - DOWNLOAD/EXECUTE PAYLOADS FROM THE WEB ON BOT START INSTANT PASSWORD RECOVERY - RECOVER PASSWORDS TO WEB (HTTP/S) ON BOT START (APPS BELOW) PASSWORD RECOVERY THROUGH MANAGER (APPS BELOW) COOKIE RECOVERY THROUGH MANAGER (APPS BELOW) WEBCAM CAPTURE WITH LOGGING MICROPHONE AUDIO CAPTURE WITH LOGGING OFFLINE KEYLOGGER LIVE KEYLOGGER - VIEW KEYSTROKES IN REALTIME SCREEN CAPTURE WEB BROWSER HISTORY VIEWER REMOTE SHELL FILE EXPLORER WITH THUMBNAIL VIEWER DROPPER - DROP FILE FROM URL TO REMOTE FILE SYSTEM DOWNLOAD AND EXECUTE THROUGH MANAGER CLIPBOARD EDITOR WITH LOGGING REVERSE PROXY OPEN WEBSITE/BROWSE TO URL REMOTE DESKTOP REMOTE BROWSER (WIN10: CHROME, EDGE, BRAVE. WIN11: CHROME, BRAVE) CAPTURE PROCESS MEMORY (MDMP) PROCESS MANAGER SHOW REMOTE MESSAGE SERVICE MANAGER (CREATE, START, STOP, DELETE) PROGRAM MANAGER (MSI) REGISTRY EDITOR REMOTE SYSTEM LOCK/REBOOT/SHUTDOWN GET/SET WALLPAPER REMOTE WINDOW CONTROL REMOTE WAV PLAYER LOCAL TEXT TO REMOTE SPEECH PASSWORD RECOVERY APPS: CHROME, OPERA, BRAVE, EDGE CHROMIUM, FIREFOX. VIVALDI, FOXMAIL, WIFI COOKIE RECOVERY APPS: GOOGLE CHROME. ONE TIME PAYMENT, LIFETIME ACCESS: $80 PAY WITH BITCOIN, MONERO, ETHEREUM, LITECOIN, USDT, PAYPAL. REQUEST A PAYMENT ADDRESS BY STARTING A CONTRACT OR BY CONTACTING: EMAIL:******** TELEGRAM: T.ME/******* PREREQUISITES: IT IS INFERRED THAT USERS OF THE SOFTWARE HAVE PRIOR TECHNICAL EXPERIENCE. TERMS: SALES ARE FINAL THIS THREAD IS NOT INTENDED FOR TECHNICAL SUPPORT, PLEASE USE THE INFO PROVIDED AFTER PURCHASE. PLEASE KEEP ANY CRITICISM POSTED AS CONSTRUCTIVE AS POSSIBLE. KINDLY FORWARD ANY QUESTIONS TO:*********

dark web image
New Recruitment Post is Detected

In a hacker forum monitored by SOCRadar, a recruitment post is detected who is specialized in RATs. https://image.socradar.com/screenshots/2024/06/03/9dbfd5f9-e1d1-41c3-8695-aa7d4e0c9e2d.pngHello ****, I’m on the search for a talent developer that specializes in RATS. I’m needing something custom and specific created. Please dm me for more info if you are interested in the role. Thanks, *******

dark web image
A New Fingerless Rat is on Sale

In a hacker forum monitored by SOCRadar, a new alleged Fingerless RAT sale is detected. https://image.socradar.com/screenshots/2024/05/02/6cfd35fc-ea4b-41bd-a028-3179646dd736.pngPrice $150,000 Contacts t.me/******* Rakuzan(name corrected): Solution for Remote Welcome to the future of remote management and support. We are pleased to introduce you to Rakuzan - your reliable tool for effective remote work and troubleshooting technical problems. Whether you're an IT professional, a system administrator, or just an account manager, our software is designed to make your job easier. Key features of the program: 1. Convenient Connection Rakuzan offers instant connection to remote devices. Now you can solve the problems of your clients or employees from anywhere in the world. There is no longer any need to wait or physically visit the client - everything is in your hands. 2. Security at the Highest Level We understand how important data security is. That's why our program uses high-level encryption to ensure your data and communications are protected. Your clients and employees can be assured of confidentiality. Since our code is directly merged through the official white production, as a result we have safe and secure traffic that travels ONLY through our VPS/VDS through an encrypted protocol, in contrast to the official white software which drives traffic through the off-server and is tracked. Due to this, we always have only fresh and relevant program material with all updates 3. Multifunctionality Our program supports a variety of platforms and operating systems. You can remotely manage Windows, macOS, and Linux devices. In addition, our program offers teamwork tools to facilitate coordination between teams. 4. Interactive Control The program includes functionality for interactive control, allowing you not only to remotely control devices, but also exchange files, send messages and run scripts. Everything you need for effective support is in one place. With our program you will get full access to the client’s computer without his knowledge, with full access on behalf of the administrator (registry, computer management, etc.), and it is also possible to open various programs in secret from the client, for example, such as WhatsApp, Telegram, Chrome and others you need 5. Flexible Pricing We offer fixed and fair prices to suit your needs and budget. Regardless of the size of your business, we will find a suitable plan that will allow you to make the most of our software in your business. 6. Secretiveness in working with clients “With the advent of the Internet on the client’s computer, we have full access to his PC” We have done almost everything to make the program as invisible as possible in use for the client, because the application is active from the initialization of the Ethernet adapter in the client’s BIOS, and also Rakuzan works without any icons or shortcuts, it works only on the basis of one service, we are currently searching and developing Ways to hide the installer from Applications in Windows settings. Our program also supports such functions as: - “silent” connection to the client - simple implementation to the client - the ability to observe, listen, record the client’s screen (possible in semi-automatic mode) - report on connect-disconnect activity, who connected where when - flexible configuration rights of workers on the server side - the ability to pick up and download files to the client past his desktop (that is, we can pick up files and the client does not have any copy window) - information about the client (IP addresses external and internal, motherboard\laptop model, what applications installed, what processes are currently running, etc.) - the ability to organize clients by groups\subgroups\name, etc. - there is no need for the client to always be on the same network, if the client changes the network, it will still automatically connect to the server and you can will work with it - the application runs as a service, so when you turn on the PC it starts immediately after the system starts - it is possible to install the client on Linux, MacOS systems -And much more ________________________________________ Why waste time and resources on complex processes? With our program you will get a fast, secure and versatile tool that will make your work easier and improve customer support. Learn more about our capabilities and start using this program today. Contact us for special offers and a trial version of the program. We are ready to help you take a step forward in the world of remote work and technical support, as well as improve the quality of your business.

dark web image
New Fraternidade RAT Tool Share is Detected

In a hacker forum monitored by SOCRadar, a new alleged dFraternidade RAT tool share is detected. https://image.socradar.com/screenshots/2024/05/10/68e2d13c-b6d9-4899-8782-c5290b0a1882.pnghttps://image.socradar.com/screenshots/2024/05/10/4d0a3dd6-2b14-41be-a702-24bbff0331c9.png♻️ FEATURES ♻️ ✅ Faster one-click unlock (Only need to record once reinstall apk can be used) ✅ Undisplay unlock the phone by fingerprint or face ✅ Bypassing all phone power permissions (MiUI,HarmonyOS,OPPO,VIVO) ✅ The above functionality is now also supported in the injected code And More. ✅ Significant enhancements in stability and speed ✅ Added automatic screen capture viewing function (you can use when the screen is very slow or not working) ✅ Added blocking addresses for Binance exchanges(When a user transfers money to someone else, the address and the entire balance set by the rat are replaced and the user is unaware) ✅ Disable cell phone background cleaning. ✅ Trust wallet(Same as Binance) ✅ Enhanced anti-uninstall function

dark web image
Reaper Android Rat V6 is on Sale

 In a hacker forum monitored by SOCRadar, a new Reaper andoid RAT V6 sale is detected. https://image.socradar.com/screenshots/2024/04/29/c8079c6d-8b21-4e32-9805-2fe08cf95627.pngApk Support on version 14. (tested on android 14) Smooth Hidden Vnc Control (show text during control) Layout vnc control (stable no lag) Screen Reader | With this feature, you can enter any banking Application and withdraw Money, L'Screen Text Logger + controller (that Helps you to monitor or control every single bank and crypto transaction) bypass black screen problem. See wallet seed phrases. Screen Capturer | show all Tasks live with controllable screen : one click unlock() Pin Unlock Pattern Unlock Apk ?? Lpin and pattern lock (uto detect) Remove captured lock data (if did not capture the lock password correctly then make again ready to capture again in just one click) Super Fast keylogger (Record pin, pattern, passwords, (record all Credentials) Phisher link | the help you to redirect any real or phishing link that can Grab all credentials we provide 500 + latest injections including Crypto and banks. Wallets much more (Crypto Clipper: support 40+ wallets | Btc, eth, BNB, trc20, trc25 more, that help you to Replace your wallet into Receiver wallet address ( (You Get All Crypto Funds that the victim can send anywhere) Read Live Notifications !! Auto Delete Apk using Command (No Traces) Anti-Uninstall SMS interceptions Calls, Contacts, () File manager © Enable/Disable Apps Live Camera (Front/Back) Live microphone (Speak/listen) And many more.......

dark web image
New S3curity RAT Tool Share is Detected

In a hacker forum monitored by SOCRadar, a new alleged S3curity RAT tool share is detected. https://image.socradar.com/screenshots/2024/05/07/762252b1-8369-4aa1-8597-4b233427ef28.pngS3CURITY RAT v0.1.0 ( IRAQI RAT ) Looks like Nj RAT :D

dark web image
New Obelix RAT Tool Sale is Detected

In a hacker forum monitored by SOCRadar, a new alleged Obelix RAT tool sale is detected. https://image.socradar.com/screenshots/2024/05/03/4ebe8b13-34d3-40de-9407-24a8737107e0.pnghttps://image.socradar.com/screenshots/2024/05/03/d5387c28-bed2-4db2-8f27-fc1e5649b6e2.pnghttps://image.socradar.com/screenshots/2024/05/03/bfca5ee7-5ec5-4964-b854-6bcb89549445.pnghttps://image.socradar.com/screenshots/2024/05/03/807750e8-b4ae-4cf8-9bb7-8185d710b107.pngOBELIX REMOTE ACCESS TOOL FOR WINDOWS 10/11. Dedicated To Remote Access, Surveillance, And Security Projects. NATIVE CORE CODED FROM SCRATCH IN FAST C++. Current Features UAC BYPASS - Option To Attempt Automatic Bot Elevation. INTERACTIVE ELEVATION - Option To Request Remote Bot Elevation. PERSISTENCE - Registry, Start Folder, Or Scheduled Task. WINDOWS DEFENDER - Option To Exclude Paths In Windows Defender. PROCESS INJECTION - Option To Inject Bot. INSTANT DOWNLOAD - Pull Payloads From The Web And Execute During Bot Launch INSTANT PASSWORD RECOVERY - Recover Passwords From 9 Apps And Deliver To HTTP/S During Bot Launch PASSWORD RECOVERY - Chrome, Edge, Opera, Brave, Firefox, Vivaldi, FoxMail, ThunderBird IMAP, WIFI REMOTE BROWSERS - Navigate Websites & Click Links (Win10: Chrome, Edge, Brave. Win11: Chrome, Brave) REMOTE WEBCAM - View And Log Remote Webcam MICROPHONE CAPTURE - Capture And Log Remote Microphone Audio FILE EXPLORER - Explore, Upload, Download, View Thumbnails, And More REMOTE PROCESS LIST - List And Terminate Processes Remotely REVERSE PROXY - Browse Websites From The Remote Computer OFFLINE KEYLOGGER - Capture Keystrokes And Deliver To FTP FILE DROPPER - Download A File From URL To Remote Computer REGISTRY EDITOR - Access Remote Registry CLIPBOARD EDITOR - Access Remote Clipboard + Logger DOWNLOAD & EXECUTE - Download & Execute Files From URL To Remote Computer REMOTE LOCK/LOGOFF - Lock, Reboot, Shutdown Remote Workstation REMOTE SCREEN - View Remote Screen REMOTE SHELL - Execute Commands Remotely REMOTE DESKTOP - Access Remote Desktop REMOTE SERVICES - Create, Start, Stop, Delete Remote Services REMOTE PROGRAMS - View And Uninstall MSI Installed Products LOCAL TEXT TO REMOTE SPEECH - Have Your Written Text Spoken Remotely REMOTE BROWSER HISTORY - List History Database For Chrome, Edge, Opera REMOTE WALLPAPER - View And Change Remote Wallpaper REMOTE WAV PLAYER - Play A Wav File Remotely REMOTE MESSAGE - Display A Message On The Remote Screen REMOTE MEMORY DUMP - Download Remote Application Memory In MDMP Format NEXT ADDITION - COOKIE RECOVERY FOR CHROME LIFETIME ACCESS! ONE TIME PAYMENT $70 - BITCOIN OR PAYPAL. GET A PAYMENT ADDRESS BY CLICKING ON THE CONTRACT BUTTON, OR REQUEST ONE FROM ******. AFTER CONFIRMED PAYMENT, PLEASE ALLOW UP TO 24 HOURS FOR DOWNLOAD INFO TO BECOME AVAILABLE. Remember to provide a valid email address. DISCLAIMER / PREREQUISITES SALES ARE FINAL. IT IS INFERRED THAT USERS HAVE PRIOR TECHNICAL EXPERIENCE WITH REMOTE ACCESS SOFTWARE. THIS THREAD IS NOT INTENDED FOR TECHNICAL SUPPORT, INSTEAD USE THE INFO PROVIDED DURING REGISTRATION. PLEASE KEEP ANY CRITICISM POSTED AS CONSTRUCTIVE AS POSSIBLE. ******

dark web image
New RAT & Botnet Setup Service Sale is Detected

In a hacker forum monitored by SOCRadar, a new alleged RAT & Botnet setup service sale is detected. https://image.socradar.com/screenshots/2024/05/03/17d5e8a9-21e4-4287-aeed-cd3458bf9c79.pnghttps://image.socradar.com/screenshots/2024/05/03/0f2de97b-d335-45eb-934d-f2e9f8025644.pngNo Fancy Thread Designs for now. We Make Money using Botnets & RATs and the color is always GREEN ! HOW TO MAKE MONEY USING RAT & BOTNET SETUP ? -- LEARN FROM EXPERT ! Are you Looking for help to setup a successful and profitable malware network ? You are looking at a premium service. The goal is to setup an environment with the method of automatated spreading & earnings in CRYPTO. After Spending thousands of dollar on multiple forums myself, I have gained experience to help you all. What do you receive after purchase ? 1. RAT or Botnet Setup (Depending upon your requirement) - Everyone have a different goal. There is a RAT & Botnet available to meet all your goals. Mining, Loader, Crypto Recovery botnets etc.. - You just have to share your goal and we will take care of everything for you. 2. Lifetime Mentoring & Support Subscription Lifetime means, you never have to pay again for a help again. I myself spent a lot of money on many forums, including here on *** too but support was ridiculous. I know the pain points, You will get a very high quality mentorship and support from me. 3. Domain & Hosting - The purchase includes domain and hosting server. 4. Spreading Method - You just have to setup the spreading method once and bot flows are automated. - You also have option to target any country, niche and behavior of slave types. - The best spreading method you can ever find is here. 5. Private Telegram Group - There is a private telegram group for all buyers - We track earnings of each member - Weekly Hall of Fame announcements - Weekly tasks & activities to sharpen your RAT & Botnet skills - Free stub SCAN [ 2 scans / member/ week ] - DIY [Do it Yourself] Video Tutorials PRICE: $199 Contact: Message me on Telegram @**** Payment Mode: Crypto ONLY - *** Contract Terms - NO Refunds

dark web image
New Rat is on Sale

In a hacker forum monitored by SOCRadar, a new rat sale is detected. https://image.socradar.com/screenshots/2024/04/08/5907fb0a-9b0f-4f1e-9bfd-ad3adfb826d7.pngAndroid RAT\Android remote control ~ Hidden automatic permissions 》 There will be no pop-ups during permissions. ~ Bank card thief + Personal information thief 》 - Easy to cash out using cards, SMS interception ~Trustwallet Thief》 Directly open the Trustwallet phishing wallet and block the original Trustwallet, password capture and 12 word seed phrases. ~ Lock Display 》 with which you can lock the victim's screen so that he cannot open the phone, cannot even see, and you can control everything ~ Automatic phone unlocking (PIN code) 》 You need to detect it once, after which the virus will remember the PIN code and unlock. ~Ready keypad for unlock screen》 Just press the buttons (0-9) and unlock easily ~Lock Screen Repeater 》 Helps you bypass face lock and pattern lock. ~ Screen Reader 》 With this feature, you can log into any banking apps and withdraw money by bypassing the black screen issue. See wallet seed phrases. ~Ransomware 》 You can lock the phone screen and display a QR code with a message about paying out money, otherwise you will not be able to use the phone. - Block Touch - Block Home Button, Block Back Button, Block Recents Button - Works even after screen is locked ~ Screen view 》 Screen control without broadcast icon About the ghost mode function With this function, you can completely turn off the victim's phone and control his phone. The victim's phone display will turn black, the touchscreen will also freeze, and none of the back or home buttons will work. How does the injection work? ~ For example, when you send a command to steal Trustwallet seed phrases, then when the victim opens TrustWallet, instantly a fake page will automatically open and ask for the seed phrases to recover the wallet, otherwise Trustwallet will not gain access. New features: ✓ 11 crypto injections: ~ Trustwallet, Metamask, Exodus wallet, Binance, Kucoin, Bybit, Coinbase exchange, Coinbase wallet, Huobi global, Blockchain, Kraken. There will be more... ✓ Direct display of the fraudulent page on the screen to collect data in real time. ✓ Injection: The scam page will be displayed every time the user wants to open the injected wallet. ✓ PIN and pattern lock for lock screen or specific apps ✓ Instantly sends all logs to a telegram bot ✓ Show custom text on screen in lock mode (covering screen with black layout) ✓ Custom Injection: Add Stealer functionality yourself as needed. ✓ Special Ransomware: Completely lock the victim's phone and display your wallet QR code to force him to pay money and show a warning message. The victim is unable to control the phone during ransomware ✓ Permission Manager: Check and request permissions if user has not provided permissions. ✓ Google 2FA Stealer: Extract all codes directly and save them on your desktop. ✅ Creation of an apk, website, placement of an installation link on your website, implementation of your creo according to your request ❗ ️ ✅ Test Guarantor ➕ ➕

dark web image
Source Code of Oxycorat Android RAT is on Sale

 In a hacker forum monitored by SOCRadar, a new alleged source code sale is detected for Oxycorat Android RAT. https://image.socradar.com/screenshots/2024/04/05/565a8848-3915-4332-bd5d-1e48fb74bcbc.pngFeatures Feature/os Windows Active Updated File manager ✔ ✔ ✔ Sms manager ✔ ✔ ✔ Contact manager ✔ ✔ ✔ Android 14 work ✔ ✔ ✔ Wallet stealer - oxycorat ✔ ✔ ✔ Bypass play store ✔ ✔ ✔ Clipboard manager ✔ ✔ ✔ Unlock screen ✔ ✔ ✔ Whatsapp manager ✔ ✔ ✔ Kill phone ✔ ✔ ✔ Whatsapp manager ✔ ✔ ✔ Builder obfuscator ✔ ✔ ✔ Ransomware ✔ ✔ ✔ Wifi password ✔ ✔ ✔ Sim settings ✔ ✔ ✔ Imei changer ✔ ✔ ✔ 100% fud apk file ✔ ✔ ✔ Keylogger ✔ ✔ ✔ Application manager ✔ ✔ ✔ Spread ✔ ✔ ✔ Camera (front & back) ✔ ✔ ✔ Screen reader ✔ ✔ ✔ Last Update No permision - All android devices. It is installed on the device without asking for any permission

dark web image
New Offence RAT Tool Share is Detected

In a hacker forum monitored by SOCRadar, a new alleged Offence RAT tool sharing post is detected. https://image.socradar.com/screenshots/2024/04/04/f1f957c3-d780-403a-aaa7-ceb9aabd60ac.pnghttps://image.socradar.com/screenshots/2024/04/04/c8d12f21-fb36-4bea-bae9-82ae58166ff8.pngOffence RAT v2.5

dark web image
New Recruitment Post is Detected

In a hacker forum monitored by SOCRadar, a recruitment post is detected to start RAT and botnet service. https://image.socradar.com/screenshots/2024/04/03/63df59cd-3188-4de4-b963-4be6968b7094.pngHello, I am looking for a partner to start RAT & Botnet service. Pease start conversation message if you think to be the right person. Note: I will only work with partner that have good business credibility and who is above L33T here. I hope such partnership is allowed here, if not then please close my thread. Thank you.

dark web image
RAT Purchasing Announcement is Detected for Apple

In a hacker forum monitored by SOCRadar, an unauthorized RAT Purchasing Announcement is detected allegedly belongs to Apple. https://image.socradar.com/screenshots/2024/04/01/eff46f7b-9a6e-4e78-a00f-4b48207e19ff.pngI'm looking for iPhone RATS that will work in 2024 for IOS 17 or below!

dark web image
Octobot Android RAT is Shared

  In a hacker forum monitored by SOCRadar, a new alleged android RAT share is detected which is called Octobot RAT. https://image.socradar.com/screenshots/2024/03/27/443a5507-1caa-40ef-bee0-3e9fd7405289.pngHELLO I AM ** TODAY I WANTED TO HONOR OUR DAY BY SHARING OCTOBOT RAT. YOU CAN REACH THE DOWNLOAD LINK AND FILE PASSWORD BY LIKEING AND COMMENTING. NOTE: WE ARE NOT RESPONSIBLE FOR ANY PROBLEM THAT MAY OCCUR. FOR YOUR QUESTIONS & ANSWERS MY TELEGRAM ADDRESS IS TELEGRAM. https://** Download: https://**

dark web image
Source Code of SilverRat is Leaked

In a hacker forum monitored by SOCRadar, a new alleged source code leak is detected for SilverRat. https://image.socradar.com/screenshots/2024/03/27/82749a82-d2f3-4ad9-a711-06ba24ecb30a.pnghttps://image.socradar.com/screenshots/2024/03/27/e7b2876d-9124-4756-86b8-ee5be2b5254f.pnghttps://image.socradar.com/screenshots/2024/03/27/8b71637e-db53-4873-8f51-6ea1992a5695.png🔰Features ⭐️ Hidden RDP ⭐️ Hidden VNC ⭐️ Hidden Apps ⭐️ Hidden Browaser ⭐️ Hidden Process ⭐️ Hidden Installation ⭐️ Cryptocurrency monitor ✔️ Password stealer 🔐Get you all data and passwords as follows 🔑 Browsers + cookies 🔑 Apps 🔑 Gaming 🔑 Bank cards 🔑 Market 🔑 Cryptocurrency wallets 🔑 WIFI 🔑 System ✔️ Send all data to Discord 🔔 If you enable this feature Once the client clicks on the payload All client data will be listed Such as 🔐Get you all data and passwords as follows And you compile it into a zip file with a password And it sends you a download link to your Discord account And It tells you whether this client is new or you already have it ✔️ Additional attachments ⭐️ Stub Private / FUD ❕It will take two days or less for Stub Private to be programmed and sent to you by email automatically ⭐️ BypassAV / FUD ⭐️ Exploit Macro Builder | Doc & Docx & Xlsm & vbs & JS ⭐️ Bypass WD Builder | Add exceptions ⭐️ Binder ⏬ Download Source Code Hidden Content https://******************

dark web image
New EagleSpy v3.0 Android RAT Tool Share is Detected

In a hacker forum monitored by SOCRadar, a new alleged EagleSpy v3.0 Android RAT tool share is detected. https://image.socradar.com/screenshots/2024/03/21/9f5e2be4-9330-4dd1-964a-8f954aba50be.pnghttps://image.socradar.com/screenshots/2024/03/21/e8435056-9d64-44eb-943e-8dddbef0644f.png✓ Crypto injections : Trustwallet, Metamask, Exodus wallet, Binance, Kucoin, Bybit, Coinbase exchange, Coinbase wallet, Huobi global, Blockchain, Kraken. ✓ Show Scam page : Direct display scam page on screen to grabbs data in real time ✓ Injection : This will show scam page everytime when user want to open injected wallet ✓ PIN & Pattern lock grabbs for lock screen or specific Apps ✓ Sends all logs to telegram bot instantly ✓ Display custom text on screen while block mode (Cover screen by black layout) ✓ Custom injection : Add stealer functionality yourself as per need ✓ Custom Ransomeware : Lock the victim phone completely and display your wallet QR code to force him to pay money and show warned message. Victim can’t operate phone during ransomeware ✓ Permission Manager : Check & Request permissions if user didn’t granted permission ✓ Google 2FA stealer : Directly extract all codes and save on your desktop

dark web image
New Rat Tool is Shared

In a hacker forum monitored by SOCRadar, a new rat tool share is detected. https://image.socradar.com/screenshots/2024/03/06/e5561c0e-5822-422e-a60d-ebc981483864.png2024 Rat Tool As you can see in the picture, it can produce viruses with many different methods... After entering the

dark web image
CraxsRat V7.1 is Shared

In a hacker forum monitored by SOCRadar, an alleged CraxsRat V7.1 share is detected. https://image.socradar.com/screenshots/2024/03/13/39c83513-a6f8-4630-bc52-e579cbf7081b.pngHey friends, Just wanted to share this version. It's 100% clean without backdoors https://www.mediafire.com/file/***/CraxsRatv7-***.7z/*** Have fun

dark web image
New Windows RAT is on Sale

In a hacker forum monitored by SOCRadar, a new Windows rat sale is detected. https://image.socradar.com/screenshots/2024/01/17/22ff86e6-9702-4bff-bc5a-101a5537df94.pngI sell RAT for Windows. Functionality: - File manager (upload\download\run). - Hidden work in cmd\powershell. - Shutdown\reboot. - Screenshot. - Reliable fastening in the system. - Encryption of the communication channel with the admin panel. - Support for Win7 - 11 + server OS. Build in C++\admin on Sharpe. Cost $2000\month. I recruit no more than 5 clients. Guarantor is welcome.

dark web image
Source Code of Bifang Rat is on Sale

 In a hacker forum monitored by SOCRadar, a new alleged source code sale is detected for Bifang Rat. https://image.socradar.com/screenshots/2023/11/30/58b40253-d07c-4ca2-99f4-f8462d980137.pngHi I am selling my Private rat BifangRat multi language english + china Coded in c/c++ for client and for server QT5c++ and the controller are coded in php price: 500$

dark web image
A New RAT Tool LOST RAT is on Sale

In a hacker forum monitored by SOCRadar, a new alleged RAT tool LOST RAT sale is detected. https://image.socradar.com/screenshots/2023/12/07/fb4ce50b-d78e-4f89-ba5d-f531800323b8.pngLOST RAT Remote Access Tool Functions: HVNC (Hidden Virtual Network Computing) Reverse Proxy (Socks5) Stealer (Password,Cookies,CC's,History,Downloads..) Offline KeyLogger KeyLogger Remote Desktop Remote Chat Live Microphone WebCam UAC Bypass Remote Powershell Remote CMD Process Manager File Manager Registry Manager Misc System Control (...) Client Control Support for Listen on multiple ports Weight build from 30kb Детект / Detect 2023-11-28 Софт, писал для себя,могу добавить функции которые вам нужны.. / Software, I wrote for myself, I can add the functions that you need.. Price: 1 month - 199$ 6 months - 499$ LifeTime - 999$ Contacts: TG - https://t.me/*** qTox - *** PM I agree to the guarantor!

dark web image
New Crypt Malware Service is Detected

In a hacker forum monitored by SOCRadar, a new new crypt malware service is detected. https://image.socradar.com/screenshots/2023/11/27/75340ec3-f733-4e3c-af1b-ec9d8f47fe1f.pngI am armed with an impeccable stub that eats any kind of EXE files Penetrates 99% of all ABs Even the most complex malware can be encrypted perfectly I give a 24 hour guarantee on every file I make. The crypto is not a carbon copy - each file is 100% unique Defender and Google do not swear I will find an approach to each client and solve the problem 1 crypto - $60

dark web image
Catlogs Malware is on Sale

In a hacker forum monitored by SOCRadar, a new alleged Catlogs malware sale is detected. https://image.socradar.com/screenshots/2023/11/18/2bae31e6-6f2d-4ced-88b8-022ad2f4d841.pngi'm selling Catlogs malware. Features: Browser Logins and cookie stealer Ransomeware(Encrypt/Decrypt with Custom key) RAT(Shell/System commands) Anti- Anlysis( Sandboxie, Virtual Machines, HoneyPots) and many more

dark web image
New Android RAT is on Sale

In a hacker forum monitored by SOCRadar, a new andoid rat sale is detected. https://image.socradar.com/screenshots/2023/11/05/83ee3373-0240-49f6-b443-ef2d392b1e15.pngProperties vnc screan reader call SMS Reader-Sender Keylog See, open, and delete apps camera Microphone Send notifications,see incoming notifications Vexena is a completely private service, we don't want to serve as many people as we do on the market. It is mandatory to sell securely using the galantor in the forum. Demo panel is not provided, we can show you the detailed details of the panel by proving the time for 3 days only for trial.

dark web image
Xeno RAT is Shared

In a hacker forum monitored by SOCRadar, Xeno RAT share is detected. https://image.socradar.com/screenshots/2023/11/01/ff07dadc-7690-411a-9b40-262d3cbdc2e3.pngWelcome to the official thread for Xeno Rat's release, a powerful and versatile remote access tool developed in C# for Windows 10 and 11. This open-source project is designed to provide you with a stable, feature-rich, and easy-to-use solution for remote computer control. Key Features Xeno Rat offers a wide range of features that set it apart from other RATs: - HVNC (Hidden Virtual Network Computing): Enjoy this premium feature for free, enhancing your remote access capabilities. - Live Microphone: Real-time audio surveillance, perfect for various use cases. - Socks5 Reverse Proxy: Proxy your internet traffic through the client with ease. - Regular Updates: The project is actively maintained, and new features are continuously added. - Built from Scratch: Xeno Rat is developed from the ground up, ensuring a unique approach to remote access. Some other features - Listen on multiple ports - Chat - Bluescreen - Message Box - Fun menu (monitor on/off, CD tray open/close, and more) - Webcam - Key Logger - Screen Control - Process Manager - File Manager - Shell - And plenty more... Legal Disclaimer Xeno Rat is intended for educational purposes only. The developer is not responsible for any misuse or damage caused by this tool. Always stay within legal and ethical boundaries. For more details and to access the project, visit Xeno Rat on GitHub. Explore the code and contribute to its development! For anyone who wants to donate, I also included a txt file with the exact same link.

dark web image
Freedom RAT is on Sale

In a hacker forum monitored by SOCRadar, a new alleged RAT sale is detected. https://image.socradar.com/screenshots/2023/10/28/b66cb6f2-3349-4e24-b2af-fa4aa2438c55.pngRemote Administrative Tool ( R.A.T ) written fully in C language ( no dependencies ) - 40 KB. Functions { Fun : - Simple MessageBox popup - Beep Sound - Empty recycle bin Power Management : - Shutdown - Restart - Sleep File Manager : - Download - Execute - Delete - Upload Task Manager : - Kill process Stealer : - Browser logins ( URL / Logins URL / Username / Password ) Screen : - Single Screnshot function ( capture all monitors on target machine - Vertical/Horizontal ) Reverse Functions : - Reverse command prompt - Reverse powershell Clipboard : - Get clipboard content - Set clipboard content Keylogger : - Live keylogger } Functions (included in Builder) { Clipper : - Bitcoin Format -> P2PKH, P2SH, BECH32/Segwit - Ethereum - Litecoin Error Message : - Fully customizable first boot error MessageBox ( Title, Content, Icon, Buttons ) Installation Folder : - Choose between 4 different path Additional : - Disable Task Manager - Persistence - Mutex - Strong anti VM + anti debug } PRICE : 1 BTC ( Garant is welcome ) COPY AVAILABLE : 1/1 Runtime Result : hxxps[://]checkzilla[.]io/scan/fa06e69c-be42-4096-829b-0b88c6d079b6 Scantime Result : hxxps[://]avcheck[.]net/id/MdhKDasbakAb What will you get after purchase ? - Full source code of client side AND also server side + builder. - Full support for installation to your server. - I am ready to explain every line of code 1 by 1 and answer all your questions ( concerning the product ). For any question concerning this product send me a PM, I will be happy to answer you. Server side screenshot : https://image.socradar.com/screenshots/2023/10/28/c45d2cb9-f616-4020-904f-8ec3a4af9599.pnghttps://image.socradar.com/screenshots/2023/10/28/74623855-ddce-4e55-ae5f-8680d7a7d85f.png

dark web image
Source Code of Linux Rootkit is on Sale

In a hacker forum monitored by SOCRadar, a new alleged source code sale is detected for Linux Rootkit. https://image.socradar.com/screenshots/2023/10/28/8d3febc9-5350-4a00-9578-842f8661ea4e.pngSyM Linux Rootkit SyM is a universal user-mode Linux rootkit that will sustainability hold root persistence across all Linux kernel versions, and will successfully bypass any EDR or rootkit detection software. SyM will also come with a plethora of features capable of stealing important files such as SQL database backups, .git, and other configuration files; And much more. Along with being the first of it's kind SyM implements some API system call hooking that has never been seen before which makes it such a unique, and undetectable rootkit experience. C&C / C2 / backdoor methods: ICMP backdoor Use a unique magic identifier to open a reverse shell accept ( ) backdoor Use a unique magic identify to open a listening TCP server PAM backdoor Direct interactive SSH backdoor with custom hidden port, username, and password Internal System Logging: SSH Log Log all incoming and outgoing SSH authorizations in plaintext by hooking pam_vprompt, read, and write API calls Execution Log Log all normal ( including root ) user command execution flow Hiding Self / Rootkit Hide all files, processes, open ports, and all connections based on unique magic identifier Hide process map files, to prevent direct mapping of process and being able to identify rootkit Hide any file, or directory of choice All rootkit master created directories and files will be kept track of, so no need to manually add or edit anything to keep it hidden! Note: It is possible to forge or fake as any other installed software, service, or similar EDR Bypass / Evasion Hooking API calls to hide it's self from / proc * / * maps as well as many other system locations Bypassing SELinux and GRSec Bypasses and hides from SentinelOne and other similar software File Stealer By scanning and keeping tracking of a user made list of interesting files and directories the rootkit is capable of stealing anything on the fly and uploading it directly to an external server Stuff like SQL databases are stolen automatically by default! Pricing Source Code: $7500 Contact Telegram

dark web image
Zer0Day2 Rat and Binder are Shared

In a hacker forum monitored by SOCRadar, Zer0Day2 Rat and Binder share is detected. https://image.socradar.com/screenshots/2023/10/26/7dc2d98f-8fa3-414f-9bdd-0e000f170308.pngZer0Day2 Rat cracked https://** pass : ** https://image.socradar.com/screenshots/2023/10/26/261c0769-544e-4f68-a38f-92ea4636105a.pngZer0Day2 binder cracked https://** pass: **

dark web image
Anubis Stealer is on Sale

In a hacker forum monitored by SOCRadar, a new stealer tool Anubis Stealer sale is detected. https://image.socradar.com/screenshots/2023/09/29/cf4d864b-4fc9-4fd9-ac67-fc693dbdb0bb.pngAnubis Stealer 💥Descriptive 💥 Program for remotely controlling Windows computers via a Telegram bot. Written in C++ language This remote access tool stands out for its exceptional features and high reliability. It supports Windows 10 and 11, both 32-bit and 64-bit operating systems. The software is developed in C/C++, featuring an independent Stub that doesn't rely on the .NET Framework. It boasts a rich set of functionalities, including cookie and password recovery, file management, remote execution, real-time and offline keylogging, remote shell access, and process management. Additionally, it supports obtaining TOKENs for Discord, Telegram, and Steam. The clipboard feature automatically replaces cryptocurrency addresses, enhancing privacy. Importantly, it includes an anti-sandbox feature that detects and counters various virtual environments and analysis tools. The Stub, ranging in size from 500KB to 600KB, ensures efficiency. In summary, this tool is user-friendly, offers a wide range of functionalities, and is suitable for various purposes, whether you need cookie recovery, password management, file transfer, or more. 💥Features💥 Cookies Recovery: This function allows you to recover cookies from popular Chrome and Firefox browsers in JSON format. Password Recovery: This feature enables the recovery of passwords from various browsers (Chrome, Firefox, Edge.) 50+ browsers。 File Manager: With the File Manager, you can upload and download files at high speed, as well as execute and delete files on the target computer. Download & Execute: This function allows you to execute files on remote computers. Remote Shell: This function lets you send commands to the remote computer's command prompt (CMD). Process Manager: With the Process Manager, you can view and terminate processes on the remote computer. TOKEN: Discord, Telegram, and Steam. Clipboard: Automatically replaces cryptocurrency addresses in the clipboard with a predefined address, likely to perform address substitution. AntiSandbox: This feature can detect the presence of virtualization or sandboxing environments like Virtualbox, VirtualMachine, Cuckoo, Anubis, ThreatExpert, Sandboxie, QEMU, and analysis tools. Spoiler: Chromium browsers Edge Edge Beta Google Chrome Google Chrome Beta Google(x86) Opera Software ChromePlus Iridium 7Star CentBrowser Chedot Vivaldi Kometa Elements Browser Epic Privacy Browser uCozMedia Sleipnir5 ChromiumViewer Citrio Coowon liebao QIP Surf Orbitum Comodo Dragon Comodo Yandex 360Browser Maxthon3 BraveSoftware K-Melon Torch Amigo Sputnik SalamWeb BlackHawk QQBrowser Slimjet GhostBrowser Xvast 360Chrome Kinza Xpom Nichrome Blisk UCBrowser Spoiler: Gecko browsers Firefox Waterfox K-Meleon Thunderbird IceDragon Cyberfox BlackHaw Pale Moon Spoiler: Auto Stealer Example https://image.socradar.com/screenshots/2023/09/29/f057555f-e4d7-480f-b2d8-5149c0d5e3fe.pnghttps://image.socradar.com/screenshots/2023/09/29/f4e699e2-e798-4c1b-9b6e-b5eab757f318.pnghttps://image.socradar.com/screenshots/2023/09/29/add014e6-6971-4a03-8634-149b91c038e4.pngSpoiler: Control Command https://image.socradar.com/screenshots/2023/09/29/32c799e1-074b-4cb2-92e3-9bc86f3ad71f.pnghttps://image.socradar.com/screenshots/2023/09/29/fb419557-0909-4d74-9601-a59f4ea06a37.png💥Builder💥 Self-delete after the first run. Add a self-startup entry. Implement a blue screen protection (immediately trigger a blue screen if the program is terminated; this feature requires administrator privileges). Automatically collect cookies, passwords, history, credit cards, bookmarks, as well as data from Telegram, Discord, Steam, and screenshots. Cease communication if a blacklisted process is detected. Activate keylogging. Manage the clipboard and replace preset wallet addresses. Implement anti-sandbox, anti-analysis, and anti-virtual machine measures. Request administrator privileges to run the program. Spoiler: Builder 6.png 💥Subscription Prices:💥 🔥1 month - $120 $39 🔥3 months - $360 $117 🔥6 months - $720 $234 🚀 Limited Time Offer: Get an Extra Month for Free! 🎁 🔥 We've got great news for you! For the first 30 customers, we're offering an exclusive deal – simply purchase our product and receive an additional month absolutely FREE! 🔥 Don't miss out on this incredible opportunity! Act fast and be one of the privileged few to benefit from this special promotion. 🔥 Grab your extended subscription today and elevate your experience with us! 🔥 Hurry, this offer won't last forever. Make the most of it! Thank you for choosing us. We appreciate your trust in our service. 💥 Accepted cryptocurrencies: 💥 BTC, ETH,TRC20 💥Contact: Telegram Channel:💥 Click Here 💥Terms of service: 💥 Click Here

dark web image
CraxsRAT V6.7 is on Sale

 In a hacker forum monitored by SOCRadar, an alleged CraxsRAT V6.7 sale is detected. https://image.socradar.com/screenshots/2023/09/20/6fc0139b-b5cd-4df1-bb68-dee092d2cc25.pnghttps://image.socradar.com/screenshots/2023/09/20/5a8e086b-975f-4bd5-b0b7-276ce15d4605.pnghttps://image.socradar.com/screenshots/2023/09/20/731a40ae-9476-438f-9b1e-9a6b4bc8d59f.pnghttps://image.socradar.com/screenshots/2023/09/20/be396d04-6df8-4699-a111-8be77dab5ee4.pnghttps://image.socradar.com/screenshots/2023/09/20/c1d06e69-3725-4930-82a7-0a4748bedf72.pngDETAILED INFORMATION AND TG FOR DEMO: @********** - !!️ 💯 ANDROID 13 WORKS AS A PROBLEMS IN ALL DEVICES. ✅ Whatsapp Click Reach. --------------------------------------------------------------- CraxsRat V6.7. New Update Attributes. File Manager 🟢Download/Install 🟢Secure Deletion Options 🟢Thumbnail/Gallery view . 🟢 Advanced search 🟢Copy/Paste 🟢Decrypt/Decode 🟢Hidden / Unhidden File 🟢 Set Wallpaper 💠Location 🟢Live Location 💠Live Screen Control 🟢Show Screen Live 🟢Control Screen (VNC) 🟢Use Keyboard 🟢 Lock / unlock screen 🟢Take silent screenshot 💠 Call Manager 🟢 Show Incoming/Outbound Call List 🟢Delete calls 💠 Send SMS 🟢 "Improve "Send SMS" feature 🟢 Send to multiple number 🟢Send from file to list 🟢Send to all people 💠 Application Manager 🟢Show Application List 🟢 Open Application 🟢 Remove Application 🟢 Disable / enable application 💠Keylogger 🟢Online/Live keylogger 🟢Offline keylogger 🟢Save to client folder 🟢Save everything 🟢even the pin of the screen lock 💠SMS Manager 🟢Show SMS List 🟢Delete SMS 💠Extra Tools 🟢 Search Number 🟢Download Linkten Apk 🟢Show Message on Screen 🟢 Clipboard 🟢 Open Link 🟢 Run Commands 🟢 Social Media Hunter 🟢 Stealer Gmail account 🟢 Ste aler Facebook account 🟢 Stealer 2FA Google 🟢Authenticator Code 💠 Permission Manager 🟢Not allowed/ not allowed Permissions checked 🟢 Ask for Permissions from the panel 🟢Request to enable accessibility 🟢 Draw in practice 💠 Account Manager 🟢 Application Email/Number Show Your Account 💠 Auto Clicker 🟢 On the screen Watch User Touch 🟢Save User Touchs 🟢 Repeat User Touchs 💠 Web Browser 🟢Web browser Monitor 🟢Web browser Html Viewer 🟢 Open link and track / save browser 💠 Injection in real app 🟢Silent control 🟢 Work like real practice 🟢 Ask for accessibility 🟢Anti killing 🟢 Anti removal 🟢 Wake up support screen 🟢 Support Permit manager 🟢Support screenshot 🟢Support lock screen 🟢 Recrypt APK 💠 Admin Rights 🟢Executive Rights Request 🟢 Lock screen 🟢 Delete Data ( delete everything ) 💠 Camera 🟢 Take Screen Image Camera 🟢 Open Front Camera 🟢Open Back Camera 🟢Take Photo 💠 Keyboard Manager (Beta) 🟢Phone keyboard 🟢Replace with Spyroid Rat custom keyboard 🟢 Support 3 languages “English – Arabic – Chinese” 🟢Record everything the victim enters 💠 Self Distraction 🟢 Automatic ( with super mode to remove apc and data 💠Microphone Capture 🟢 Listen Talk ✅ Save 💠 Notification Listener ✅Get All Notifications ✅Save 💠 Call Listener ✅Get all call notifications ✅ Save/remove call 💠 Screen Reader Skeleton view or Scan View ✅ Skip the black screen of banks and crypto application ✅Add logo window to easily copy anything from the screen

dark web image
Remote Administration Tool Sale is Detected

In a hacker forum monitored by SOCRadar, a new alleged remote administration tool sale is detected. https://image.socradar.com/screenshots/2023/09/14/33faee49-b62f-40ac-83b9-531ac2644ef5.pngHello everyone, you can find more information about software below. Remote Administration Tool Web admin panel with GUI + realtime remote clients communications One secure encrypted connection to the management server with multiple layers of https+rsa+aes Supports proxy connections over http, socks5 (also with credentials). You can create your own chain of proxy servers to connect to the management server (if your software is located deep in the network) Can be run as a service or as a current user. Universal plug-in system: command line socks5 tunnel file manager - view remote file system directories and download files mimikatz - command line as a plugin (possibly may be unstable using multiply commands with specify environment) vnc, hvnc - custom desktop viewer (under development) keylogger - simple keylogger via RegisterRawInputDevices() (under development) meterpreter - allows you to use the meterpreter module from metasploit framework (under development) screen[snapshots/recordings] - take screenshots and record user screen (under development) collection - complete system information with lost passwords (under development) webinjects - allow the operator to replace web traffic (under development) traffic tunneling - traffic tunneling without system tools (under development) Well tested under: Windows 7 with Service Pack 1 x64 - passed Windows Vista x64 - passed Windows 8.1 x64 - passed Windows 10 x64 - passed Windows 11 x64 - passed Windows Server 2008 x64 - passed Windows Server 2022 x64 - passed Windows 7 x86 - passed Windows 8.1 x86 - passed Windows 10 x86 - passed Minimum server requirements: VPS server with KVM virtualization 2 GB of RAM 1 Central processing unit Network any The TOR service for the licensing server. User Agreements and Terms: All parts of the software you use are at your own risk Messages to the support service about any warnings of the AV software after scanning the file will be ignored AV alerts can be considered at runtime if they can be reproduced in a laboratory environment. If any critical errors are found while using the software, we will try to fix them as soon as possible, depending on the type of error, and your license will be extended for the number of days from the date we receive the report (when we reproduce it in the laboratory) to the date of correction. We use escrow for every money transfer. Only you or your team can use this software package if you transfer the software to a third party, we will block your license. Refunds are not allowed Accepted payment: BTC, Monero. We not provide any bypass or privilege escalation. We not provide encryption for any binaries. After receiving the payment within the next 2 hours, you will have an archive with: web control panel - with plugins and license file of the selected plan x64/x86 executables - for execution on remote systems is about ~1Mb/~700Kb size Domain configuration file - configured for your domain (this is separate file must be copied to the specify folder on the system) Documentation - how install and use software and plugins. Plans for 30 days: Minimum Command Line File Manager Socks 5 Mimikatz 5 Domain Configurations Price: $2,990​ Since this is a raw project at the moment, and possibly can be unstable in some situations, we are adding an additional 30 days to your plan as a bonus. Thank you.

Subscribe