Corresponding Mirai #malware payload delivery host:
🌐 urlhaus.abuse.ch/host/45.141....

Looks like this #Mirai threat actor is a BIG fan of our URLhaus platform 😜

👉 hXXp://45.141.215.196/FuckYou0urlhaus0abuse0ch/

We thought we'd send a little love back to the threat actor... their server’s been taken down, and their #botnet C2 domain is now sinkholed. 😘 ⤵️

👾 MalwareBazaar stats 👉 bazaar.abuse.ch/statistics/
🧠 SpamhausTech MalwareDigest 👉 www.spamhaus.com/malware-dige...

🫶 #SharingIsCaring #Community

Top Contributor MalwareBazaar - JAMESWT_WT

📣 Big thanks to MalwareBazaar Top Contributor "JAMESWT_WT" 🙇

First seen: 30 March 2020 and since then, they’ve shared 45,994 malware samples.

In the last 30 days alone, they have dropped 1,472 new samples, that’s +30% ⬆️ from the previous month, with 631 samples shared on September 30th. 🔥🔥

Over the last 30 days, the community shared 26,575 #IOCs on ThreatFox 🦊. That's a 83% jump on the previous month. 🚀 And topping the charts: XtremeRAT, with 6,640 IOCs 💀

Find more ThreatFox statistics here:
👉 threatfox.abuse.ch/statistics

#SharingIsCaring #XtremeRAT #Malware #ThreatIntel

🛠️ The User-Agent changed from "Kamasers C2 Client" to "System Updater/5.0"

Malware sample:
📃https://bazaar.abuse.ch/sample/9ed0190eaa288e46c49d8a1d3dd52ea42bd6e7aaea1dbdf9e65912579630b075/

...a build 'TimeDateStamp: Tue Sep 23 11:33:26 2025' indicates that the malware is still under active development:

🛠️ Supported commands now have the character ! In front of them (!syn)
🛠️ More commands related to DDoS activities were added (!NTP-AMP, !NTP-AMP, !DNS-QUERY-FLOOD) ⤵️

As for the DDR services, they are embedded in the binary, and again encrypted with AES using the aforementioned key, and encoded with base64. So far the following services have been seen 🔎

➡️ Github gists
➡️ Telegram Channels
➡️ Dropbox

The latest sample, containing debug information with...⤵️

...the C2 address from various DDR locations, by searching for the value of specific strings inside the DDR responses. The C2 domain is encrypted with AES CBC and encoded with base64. As of today, the malware is using `MySuperSecretKeyForAES256IsGood!` as an AES key to decrypt the responses. ⤵️

A few days later, we identified a second variant, written in C, which remains in use to this day. As a DDoS botnet, it supports various DDoS commands. Initially, we 🔎 observed the following list:

➡️ httpflood
➡️ httpbypass
➡️ httppost
➡️ slowloris
➡️ tcp (syn, ack)
➡️ udp

The 🤖 botnet receives...⤵️

🔥 "Kamasers" is a DDoS botnet, first seen in August, and dropped by Amadey. The malware name was adapted from the User-Agent used during network communication with the C2 server. The first time we encountered it, the sample was written in Golang language. ⤵️

Additional contextual information on Office OLE files on MalwareBazaar

Doc report (OLE):
🔎 bazaar.abuse.ch/sample/4a4b3...

➡️ Improved OLE handling: Office documents now come with additional context, including extraction & hashing of embedded image files, extraction of attached templates, and more 🧰

Here are some example reports below ⤵️

OpenTIP integration:
📄 bazaar.abuse.ch/sample/dda32...

Kaspersky OpenTIP integration on MalwareBazaar

We’ve just rolled out two new features on MalwareBazaar 🆕 👀

➡️ OpenTIP integration: Results from @kasperskylab.bsky.social OpenTIP are now included for all samples on MalwareBazaar, available via both, UI and API 🖥️

https://threatfox.abuse.ch/browse/malware/win.lumma/

Since end of August we observe infamous #LummaStealer communicating with DGA-like domain names. We have seen such domains across 3 distinct IP address, all sharing the same SSL certificate ⤵️

129.226.128.168:443 (Tencent 🇨🇳)
31.220.109.219:443 (Hostinger 🇺🇸)
165.227.143.219:443 (DigitalOcean🇺🇸)

Morpheus loader admin panel

💻 If there is no match from the above, but the command length is not zero, it will execute the value using "cmd".

A Morpheus sample is available on MalwareBazaar:
📄 bazaar.abuse.ch/sample/6e1b1...

IOCs are available on ThreatFox:
🦊https://threatfox.abuse.ch/browse/malware/win.morpheus/

🌐 Anything starting with http/https: Downloads the files from the aforementioned URL and writes it to Windows Temp directory, using the current time as a name (nanoseconds since epoch). The file is then executed using the 'open' command of Windows.

- Network ( addresses, MAC, name)
- Processes (name, PID)
- Installed Apps
💥 selfdestruct: Deletes the Registry Run key and the executable from the disk running the command "/C ping 127.0.0.1 -n 3 > nul & del /f /q {sample_path}"

ℹ️ sysinfo: Collects the following information from the compromised host:
- Installed AV
- CPU (number of cores, architecture)
- Available Hard Disk (name, free space, total space)
- Domain (is domain joined, domain name)
- Available Memory (free, total)

The commands received from the botnet C2 come as a JSON object with two properties: "id" and "command". The following command-values are supported:

4️⃣ A self update mechanism, where it will download a new version of itself, write it to disk with a ".tmp" suffix and immediately execute it. The current running instance will then exit.
5️⃣ Execution of various actions based on the commands received from the #botnet C2

3️⃣ Collects system information of the compromised host and sends them to a botnet C2, both, in the form of "HeartBeat" but also as Task command

1️⃣ Persistence through the Windows registry. It copies itself to the AppData Roaming directory under "SysSvc64.exe" and creates a new registry Run key that points to its location.
2️⃣ A host-based ID generated by collecting the current time, hostname and the MAC address of the compromised host.

The #malware accepts two command line parameters:
➡️ log: Path where debug logs are stored
➡️ update-url: URL used by the self-update process

#Morpheus has the following capabilities 💡:

We encountered a a new loader advertised as "Morpheus" in underground forums 🕵️, recently dropped by #Amadey ⬇️🪲. Morpheus' C2 protocol is based on HTTP and working with tasks, where each task consists of an ID and a command 📣

Botnet C2: sophos-upd-srv .info 🇳🇱

Amadey botnet C2 network traffic

Fresh Amadey botnet C2 domains 🪲🔍👀⤵️

microsoft-telemetry .cc
telemety-sys .lol
telemety-xbox .lol
witasametry .live
telamtykina .live
telemetrywatson .live

More Amadey IOCs are available on ThreatFox 🦊:
📡https://threatfox.abuse.ch/browse/malware/win.amadey/

You know you did something right if you get a false positive report for on URLhaus with the words "fuck u" 😎 vtuber DDoS bot spreading through ThinkPHP RCE (CVE-2019-9082) ⤵️

urlhaus.abuse.ch/host/172.233...

Payload:
bazaar.abuse.ch/sample/dafb6...

IOCs:
threatfox.abuse.ch/browse/tag/D...

SalatStealer (aka WEB_RAT) is on the rise 📈, heavily dropped by Amadey

Malware sample:
📄https://bazaar.abuse.ch/sample/8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05/

Admin Panel:
📡https://salat .cn/login/ (Cloudflare)

Gihub:
🗜️https://github.com/webr-at/importantfiles/releases

Weaponized PDF leading to rogue ScreenConnect download

Compromised travel agency in Sri Lanka 🇱🇰 spreading fake Royal Air Maroc ✈️🇲🇦emails with a weaponized PDF 📄 that leads to a rogue ConnectWise ScreenConnect download 🔥

➡️ hunting.abuse.ch/hunt/6890d35...

Payload delivery URL + botnet C2 are hosted at 51.89.204 .89 (StarkRDP 🇩🇪)

Malware samples:
📄 bazaar.abuse.ch/sample/42671...
📄 bazaar.abuse.ch/sample/f1865...
📄 bazaar.abuse.ch/sample/0cfb4...