Vallabh Chole @CholeVallabh

Trying to Learn Malware and exploit analysis 😵 Tweets are personal.. https://t.co/9fN0Wsry6B Aurangabad,Maharashtra Joined August 2010

Tweets

501
Followers

336
Following

854
Likes

3K

BleepingComputer @BleepinComputer

3 years ago

Rest in peace, Vitali. Our thoughts and prayers are with your family and friends. Thanks for all you did for the cybersecurity community.

7 81 363 0 3

U.S. Coast Guard Southeast @USCGSoutheast

3 years ago

#SearchAndRescue @USCG crews are searching for 36-year-old Vitali Kremez, last seen wearing a black wetsuit and scuba tank while diving near #HollywoodBeach, Florida. Anyone with information is asked to call Sector Miami at (305) 535-4472.

19 133 258 0 17

Vallabh Chole @CholeVallabh

3 years ago

1 million downloads on chrome store

McAfee Labs @McAfee_Labs

3 years ago

1 million downloads on chrome store

4 6 14 0 0

Download Image

1 0 0 0 0

Vallabh Chole @CholeVallabh

3 years ago

Great use of affiliate program to earn money 💰

McAfee Labs @McAfee_Labs

3 years ago

Great use of affiliate program to earn money 💰

5 5 10 0 0

0 0 0 0 0

Virus Bulletin @virusbtn

4 years ago

McAfee researchers have discovered a new technique that downloads and executes malicious DLLs (Zloader) without any malicious code present in the initial spammed attachment macro. mcafee.com/blogs/other-bl…

1 80 188 0 27

Download Image

Vallabh Chole @CholeVallabh

4 years ago

mcafee.com/blogs/other-bl… #mcafee #hancitor #malware

0 0 1 0 0

sysopfb @sysopfb

4 years ago

Here's a recent sample using this going to a DNS based stager shellcode for CobaltStrike 6ccd01f6dd85a1c412bbf9b9871045e22f157490 , I wrote a script to pull down the shellcode blob which is a self decoding blob on top of NETBIOS encoded data gist.github.com/sysopfb/f4f89a…

sysopfb @sysopfb

4 years ago

0 13 37 0 1

0 3 9 0 2

Cryptolaemus @Cryptolaemus1

5 years ago

#Emotet Update - @spamhaus/@nazywam Alerted us to a run of malspam coming form Emotet in the last 15-30 minutes. This is correct and we have confirmed this to be from the E2 botnet. Spam modules are being deployed and there is at least a test run being done currently. More Soon.

Cryptolaemus @Cryptolaemus1

5 years ago

1 36 55 0 0

Download Image

3 40 65 0 0

Vallabh Chole @CholeVallabh

6 years ago

Great article regarding wifi spreader module by Quinn #cryptolaemus1 #emotet

0 0 6 0 0

Cryptolaemus @Cryptolaemus1

6 years ago

#Emotet Update: Looks like we are seeing signs of a protocol change for C2 that matches what we saw last night for the new possible E4 loader. It may not be an E4 but more likely a loader/C2 revision that is inbound. Right now only E2 is exhibiting this behavior.

1 30 38 0 4

Cryptolaemus @Cryptolaemus1

6 years ago

#Emotet Daily Summary Report for 2019/11/26 - Doc DL Links are gone again. Less doc quintets today. Lots of odd C2 changes later reverted🤷‍♂️. Thanksgiving email templates and examples at bottom. Japan continues to get hit hard. 😞 pastebin.com/Lzu4K1Bi paste.cryptolaemus.com/emotet/2019/11…

1 18 29 0 0

Dr Rupal Tyagi @GrlScholar

6 years ago

Very informative! We should correct our knowledge. #recycling #plasticpollution #saynotoplastic #reuse #saynotomicroplastics #reduce #downcyled #petwaterbottle

0 2 3 0 0

Download Image

Cryptolaemus @Cryptolaemus1

6 years ago

#Emotet Daily Cryptolaemus Summary Post for 2019/09/17: Splitting of E1 in to E1/E3 botnets. Is E2 splitting into E2/E4 next? Lots of links on E2 spam and just attachments on E1/E3. Short update More tomorrow. pastebin.com/VnnwwP4y paste.cryptolaemus.com/emotet/2019/09…

0 19 26 0 1

\_(ʘ_ʘ)_/ @pollo290987

6 years ago

After #Emotet disappeared from the map, #Trickbot appeared to fill the gap left by it. Let me tell you some information about #Trickbot. Excuse me sir, do you have a moment to talk about #Trickbot …

1 46 118 0 7

J.A.R.V.I.S @peppermalware

6 years ago

0a1340bb124cd0d79fa19a09c821a049 seems to create infinite processes into anyrun vm: app.any.run/tasks/8558937b… Here it's connecting: 142.4.198.]249:7080/devices/taskbar/ 162.243.125.]212:8080/site/ringin/ringin/ 170.150.11.]245:8080/results/report/ I think its #emotet #malware

2 15 23 0 0

Christiaan Beek @ChristiaanBeek

6 years ago

Many #ransomware attacks these days are no longer mass-spread but direct and targeted. #RDP is their favorite entry point. @John_Fokker and his team did an excellent write up on how to secure RDP: securingtomorrow.mcafee.com/other-blogs/mc… #DFIR

2 13 14 0 1

Download Image

Vallabh Chole @CholeVallabh

6 years ago

#opendir 43.242.75.228 Cc @James_inthe_box

1 1 5 0 0

Vallabh Chole @CholeVallabh

6 years ago

#Emotet #Whitepaper #too_late #10000_password_list #Serverside_framework #namelogic #url_patternlist @Cryptolaemus1 quickheal.co.in/documents/tech… blogs.quickheal.com/what-is-emotet/

Bot Tracker @EmotetIndian

6 years ago

#Emotet #Whitepaper #too_late #10000_password_list #Serverside_framework #namelogic #url_patternlist @Cryptolaemus1 quickheal.co.in/documents/tech… blogs.quickheal.com/what-is-emotet/

2 10 12 0 1

Download Image

0 2 8 0 0

Netmux @netmux

6 years ago

REMOTELY EXTRACT NTDS.DIT & SYSTEM hive STEP 1: Use ‘wmi’ to execute ‘vssadmin’ to create new volume shadow copy: wmic /node:DC_hostname /user:DOMAIN\Username /password:password123 process call create "cmd /c vssadmin create shadow /for=C: 2>&1"