Mikhail Kasimov

@500mk500

Malicious traffic detection system: @maltrail;

Maltrail Demo Page: maltraildemo.github.io;
Maltrail FAQ: bit.ly/3IM9z07

Ukraine, Kiev maltrail.github.io Joined January 2016

640 Following 5.5K Followers 9.3K Posts

Latest posts 5

Pinned post

Mikhail Kasimov @500mk500 Jun 6, 2025

Generalization is the key on solving the problem of "you-have-wrong-attribution" discussions.

LetsDefend Verified account @LetsDefendIO Jun 5, 2025

Cybersecurity Terminology

View quoted post on X

Mikhail Kasimov @500mk500 Oct 4

FYI

Denis @unmaskparasites Oct 4

"DDoS-Guard verification" ClickFix malware. It uses DNS TXT records of luqiuid91[.]com to retrieve payloads
urlscan.io/search/#filena…

View quoted post on X

Mikhail Kasimov @500mk500 Sep 26

+

lurkershield\.com
safepayguard\.com
webcache-cache\.com
webcachecache\.com
feedback-bundle\.com
assets-bundle\.com
feedbackbundle\.com
static-secure\.com
analytics-secure\.com
doubleclickpro\.com
jquery-bootstrap\.com
captchatimestamp\.com
feedback-hotjar\.com

#magecart

1/2

Report URI Verified account @reporturi Sep 25

☠️IoC list for defenders:
specterguardian\.com
solutionjquery\.com
assetsbundle\.com
safeprocessor\.com
gtmtimestamp\.com
doubleclickcache\.com
websitewebcache\.com
explorerbrowser\.com
review-cdn\.com
safeprocessmaster\.com
View quoted post on X

Mikhail Kasimov @500mk500 Aug 3

cas-edu\.com
cas-edu\.org
china-robot\.online
china-robot\.org
eps-expo\.com
gcl-power-cn\.org
humanoid-robot\.online
ljewmte\.org
tickimmazy\.org
wtechnote\.org

#APT #Patchwork

Sudeep_Singh Verified account @SinghSoodeep Aug 3

Dropping Elephant targets East Asia using ICASSE decoy theme.

LNK MD5: a02dca4d1487f9141a90f3b11aa08d64
Malicious DLL: f8f03a6a3edbf7985469de26bdfb5e97
Base64-encoded and XOR-encrypted shellcode: fdfce91c0a9758a24ea98b48c44fdc9c
.NET assembly payload: 1ac87c87bc585605b75b269ca510fc52

Malicious DLL - msdtctm.dll sideloaded by msdtc.exe
Scheduled task name - GoogleErrorReport launches msdtc.exe to start attack chain

DLL sideloading -> Base64 + XOR decrypt shellcode -> Donut shellcode -> in-memory execution of .NET DLL

All DLL sideloading components downloaded from the staging domain: cas-edu[.]org

C2 URL: hxxps://wtechnote[.]org/c019e2b6b055-48d2/a5c5a153b6caddd7.php

#threatintel

@smica83 @malwrhunterteam @volrant136

View quoted post on X

Mikhail Kasimov @500mk500 Jun 3

Some add-on for C2 domains list:

aputuptherehe\.org
galsoillyoucom\.org
happygoluckybutterfly\.com
malevolencecheats\.com

#osx #fluttershell

Virus Bulletin @virusbtn Jun 3

Unit 42 analyses Operation FlutterBridge, a macOS malvertising campaign that seems to be the next stage of JSCoreRunner. The attackers now deliver adware with full backdoor capabilities through a payload dubbed FlutterShell. unit42.paloaltonetworks.com/flutterbridge-…

View quoted post on X