#WhiteSnake Stealer is now releasing an update featuring Google Cookies restoration 🍪👀
Same features after #Lumma , #Rhadamanthys , #Risepro , #Meduza , #Stealc
Anyone else?😂
![Looks Like Risepro has updated their C2 Panel
http[:]//38[.]47[.]220[.]202
censys
services.http.response.html_title='ProxyTools'
shodan
http.html_hash:-946937792
new panels:
175[.]24[.]178[.]202
38[.]47[.]221[.]56
8[.]140[.]18[.]150
#RisePro @ShilpeshTrivedi @JAMESWT_MHT](https://pbs.twimg.com/media/F54Y2PCbAAAx0Cg.jpg "Salman Shaikh (@salmanvsf) on Twitter photo 2023-09-13 05:13:19 Looks Like Risepro has updated their C2 Panel
http[:]//38[.]47[.]220[.]202
censys
services.http.response.html_title='ProxyTools'
shodan
http.html_hash:-946937792
new panels:
175[.]24[.]178[.]202
38[.]47[.]221[.]56
8[.]140[.]18[.]150
#RisePro @ShilpeshTrivedi @JAMESWT_MHT")
![[1/4] #RisePro #stealer C2 panel,This #Malware came back after 8 months
http[:]//5[.]42[.]79[.]238[:]8081/login
http[:]//38[.]47[.]220[.]202[:]8081/login
http[:]//45[.]15[.]159[.]248[:]8081/login
http[:]//95[.]214[.]25[.]205[:]8081/login
http[:]//95[.]214[.]25[.]208[:]8081/login](https://pbs.twimg.com/media/F1_qjRSaYAIinen.jpg "Cyber_Ravan (@cyber_ra1) on Twitter photo 2023-07-26 22:12:05 [1/4] #RisePro #stealer C2 panel,This #Malware came back after 8 months
http[:]//5[.]42[.]79[.]238[:]8081/login
http[:]//38[.]47[.]220[.]202[:]8081/login
http[:]//45[.]15[.]159[.]248[:]8081/login
http[:]//95[.]214[.]25[.]205[:]8081/login
http[:]//95[.]214[.]25[.]208[:]8081/login")
Prepare your inquiries points for this session!
'Ranolazine from Theory to Practice: Clinical Cases', a session led by the esteemed Prof. Amr Kamal 🤩
Register Now & save yourself a seat: bit.ly/43fEcWt
#CVREP #RisePro #cardiology #cardiologist #cardiology fellows
A few active #RisePro #stealer #c2 panels:
hxxp://194.169.175[.]128:8081/login
hxxp://38.47.220[.]202:8081/login
hxxp://79.110.49[.]141:8081/login
Dee Who said what JAMESWT fastfire ChrisUeland R.
#threathunting #malware
![A few active #RisePro #stealer #c2 panels:
hxxp://194.169.175[.]128:8081/login
hxxp://38.47.220[.]202:8081/login
hxxp://79.110.49[.]141:8081/login
@ViriBack @g0njxa @JAMESWT_MHT @fastfire @ChrisUeland @0xrb
#threathunting #malware](https://pbs.twimg.com/media/F1e5jzyX0AAMrC2.jpg "Greg Leah (@powershellcode) on Twitter photo 2023-07-20 13:18:02 A few active #RisePro #stealer #c2 panels:
hxxp://194.169.175[.]128:8081/login
hxxp://38.47.220[.]202:8081/login
hxxp://79.110.49[.]141:8081/login
@ViriBack @g0njxa @JAMESWT_MHT @fastfire @ChrisUeland @0xrb
#threathunting #malware")
![#Censys Queries to find #RisePro #Stealer Infra
'services.http.response.headers: (key: `Server` and value.headers: `RisePro`)' => 26 servers
(or)
'services[.]software.product=`risepro` ' => 23 servers
The reason is explained in the below screenshots.
#Malware #ioc](https://pbs.twimg.com/media/GG8Gbh0XIAAZWhx.png "Cyber Team (@Cyberteam008) on Twitter photo 2024-02-22 11:56:49 #Censys Queries to find #RisePro #Stealer Infra
'services.http.response.headers: (key: `Server` and value.headers: `RisePro`)' => 26 servers
(or)
'services[.]software.product=`risepro` ' => 23 servers
The reason is explained in the below screenshots.
#Malware #ioc")
🔍 #Malware configuration extractors targeting #infostealers like #RisePro and #Lumma .
🛡️ Detecting threat tactics such as #ReverseShells , #ProcessHollowing , and more.
🎣 Enhanced #phishing detection capabilities, including automated login interaction.
🚨 Insight into the…
#100DaysofYARA Day47: Detecting RisePro C2 Login Panels based on Network Headers using VT Live Hunt
github.com/RustyNoob-619/…
