Squiblydoo
@squiblydooblog
Malware Analysis (mostly SolarMarker)
Creator of Debloat and certReport
Want to chat? Join the Debloat discord: discord.gg/dvGXKaY5qr
ID: 1329845004303527938
http://squiblydoo.blog 20-11-2020 17:52:45
900 Tweet
3,3K Followers
72 Following
![<a href="/JAMESWT_WT/">JAMESWT</a> <a href="/struppigel/">Karsten Hahn</a> "LONG SOUND TLD" has now been reported.
It is also the trojan CrystalPDF, but seems to be an older version.
Domains:
flt.cntrlclient[.]com/v6
sih.cntrlclient[.]com/r
Same functionality.](https://pbs.twimg.com/media/G3NwkV4bMAAMjVu.png "Squiblydoo (@squiblydooblog) on Twitter photo <a href=\"/JAMESWT_WT/\">JAMESWT</a> <a href=\"/struppigel/\">Karsten Hahn</a> \"LONG SOUND TLD\" has now been reported.
It is also the trojan CrystalPDF, but seems to be an older version.
Domains:
flt.cntrlclient[.]com/v6
sih.cntrlclient[.]com/r
Same functionality.")
"Harmony_Impact_Campaign_Brief_PDF.exe" Signed "Universal Vision Limited" f470ab8df8dc7764cb726c85d9a6f5daadca98d45f34bff992a563754b484b93 Refuses to run in sandboxes PDF icon, Decoy PDF Malcat's Kesakode suggests high probability of "QuirkyLoader" h/t MalwareHunterTeam
