I had my suspicions 🤣

After mucking around a bit finally got a working Dropbox URL and file for the #Clearfake distributed #AtomicStealer fake Chrome sample urlscan.io/result/376ad... tria.ge/240806-sahwj... and now it's a different IP 45.134.26[.]7 for the c2

Nice! Thank you ☺️

Secondary "grabber" payload urlscan.io/result/c1276...

Malware host/lure: tneunarchiver[.]com

First stage payload: TheUnarchiver.dmg (MD5: c720feef0092cfce7a54951beacfc02d)
www.virustotal.com/gui/file/116...

Second stage: cryptomac[.]dev/download/grabber.zip (MD5: 03db09912b4b7bec98410d276bd2409a)
www.virustotal.com/gui/file/a08...

Nice feature of urlscanio live browsing is having the file download available with the scan for context urlscan.io/result/e25eb... … I thought this was going to be #atomicstealer or #poseidon / #rodstealer / #rodmacer (or not-amos as I'm calling it cos there are too many names lol)

Thanks! I used Gephi.

Thank you!

No time for glass. Just swig.

Yeh telling war stories is getting harder 🤣 it was a part of becoming of age on the internet... what has happened 😢

Screenshot from the desktop app of part of a timeline I'm working on. Spans a decade of activity 😳

Thanks Marco! And no videos either to use as an alternative 😮

Thank you! So many great people!!!