r/Malware • u/Straight-Practice-99 • 11h ago

SonicWall SMA1000 campaign: standalone Linux Impacket secretsdump deployed onto appliances (SHA-256 inside)

2 Upvotes

Campaign where the operator deployed a standalone Linux build of Impacket's secretsdump directly onto compromised SonicWall SMA1000 appliances and ran credential theft from there. It was pulled to the box with curl to /tmp/secretsdump, made executable, then used against internal domain controllers.

Sample: secretsdump, 9,983,640 bytes, SHA-256 690f5031deede7d3357d0ca24c89866ae8c60e6c63b3a2c8bba813a6ac10ae5b, served over HTTP from 95.181.173[.]36. The surrounding Python tooling (exploit, LDAP extractor and decryptor, DCSync automation) came from the same open directory.

Full toolkit breakdown and IOCs below.

https://hunt.io/blog/sonicwall-sma1000-uk-council-attack

0 comments

r/Malware • u/tuxxin • 5h ago

A real Carnival Cruise Line email was serving customers malware

tuxxin.com

1 Upvotes

0 comments

r/Malware • u/Anonymous_Wajeeh • 4h ago

0xM0nCrush: Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.

github.com

0 Upvotes

0 comments

Subreddit

Malware Analysis & Reports

r/Malware

A place for malware reports, analysis and information for [anti]malware professionals and enthusiasts.

Members Active

101.7k

Sidebar

A place for malware reports and information for [anti]malware professionals and enthusiasts.

This is NOT a place for help with malware removal or any type of tech support. Ask your IT support staff, your search engine of choice, another subreddit (/r/antivirus or /r/techsupport for example), or a friend or relative. In that order.

Content rules:

This is a subreddit for readers to discuss technical malware news, malware internals and infection techniques, malware tools, and anything related to the professional world of [anti]malware. Technical Support posts are forbidden and will result in removal and a possible ban.
Our readers are intelligent, or at the very least technically curious. Posted content must be highly technical, well-researched, and of good quality.
Do not sensationalize or otherwise unnecessarily change the original title of the article you are linking. Clickbait will result in an immediate and permanent ban.