lowmal@lowmal3

sysadmin by day and wardriver by night.

bazaar.abuse.ch/user/1700/
Joined November 2020
9 Photos and videos
The first day of balccon2k26 has just begun. I hope to see many of you in Novi Sad. #balccon #balccon2k26
3
4
454
Balccon 2k25 starts tomorrow, see you in NoviSad.
4
12
1,167
Good Morning @500mk500 @maltrail 199.36.158[.]100:443 detected as android spynote looks like a FP to me. Our passive dns shows adblockplus[.]org Looks like the IP is used by google/fastly
2
2
187
Use a vhd image to deliver malware via e-mail and then set ZoneId=3 in the Zone.Identifier ADS? 🙄 bazaar.abuse.ch/sample/ad2ba…

MalwareBazaar - PO-TS006630009-MRTUNNING.vhd (VenomRAT)

PO-TS006630009-MRTUNNING.vhd has been detected as VenomRAT by MalwareBazaar

bazaar.abuse.ch
1
81
Arrived at BalCCon 2k24, let’s have a good time
1
2
119
#balccon #NoviSad #Serbia #cyber
1
128
Fake @awscloud domain server[.]awsamazongroup[.]asia registered via @netsolcares hosted by @SingleHop used to send fake @thermofisher with malicious attachments, see: virustotal.com/gui/ip-addres… virustotal.com/gui/file/ff10… bazaar.abuse.ch/sample/1a534…
2
109
lowmal retweeted
BalCCon@BalCC0n
27 Aug 2024
Assemblies: Want to bring more of that Hackerspace feeling to the #BalCCn2k24! Reserve a space in #BalCCon #hackerspace: tinyurl.com/4mekkudd #Assembly #Security #Hackerspace #community #hacking
6
7
1,224
1302 days, 12345 malware samples uploaded to @abuse_ch MalwareBazar.
1
74
When you have no budget for an exploit, just ask the user to copy and paste your code to powershell and execute it ;) Sample: bazaar.abuse.ch/sample/e1fab…
50
Hey @500mk500 94.23.121[.]150:8080 listed as vidar and 66.111.2[.]20:9001 listed as android bankbot both look like tor relays/exit nodes. Not sure if you can flag them as Tor, so people know that they can be FP if somebody is using Tor.
1
1
214
Good Morning @500mk500, @maltrail 154.61.71.12[:]443 detected as android exobot (malware) looks like a FP to me. Our passive DNS shows @hatching_io tria[.]ge and hatching[.]io resolve to this IP.
1
186
Hey @Medium your website is used as a redirect service in phishing campaigns: medium.com/m/global-identity…
47
Hey @Namecheap someone is using a domain, registered via your service to send phishing messages on behalf of @Deloitte via the domain delloittee[.]de
1
65
Good Morning @maltrail, @500mk500 154.61.71[.]12 detected as android exobot looks like a false positive. Our PassiveDNS show that the IP belongs to tria.ge: |IN||tria.ge.||A||154.61.71.12|
1
2
156
Hey @Cloudflare @CloudflareHelp another domain who hides behind your service to phish users is germany: eu-west-1.resend-links[.]com ssl certificate signed by @Google See: virustotal.com/gui/domain/re…
92
Good Morning @maltrail, @500mk500 185.199.108[.]133 detected as elf gafgyt looks like a FP to me. Our passive dns shows raw.githubusercontent[.]com and objects.githubusercontent[.]com
1
1,078
Guten Morgen @eliaselster, https://aktualisierung-elster[.]de ist eine Kopie eurer Seite die für phishing genutzt wird.
242
Hey @maltrail, @500mk500 156.154.132.200 detected as pupyrat looks like a namecheap dns server: dns1.namecheaphosting.com dns1.registrar-servers.com Looks like a FP to me
1
165
lowmal retweeted
BalCCon@BalCC0n
16 Aug 2023
BalCCn2k23 Badge: hackaday.io/project/192371-b… #badgelife #Hacking #conference #BalCCon #BalCCon2k23 #badge #Security

BalCCon Cyberdeck 0o27, aka BCD-0o27

Note: This is a pre-release of the BalCCon Cyberdeck 0o27, or BCD-0o27 in short (which will be the offical badge for the BalCCon security conference in September). Development is still in progress...

hackaday.io
1
16
25
3,033
Load more