Very intelligent #android #malware actor filming his #C2 and giving away the URL. Targeting #spain and #portugal it seems. C2: hxxps://190.211.255.218/YTFlMzViNjNiNWM3/OTI0NGRhMTFlMDNk/index.php Probably: #Octo / #Coper android banker. Germán Fernández LaurieWired Alexander Leslie James @0xToxin Ankit Anubhav Tom.K vx-underground

@1ZRR4H Aha, and all domains: biribizidurdursunn[.]com biribizidurdursunn1[.]com biribizidurdursunn2[.]com yamacbank22[.]xyz youtubeadvan3242[.]xyz youtubeadvanced[.]pro Last two ones could be related to youtubeadvanced[.]net youtubevanvedadw[.]net as #SOVA --

@1ZRR4H Indeed, it is #Coper (tag NSGPlaystore). Config

@1ZRR4H Thanks for sharing this :)

@1ZRR4H The IP is also leaked on the video, he doing RDP into a host: 77[.]91[.]77[.]211 He is also using Winrar, 😅

@1ZRR4H Yeah, the same observation was made here: Also some ip in the 91.... but that's a huge space to check ^^

@1ZRR4H Lol 😂😂😂

@1ZRR4H RDPing 77.91.77.211 🇩🇪

@1ZRR4H True I did oversee that :)

@1ZRR4H @Soy @232 lmfao

@JAMESWT_MHT @1ZRR4H 🤣🤣🤣