Fresh today compiled #razr #Ransomware

[james_inthe_box@infosec.exchange]

Fresh today compiled #razr #Ransomware

https://app.any.run/tasks/024d41ab-8174-4256-a85c-6b8efda037ba

[netresec@infosec.exchange]

@james_inthe_box Seems like they just get a new subdomain on pythonanywhere[.]com for each new campaign. Might be a good idea to put pythonanywhere on a blocklist.

[netresec@infosec.exchange]

@james_inthe_box
xmb.pythonanywhere[.]com (2024-08-18 -- 2025-09-17)
tdroot.pythonanywhere[.]com (2026-02-10)
https://www.joesandbox.com/analysis/1494487/1/html

#razr #ransomware

[anyrun_app@infosec.exchange]

@james_inthe_box thanks for sharing, James!