<![CDATA[I don't know how to feel about this domain: maybedontbanplease[.]com]]>I don't know how to feel about this domain: maybedontbanplease[.]com

What to do? Chat, can you help me out?

(CastleLoader
4ba0d3ae41a0ae3143e8c2c3307c24b0d548593f97c79a30c0387b3d62504c31 signed "SERPENTINE SOLAR LIMITED"
NSIS -> Python execution -> loads remote resource)

]]>https://board.circlewithadot.net/topic/e587d2f5-a2d4-40d2-a1c2-89fd24126cb3/i-don-t-know-how-to-feel-about-this-domain-maybedontbanplease-.-comRSS for NodeFri, 01 May 2026 11:16:41 GMTThu, 09 Apr 2026 18:12:58 GMT60<![CDATA[Reply to I don't know how to feel about this domain: maybedontbanplease[.]com on Thu, 23 Apr 2026 14:10:06 GMT]]>@darfplatypus
This python dropper is tracked as "CastleLoader", there are a few actors that are leveraging it.
Also, happy to talk via email or another medium if desired. (My email is Squiblydoo@pm.me)

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/squiblydoo/statuses/116454418456064484https://board.circlewithadot.net/post/https://infosec.exchange/users/squiblydoo/statuses/116454418456064484Thu, 23 Apr 2026 14:10:06 GMT<![CDATA[Reply to I don't know how to feel about this domain: maybedontbanplease[.]com on Thu, 23 Apr 2026 12:56:31 GMT]]>@squiblydoo we've seen approximately three chains that start with that python dropper. I am going to work today to ensure it's not specific to our org and work on getting permission to share.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/darfplatypus/statuses/116454129113718398https://board.circlewithadot.net/post/https://infosec.exchange/users/darfplatypus/statuses/116454129113718398Thu, 23 Apr 2026 12:56:31 GMT<![CDATA[Reply to I don't know how to feel about this domain: maybedontbanplease[.]com on Thu, 23 Apr 2026 11:05:10 GMT]]>@darfplatypus Hello! Thanks for the question. Unfortunately, I didn't see the payload. Do you happen to have it?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/squiblydoo/statuses/116453691275669054https://board.circlewithadot.net/post/https://infosec.exchange/users/squiblydoo/statuses/116453691275669054Thu, 23 Apr 2026 11:05:10 GMT<![CDATA[Reply to I don't know how to feel about this domain: maybedontbanplease[.]com on Tue, 21 Apr 2026 21:28:44 GMT]]>@squiblydoo hi Squiblydoo, I'm sorry for asking from someone I don't know well, but do you happen to have a malware name for the last payload that drops?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/darfplatypus/statuses/116444818619178469https://board.circlewithadot.net/post/https://infosec.exchange/users/darfplatypus/statuses/116444818619178469Tue, 21 Apr 2026 21:28:44 GMT