MalwareHunterTeam ✓

@malwrhunterteam

Official MHT Twitter account. Check out ID Ransomware (created by @demonslay335). More photos & gifs, less malware.

256 140Followers

39Following

71 497Posts total

109.8KViews on collected posts

Growth & engagement

How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.

Views per post

80.1K16 Jan

3.1K

17.5K17 Jan

2.2K

1.7K

245

909

525

755

1.6K

1.2K

Last 11 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.

Engagement rate per post

0.05%16 Jan

0.19%

0.89%17 Jan

0.18%

0.84%

1.22%

0.33%

0.57%

0.26%

0.19%

0.25%

Reactions — likes, reposts, replies and quotes — divided by views.

What the audience does

Likes55.7%180 in total

Reposts9.9%32 in total

Replies5.9%19 in total

Quotes2.2%7 in total

Bookmarks26.3%85 in total

Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.

The follower curve appears once this account has two daily snapshots — we take one a day, and this one is on its first.

Latest posts

@Kostastsale @nullableVoidPtr And then finally, here are lots of lines containing "error" in any way... 🤷‍♂️ https://t.co/IAUndXr3LB 1.2K views · 2 likes · 0 reposts · 1 replies 17 Jan 2026 · Open on X →

@Kostastsale @nullableVoidPtr Then, on the screenshot are all supported task types in the "handleMessage" function: https://t.co/7R7Rpbs3NB 1.6K views · 2 likes · 0 reposts · 1 replies 17 Jan 2026 · Open on X →

@Kostastsale @nullableVoidPtr " PRIORITY_PATTERNS = ["*.kdbx", "*.key", "*.pem", "*.ppk", "*.p12", "*.pfx", "*.asc", "*.gpg", "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", "*.ovpn", "*.txt", "*.rdp"], " 755 views · 1 likes · 0 reposts · 1 replies 17 Jan 2026 · Open on X →

@Kostastsale @nullableVoidPtr Then, on the screenshots are all the function names that are not shit (like "_0x497924" and etc). https://t.co/Fc3dBC41hG 525 views · 2 likes · 0 reposts · 1 replies 17 Jan 2026 · Open on X →

@Kostastsale Thanks to @nullableVoidPtr's deobfuscation work (https://t.co/8ZD1K8c5hf), now we can take some closer looks. First, on the screenshots are all the console.log calls I found in it. Not sure why the actors did not remove them yet (maybe they are testing this malware s 909 views · 2 likes · 0 reposts · 1 replies 17 Jan 2026 · Open on X →

@malwrhunterteam https://t.co/dU9kpqWakC 245 views · 3 likes · 0 reposts · 0 replies 17 Jan 2026 · Open on X →

@vxunderground Deobfuscated: https://t.co/U11VLqEbk7 1.7K views · 10 likes · 0 reposts · 2 replies 17 Jan 2026 · Open on X →

Check this tweet from @Kostastsale for some more information/details: https://t.co/3PdkTpbBB2 2.2K views · 3 likes · 0 reposts · 1 replies 17 Jan 2026 · Open on X →

This is a very interesting intrusion using deno.exe in a way I haven’t personally seen before. What stands out here is not just Deno itself, but the full execution chain and how multiple runtimes are stitched together. It starts via an MSI that launches a VBS script. VBS acts h 17.5K views · 125 likes · 25 reposts · 4 replies 17 Jan 2026 · Open on X →

See this next stage url: http://sharecodepro[.]com/m/8752e5472b9a3a80/main The code given here is not only obfuscated, but looks changing constantly... 🤷‍♂️ 3.1K views · 4 likes · 0 reposts · 2 replies 16 Jan 2026 · Open on X →

Possible interesting "topwebcomicsv1.msi": 5a1c14335d0a8b007ff2813e6ef738e8836be38257cc82fe03c02b71d71e1b01 It is using Deno, "the next-generation JavaScript runtime". Seeing malware using Deno is not a common thing, at least yet... 🤷‍♂️ https://t.co/zZY9wlFcoq 80.1K views · 26 likes · 7 reposts · 5 replies 16 Jan 2026 · Open on X →

Growth & engagement

Views per post

Engagement rate per post

What the audience does

Latest posts

Similar accounts