#ParsedReport
29-12-2022
. Hidden teeth hidden in South Asia Slang snake tissue recent attack activity briefing
https://ti.qianxin.com/blog/articles/sidewinder-group%27s-recent-attack-activity-briefing
Actors/Campaigns:
Sidewinder
Threats:
Dll_sideloading_technique
Dotnettojscript_technique
Industry:
Government, Maritime, Education
Geo:
Bangladesh, Pakistan, China, Afghanistan, Asia, Pakistani, Nepal
CVEs:
CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 4.8,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft office (2013, 2010, 2016, 2007)
IOCs:
File: 11
Hash: 14
Softs:
slack, android
Algorithms:
base64, xor
Languages:
javascript
29-12-2022
. Hidden teeth hidden in South Asia Slang snake tissue recent attack activity briefing
https://ti.qianxin.com/blog/articles/sidewinder-group%27s-recent-attack-activity-briefing
Actors/Campaigns:
Sidewinder
Threats:
Dll_sideloading_technique
Dotnettojscript_technique
Industry:
Government, Maritime, Education
Geo:
Bangladesh, Pakistan, China, Afghanistan, Asia, Pakistani, Nepal
CVEs:
CVE-2017-11882 [Vulners]
Vulners: Score: 9.3, CVSS: 4.8,
Vulners: Exploitation: True
X-Force: Risk: 7.8
X-Force: Patch: Official fix
Soft:
- microsoft office (2013, 2010, 2016, 2007)
IOCs:
File: 11
Hash: 14
Softs:
slack, android
Algorithms:
base64, xor
Languages:
javascript
Qianxin
奇安信威胁情报中心
Nuxt.js project
#ParsedReport
29-12-2022
APT-C-36. 1. Analysis of attack activities
https://mp.weixin.qq.com/s/mTmJLHYC9bJDnphf_52JmA
Actors/Campaigns:
Blindeagle
Threats:
Njrat_rat
Syncrat
Asyncrat_rat
Industry:
Financial, Government
Geo:
Spanish, America, Ecuador, Colombia, Colombian
IOCs:
Hash: 14
File: 26
Url: 6
Softs:
virtualbox
Algorithms:
base64, aes
Functions:
Settings
Languages:
c_language, csharp
29-12-2022
APT-C-36. 1. Analysis of attack activities
https://mp.weixin.qq.com/s/mTmJLHYC9bJDnphf_52JmA
Actors/Campaigns:
Blindeagle
Threats:
Njrat_rat
Syncrat
Asyncrat_rat
Industry:
Financial, Government
Geo:
Spanish, America, Ecuador, Colombia, Colombian
IOCs:
Hash: 14
File: 26
Url: 6
Softs:
virtualbox
Algorithms:
base64, aes
Functions:
Settings
Languages:
c_language, csharp
Weixin Official Accounts Platform
APT-C-36（盲眼鹰）近期攻击活动分析
APT-C-36近期常采用鱼叉攻击，以PDF文件作为入口点，诱导用户点击文档里面的恶意链接下载RAR压缩包文件
#ParsedReport
29-12-2022
Operation Dragon Dance
https://ti.qianxin.com/blog/articles/operation-dragon-dance-the-sword-of-damocles-hanging-over-the-gaming-industry
Actors/Campaigns:
Dragon_dance
Miuuti
Dragon_breath
Threats:
Powerkatz_stealer
Industry:
Entertainment
CVEs:
CVE-2021-21220 [Vulners]
Vulners: Score: 6.8, CVSS: 3.1,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- google chrome (<89.0.4389.128)
- fedoraproject fedora (32, 33, 34)
IOCs:
File: 8
Softs:
node.js, curl, chrome, telegram
Languages:
delphi
29-12-2022
Operation Dragon Dance
https://ti.qianxin.com/blog/articles/operation-dragon-dance-the-sword-of-damocles-hanging-over-the-gaming-industry
Actors/Campaigns:
Dragon_dance
Miuuti
Dragon_breath
Threats:
Powerkatz_stealer
Industry:
Entertainment
CVEs:
CVE-2021-21220 [Vulners]
Vulners: Score: 6.8, CVSS: 3.1,
Vulners: Exploitation: True
X-Force: Risk: 8.8
X-Force: Patch: Official fix
Soft:
- google chrome (<89.0.4389.128)
- fedoraproject fedora (32, 33, 34)
IOCs:
File: 8
Softs:
node.js, curl, chrome, telegram
Languages:
delphi
Qianxin
奇安信威胁情报中心
Nuxt.js project
#ParsedReport
30-12-2022
. Analysis of the CNC organization "Ferry" of the CNC organization of the military and education industry
https://www.antiy.cn/research/notice&report/research_report/20221229.html
Actors/Campaigns:
Darkhotel
Industry:
Education
TTPs:
Tactics: 3
Technics: 0
IOCs:
File: 7
Hash: 2
IP: 2
Algorithms:
xxtea, base64
Platforms:
amd64
30-12-2022
. Analysis of the CNC organization "Ferry" of the CNC organization of the military and education industry
https://www.antiy.cn/research/notice&report/research_report/20221229.html
Actors/Campaigns:
Darkhotel
Industry:
Education
TTPs:
Tactics: 3
Technics: 0
IOCs:
File: 7
Hash: 2
IP: 2
Algorithms:
xxtea, base64
Platforms:
amd64
www.antiy.cn
针对军工和教育行业的CNC组织“摆渡”木马分析
安天应急响应中心（安天CERT）在梳理攻击活动时发现CNC组织使用的两个下载器，其中一个下载器具有摆渡攻击的能力，利用移动存储设备作为“渡船”，间接从隔离网中窃取攻击者感兴趣的文件；另一个下载器使用欺骗性的具有不可信数字证书的C2节点进行通信。
#ParsedReport
31-12-2022
ASEC (20221218 \~ 20221224). ASEC Weekly phishing email threat trend (20221218 \~ 20221224)
https://asec.ahnlab.com/ko/45061
Threats:
Agent_tesla
Formbook
Industry:
Transport, Financial
Geo:
Chile, Korean
TTPs:
IOCs:
File: 40
Url: 3
31-12-2022
ASEC (20221218 \~ 20221224). ASEC Weekly phishing email threat trend (20221218 \~ 20221224)
https://asec.ahnlab.com/ko/45061
Threats:
Agent_tesla
Formbook
Industry:
Transport, Financial
Geo:
Chile, Korean
TTPs:
IOCs:
File: 40
Url: 3
ASEC BLOG
ASEC 주간 피싱 이메일 위협 트렌드 (20221218 ~ 20221224) - ASEC BLOG
Contents피싱 이메일 위협 유형첨부파일 확장자유포 사례사례: 가짜 로그인 페이지 (FakePage)사례: 악성코드 (Infostealer, Downloader 등)주의 키워드: ‘RAR 압축파일’ 가짜 페이지 (FakePage) C2 주소피싱 이메일 공격 예방 ASEC 분석팀에서는 샘플 자동 분석 시스템(RAPIT)과 허니팟을 활용하여 피싱 이메일 위협을 모니터링하고 있다. 본 포스팅에서는 2022년 12월 18일부터 12월 24일까지 한 주간 확인된…
#ParsedReport
31-12-2022
NetSupport RAT. Netsupport RAT disguised as a Pokemon game
https://asec.ahnlab.com/ko/45073
Threats:
Netsupportmanager_rat
Ammyyadmin_tool
Anydesk_tool
Teamviewer_tool
Tmate_tool
Malware/win.generic.c5339867
Malware/win.generic.c5335414
Malware/win.generic.c5333592
Malware/win.malware-gen.c5331507
IOCs:
File: 13
Hash: 11
Domain: 1
Url: 6
Softs:
visual studio
31-12-2022
NetSupport RAT. Netsupport RAT disguised as a Pokemon game
https://asec.ahnlab.com/ko/45073
Threats:
Netsupportmanager_rat
Ammyyadmin_tool
Anydesk_tool
Teamviewer_tool
Tmate_tool
Malware/win.generic.c5339867
Malware/win.generic.c5335414
Malware/win.generic.c5333592
Malware/win.malware-gen.c5331507
IOCs:
File: 13
Hash: 11
Domain: 1
Url: 6
Softs:
visual studio
ASEC BLOG
포켓몬 게임으로 위장한 NetSupport RAT 악성코드 유포 중 - ASEC BLOG
NetSupport Manager는 원격 제어 도구로서 일반 사용자나 기업 사용자들이 원격으로 시스템을 제어하기 위한 목적으로 설치하고 사용할 수 있다. 하지만 외부에서 특정 시스템을 제어할 수 있다는 기능으로 인해 다수의 공격자들에 의해 악용되고 있다. 원격 제어 도구(Remote Administration Tool)들은 대부분 커맨드 라인 기반인 백도어 및 RAT(Remote Access Trojan) 악성코드들과 달리 사용자 편의가 중요하기 때문에…
#ParsedReport
02-01-2023
ASEC Weekly Malware Statistics (December 19th, 2022 December 25th, 2022)
https://asec.ahnlab.com/en/45023
Threats:
Beamwinhttp_loader
Garbage_cleaner
Agent_tesla
Tofsee
Stop_ransomware
Smokeloader
Vidar_stealer
Formbook
Clipboard_grabbing_technique
Snake_keylogger
Industry:
Financial
Geo:
Korea
IOCs:
File: 19
Email: 9
Domain: 2
Url: 11
Softs:
telegram, discord
Languages:
php
02-01-2023
ASEC Weekly Malware Statistics (December 19th, 2022 December 25th, 2022)
https://asec.ahnlab.com/en/45023
Threats:
Beamwinhttp_loader
Garbage_cleaner
Agent_tesla
Tofsee
Stop_ransomware
Smokeloader
Vidar_stealer
Formbook
Clipboard_grabbing_technique
Snake_keylogger
Industry:
Financial
Geo:
Korea
IOCs:
File: 19
Email: 9
Domain: 2
Url: 11
Softs:
telegram, discord
Languages:
php
ASEC BLOG
ASEC Weekly Malware Statistics (December 19th, 2022 – December 25th, 2022) - ASEC BLOG
ContentsTop 1 – BeamWinHTTPTop 2 – AgentTeslaTop 3 – TofseeTop 4 – FormbookTop 5 – SnakeKeylogger The ASEC analysis team uses the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected…
#ParsedReport
02-01-2023
Legitimate Apps a safe haven for IcedID
https://labs.k7computing.com/index.php/legitimate-apps-a-safe-haven-for-icedid
Threats:
Icedid
Cobalt_strike
Industry:
Financial
IOCs:
File: 6
Domain: 1
Hash: 2
Softs:
zoom
Algorithms:
zip
Platforms:
x86
02-01-2023
Legitimate Apps a safe haven for IcedID
https://labs.k7computing.com/index.php/legitimate-apps-a-safe-haven-for-icedid
Threats:
Icedid
Cobalt_strike
Industry:
Financial
IOCs:
File: 6
Domain: 1
Hash: 2
Softs:
zoom
Algorithms:
zip
Platforms:
x86
K7 Labs
Legitimate Apps a safe haven for IcedID
IcedID is a Banking Trojan(used to steal banking details) which has been active since 2017.However, it’s being used these days […]
#ParsedReport
02-01-2023
Dark Web Profile: MuddyWater APT Group
https://socradar.io/dark-web-profile-muddywater-apt-group
Actors/Campaigns:
Muddywater (motivation: cyber_espionage, financially_motivated)
Unc3313
Threats:
Powgoop
Powerstats
Stuxnet
Mimikatz_tool
Ligolo
Screenconnect_tool
Ehorus_tool
Starwhale
Disttrack
Syncro_tool
Industry:
Government, Energy, Healthcare, Education, Financial
Geo:
Asia, Iraq, Africa, Turkish, Turkey, Azerbaijan, Irans, America, Iran, Pakistan, Israeli, Bahrain, Iranian, Emirates, Israel
TTPs:
Tactics: 12
Technics: 55
IOCs:
File: 11
Hash: 30
IP: 16
Softs:
component object model
Languages:
visual_basic, python, javascript
02-01-2023
Dark Web Profile: MuddyWater APT Group
https://socradar.io/dark-web-profile-muddywater-apt-group
Actors/Campaigns:
Muddywater (motivation: cyber_espionage, financially_motivated)
Unc3313
Threats:
Powgoop
Powerstats
Stuxnet
Mimikatz_tool
Ligolo
Screenconnect_tool
Ehorus_tool
Starwhale
Disttrack
Syncro_tool
Industry:
Government, Energy, Healthcare, Education, Financial
Geo:
Asia, Iraq, Africa, Turkish, Turkey, Azerbaijan, Irans, America, Iran, Pakistan, Israeli, Bahrain, Iranian, Emirates, Israel
TTPs:
Tactics: 12
Technics: 55
IOCs:
File: 11
Hash: 30
IP: 16
Softs:
component object model
Languages:
visual_basic, python, javascript
SOCRadar® Cyber Intelligence Inc.
Dark Web Profile: MuddyWater APT Group
April 19, 2023: Added subheading: “MuddyWater Uses SimpleHelp Tool for Persistence on Victim Devices”
#ParsedReport
03-01-2023
How Infostealer Threat Actors Make a Profit
https://asec.ahnlab.com/en/45150
Threats:
Agent_tesla
Formbook
Lokibot_stealer
Snake_keylogger
Redline_stealer
Vidar_stealer
Lockbit
Industry:
Financial
03-01-2023
How Infostealer Threat Actors Make a Profit
https://asec.ahnlab.com/en/45150
Threats:
Agent_tesla
Formbook
Lokibot_stealer
Snake_keylogger
Redline_stealer
Vidar_stealer
Lockbit
Industry:
Financial
#ParsedReport
03-01-2023
ASEC Weekly Phishing Email Threat Trends (December 18th, 2022 December 24th, 2022)
https://asec.ahnlab.com/en/45237
Threats:
Agent_tesla
Formbook
Industry:
Transport, Financial
Geo:
Chile, Korean
TTPs:
IOCs:
File: 36
Url: 3
03-01-2023
ASEC Weekly Phishing Email Threat Trends (December 18th, 2022 December 24th, 2022)
https://asec.ahnlab.com/en/45237
Threats:
Agent_tesla
Formbook
Industry:
Transport, Financial
Geo:
Chile, Korean
TTPs:
IOCs:
File: 36
Url: 3
ASEC BLOG
ASEC Weekly Phishing Email Threat Trends (December 18th, 2022 – December 24th, 2022) - ASEC BLOG
ContentsPhishing EmailsFile Extensions in Phishing EmailsCases of DistributionCase: FakePageCase: Malware (Infostealer, Downloader, etc.)Keywords to Beware of: ‘RAR Compressed FileFakePage C2 URL Preventing Phishing Email Attacks The ASEC analysis team monitors…
#ParsedReport
03-01-2023
BitRAT Now Sharing Sensitive Bank Data as a Lure
https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Threats:
Sbit_rat
Redline_stealer
Industry:
Financial
TTPs:
Tactics: 1
Technics: 9
IOCs:
File: 1
Hash: 1
Win API:
WinExec
03-01-2023
BitRAT Now Sharing Sensitive Bank Data as a Lure
https://blog.qualys.com/vulnerabilities-threat-research/2023/01/03/bitrat-now-sharing-sensitive-bank-data-as-a-lure
Threats:
Sbit_rat
Redline_stealer
Industry:
Financial
TTPs:
Tactics: 1
Technics: 9
IOCs:
File: 1
Hash: 1
Win API:
WinExec
Qualys Security Blog
BitRAT Now Sharing Sensitive Bank Data as a Lure | Qualys Security Blog
In June of 2022 Qualys Threat Research Unit (TRU) wrote an in-depth report on Redline, a commercial off the shelf infostealer that spreads via fake cracked software hosted on Discord’s content…
#ParsedReport
04-01-2023
Shc Linux Malware Installing CoinMiner
https://asec.ahnlab.com/en/45182
Threats:
Xmrig_miner
Perlbot
Geo:
Korea
IOCs:
File: 1
Hash: 12
IP: 2
Url: 9
Softs:
ubuntu)
Algorithms:
rc4
Languages:
perl
04-01-2023
Shc Linux Malware Installing CoinMiner
https://asec.ahnlab.com/en/45182
Threats:
Xmrig_miner
Perlbot
Geo:
Korea
IOCs:
File: 1
Hash: 12
IP: 2
Url: 9
Softs:
ubuntu)
Algorithms:
rc4
Languages:
perl
ASEC
Shc Linux Malware Installing CoinMiner - ASEC
Shc Linux Malware Installing CoinMiner ASEC
#ParsedReport
04-01-2023
Pupy RAT hiding under WerFaults cover
https://labs.k7computing.com/index.php/pupy-rat-hiding-under-werfaults-cover
Actors/Campaigns:
Apt33 (motivation: cyber_espionage)
Cleaver (motivation: cyber_espionage)
Threats:
Pupy_rat
Lolbin_technique
Dll_sideloading_technique
Cloudeye
Reflectiveloader
Industry:
Energy
Geo:
Chinese, China, Iran
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 6
Hash: 3
Url: 1
Softs:
windows error reporting
Algorithms:
rc4
Win API:
CreateThread
Languages:
python
Links:
04-01-2023
Pupy RAT hiding under WerFaults cover
https://labs.k7computing.com/index.php/pupy-rat-hiding-under-werfaults-cover
Actors/Campaigns:
Apt33 (motivation: cyber_espionage)
Cleaver (motivation: cyber_espionage)
Threats:
Pupy_rat
Lolbin_technique
Dll_sideloading_technique
Cloudeye
Reflectiveloader
Industry:
Energy
Geo:
Chinese, China, Iran
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 6
Hash: 3
Url: 1
Softs:
windows error reporting
Algorithms:
rc4
Win API:
CreateThread
Languages:
python
Links:
https://github.com/n1nj4sec/pupyK7 Labs
Pupy RAT hiding under WerFault’s cover
We at K7 Labs recently identified an interesting technique used by threat actors to execute a Remote Admin Tool. We […]
#ParsedReport
05-01-2023
BlindEagle Targeting Ecuador With Sharpened Tools. HIGHLIGHTS:
https://research.checkpoint.com/2023/blindeagle-targeting-ecuador-with-sharpened-tools
Actors/Campaigns:
Blindeagle (motivation: financially_motivated, cyber_espionage)
Cloudatlas
Threats:
Quasar_rat
Meterpreter_tool
Lotl_technique
Azov
Wannacry
Rubyminer
Adwind_rat
Industry:
Financial, Government
Geo:
Ukraine, Ecuador, America, Russia, Spanish, Belarus, Colombian, Colombia, Turkish
IOCs:
Url: 5
File: 14
Domain: 3
Registry: 3
Hash: 13
Softs:
pyinstaller, windows defender), office 365, android
Algorithms:
prng, base64, zip
Functions:
GetConsoleWindow, CreateObject
Win API:
ShowWindow, VirtualAlloc, RtlMoveMemory, CreateThread, WaitForSingleObject
Win Services:
WebClient
Languages:
python
Links:
05-01-2023
BlindEagle Targeting Ecuador With Sharpened Tools. HIGHLIGHTS:
https://research.checkpoint.com/2023/blindeagle-targeting-ecuador-with-sharpened-tools
Actors/Campaigns:
Blindeagle (motivation: financially_motivated, cyber_espionage)
Cloudatlas
Threats:
Quasar_rat
Meterpreter_tool
Lotl_technique
Azov
Wannacry
Rubyminer
Adwind_rat
Industry:
Financial, Government
Geo:
Ukraine, Ecuador, America, Russia, Spanish, Belarus, Colombian, Colombia, Turkish
IOCs:
Url: 5
File: 14
Domain: 3
Registry: 3
Hash: 13
Softs:
pyinstaller, windows defender), office 365, android
Algorithms:
prng, base64, zip
Functions:
GetConsoleWindow, CreateObject
Win API:
ShowWindow, VirtualAlloc, RtlMoveMemory, CreateThread, WaitForSingleObject
Win Services:
WebClient
Languages:
python
Links:
https://github.com/rapid7/metasploit-payloads/blob/master/python/meterpreter/meterpreter.pyCheck Point Research
BlindEagle Targeting Ecuador With Sharpened Tools - Check Point Research
Blind Eagle, is a financially motivated threat group that has been launching indiscriminate attacks against citizens of various countries in South America since at least 2018. In a recent campaign targeting Ecuador based organizations, CPR detected a new…
#ParsedReport
05-01-2023
Securonix Threat Labs Monthly Intelligence Insights December
https://www.securonix.com/blog/securonix-threat-labs-monthly-intelligence-insights-december
Actors/Campaigns:
Agrius
Steppy_kavach
Phosphorus
Transparenttribe
Sidecopy
Threats:
Crywiper
Zerobot
Raspberry_robin
Avkiller
Burntcigar_tool
Cuba
Apostle
Fantasy_wiper
Log4shell_vuln
Proxyshell_vuln
Industry:
Telco, Government, Energy, Iot, Financial
Geo:
Israel, Indias, Mexico, Argentina, Iran, Africa, Pakistan, Brazil, France, American, Colombia, Australian, Iranian, Russian, Australia, Indian, India, Emirates, Croatia, Italy
CVEs:
CVE-2022-42475 [Vulners]
Vulners: Score: Unknown, CVSS: 6.2,
Vulners: Exploitation: True
X-Force: Risk: 9.8
X-Force: Patch: Official fix
CVE-2022-33891 [Vulners]
Vulners: Score: Unknown, CVSS: 2.3,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- apache spark (le3.0.3, le3.2.1, le3.1.2)
IOCs:
Path: 1
Command: 1
File: 14
IP: 1
Domain: 1
Softs:
apache spark
Languages:
javascript
05-01-2023
Securonix Threat Labs Monthly Intelligence Insights December
https://www.securonix.com/blog/securonix-threat-labs-monthly-intelligence-insights-december
Actors/Campaigns:
Agrius
Steppy_kavach
Phosphorus
Transparenttribe
Sidecopy
Threats:
Crywiper
Zerobot
Raspberry_robin
Avkiller
Burntcigar_tool
Cuba
Apostle
Fantasy_wiper
Log4shell_vuln
Proxyshell_vuln
Industry:
Telco, Government, Energy, Iot, Financial
Geo:
Israel, Indias, Mexico, Argentina, Iran, Africa, Pakistan, Brazil, France, American, Colombia, Australian, Iranian, Russian, Australia, Indian, India, Emirates, Croatia, Italy
CVEs:
CVE-2022-42475 [Vulners]
Vulners: Score: Unknown, CVSS: 6.2,
Vulners: Exploitation: True
X-Force: Risk: 9.8
X-Force: Patch: Official fix
CVE-2022-33891 [Vulners]
Vulners: Score: Unknown, CVSS: 2.3,
Vulners: Exploitation: Unknown
X-Force: Risk: 9.8
X-Force: Patch: Official fix
Soft:
- apache spark (le3.0.3, le3.2.1, le3.1.2)
IOCs:
Path: 1
Command: 1
File: 14
IP: 1
Domain: 1
Softs:
apache spark
Languages:
javascript
Securonix
Securonix Threat Labs Monthly Intelligence Insights – December
#technique
DNSKeyGen is a Python-based open-source tool designed to facilitate the exchange of command and control (C2) beacon/implant decryption keys through DNS records, including A, AAAA, and TXT records.
https://github.com/mhaskar/DNSKeyGen
DNSKeyGen is a Python-based open-source tool designed to facilitate the exchange of command and control (C2) beacon/implant decryption keys through DNS records, including A, AAAA, and TXT records.
https://github.com/mhaskar/DNSKeyGen
GitHub
GitHub - mhaskar/DNSKeyGen: A tool to exchange decryption keys for command and control (C2) beacons and implants through DNS records.
A tool to exchange decryption keys for command and control (C2) beacons and implants through DNS records. - mhaskar/DNSKeyGen
#technique
pure-python implementation of MemoryModule technique to load a dll entirely from memory
https://github.com/naksyn/PythonMemoryModule
pure-python implementation of MemoryModule technique to load a dll entirely from memory
https://github.com/naksyn/PythonMemoryModule
GitHub
GitHub - naksyn/PythonMemoryModule: pure-python implementation of MemoryModule technique to load dll and unmanaged exe entirely…
pure-python implementation of MemoryModule technique to load dll and unmanaged exe entirely from memory - naksyn/PythonMemoryModule
#technique
Alcatraz is a x64 binary obfuscator that is able to obfuscate various different pe files including:
https://github.com/weak1337/Alcatraz
Alcatraz is a x64 binary obfuscator that is able to obfuscate various different pe files including:
https://github.com/weak1337/Alcatraz
GitHub
GitHub - weak1337/Alcatraz: x64 binary obfuscator
x64 binary obfuscator. Contribute to weak1337/Alcatraz development by creating an account on GitHub.
Нужны ли на этом канале ссылки на инструментарий: тулы, обфускаторы и т.д (тег #technique)?
Final Results
77%
Да
18%
Нет
5%
Посмотреть ответы