Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Digital Forensics Tool: Lupo – Malware IOC Extractor
Digital Forensics Tool: Lupo – Malware IOC ExtractorPost Views: 3
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes GitHub Link IntroductionWorking on security incidents that involve malware, we come across situations on a regular basis where we feel the need to automate parts of the analysis process as complete manual analysis is, more often than not, not possible for every case due to many factors (time, skills, scale etc.). Choosing the right Digital Forensics tools and adding them to your arsenal, getting to use and train with them is key, towards spending time working with reading code, reverse engineering, especially when it has to do with Malware.
Lupo (Debugging module for Malware Analysis Automation) written by malienist, mainly is a tool to automate and accelerate the process as much as possible. It is a dynamic analysis tool that can be used as a module with the debugger. The first version works with the popular Windows Debugger — WinDbg.
The way the tool works is pretty straight forward. You load Lupo into the debugger and then execute it. It runs through the malware and collects predefined IOC and writes them to a text file on the disk. You can then use this information to contain and neutralize malware campaigns or simply respond to the security incident that you are working on.
The tool is written in C++ and uses the Windows Debugging framework to execute the code. It can be used with WinDbg as a ‘plugin’ in order to help automate the analysis process.
See Also: Offensive Security Tool: Mobile Security Framework (MobSF) UsageUsing the tool is very easy. It works in this way:
Save the Lupo extension in your extensions dir (default: sdk\samples\exts subdirectory of the installation directory). You can also define the extensions path by using the command ‘.extpath[+] [Directory[;…]]’.
Start the debugger
Attach the process to be debugged (malware in this case)
Load Lupo using the ‘.load’ command.
Execute Lupo by using this command: ‘lupo.go’
All results will be displayed in the console and also written to a new text file on the disk. Path and name of this text file will be displayed in console as well. All done!
You can optionally use the results from Lupo with this other tool that the creator wrote — Ragno, to advance your research and response by aggregating OSINT for the wider footprint of the campaign you are possibly dealing with. You can read about Ragno in another post here
For a step by step post on how to use Lupo, with images and instructions, you can see this post
See Also: Write up: Detect malicious hacker activities on endpoints https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Mobile-Security-Framework-MobSF-90x90.png Offensive Security Tool: Mobile Security Framework (MobSF)20 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/metabigor-90x90.png OSINT Tool: Metabigor7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Domain-Analyzer-90x90.png Recon Tool: Domain Analyzer2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/deepsleep-90x90.png Offensive Security Tool: DeepSleep3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/qsreplace-90x90.png Recon Tool: qsreplace3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Arjun-90x90.png Offensive Security Tool: Arjun4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/[...]
Digital Forensics Tool: Lupo – Malware IOC Extractor
Digital Forensics Tool: Lupo – Malware IOC ExtractorPost Views: 3
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes GitHub Link IntroductionWorking on security incidents that involve malware, we come across situations on a regular basis where we feel the need to automate parts of the analysis process as complete manual analysis is, more often than not, not possible for every case due to many factors (time, skills, scale etc.). Choosing the right Digital Forensics tools and adding them to your arsenal, getting to use and train with them is key, towards spending time working with reading code, reverse engineering, especially when it has to do with Malware.
Lupo (Debugging module for Malware Analysis Automation) written by malienist, mainly is a tool to automate and accelerate the process as much as possible. It is a dynamic analysis tool that can be used as a module with the debugger. The first version works with the popular Windows Debugger — WinDbg.
The way the tool works is pretty straight forward. You load Lupo into the debugger and then execute it. It runs through the malware and collects predefined IOC and writes them to a text file on the disk. You can then use this information to contain and neutralize malware campaigns or simply respond to the security incident that you are working on.
The tool is written in C++ and uses the Windows Debugging framework to execute the code. It can be used with WinDbg as a ‘plugin’ in order to help automate the analysis process.
See Also: Offensive Security Tool: Mobile Security Framework (MobSF) UsageUsing the tool is very easy. It works in this way:
Save the Lupo extension in your extensions dir (default: sdk\samples\exts subdirectory of the installation directory). You can also define the extensions path by using the command ‘.extpath[+] [Directory[;…]]’.
Start the debugger
Attach the process to be debugged (malware in this case)
Load Lupo using the ‘.load’ command.
Execute Lupo by using this command: ‘lupo.go’
All results will be displayed in the console and also written to a new text file on the disk. Path and name of this text file will be displayed in console as well. All done!
You can optionally use the results from Lupo with this other tool that the creator wrote — Ragno, to advance your research and response by aggregating OSINT for the wider footprint of the campaign you are possibly dealing with. You can read about Ragno in another post here
For a step by step post on how to use Lupo, with images and instructions, you can see this post
See Also: Write up: Detect malicious hacker activities on endpoints https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Mobile-Security-Framework-MobSF-90x90.png Offensive Security Tool: Mobile Security Framework (MobSF)20 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/metabigor-90x90.png OSINT Tool: Metabigor7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Domain-Analyzer-90x90.png Recon Tool: Domain Analyzer2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/deepsleep-90x90.png Offensive Security Tool: DeepSleep3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/qsreplace-90x90.png Recon Tool: qsreplace3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Arjun-90x90.png Offensive Security Tool: Arjun4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking New MaliBot Android banking malware spreads as a crypto miner New MaliBot Android banking malware spreads as a crypto minerPost Views: 16 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon…
iBot, like the detection of emulated environments that could be used to evade analysis.
This is a sign that the development is very active, and new versions of MaliBot are expected to enter circulation soon, possibly raising the potency of the novel malware.
For now, MaliBot loads overlays that target Italian and Spanish banks, but it could expand its scope soon by adding more injections, just like FluBot gradually did.
https://www.bleepstatic.com/images/news/u/1220909/Android%20malware/caixa-bank.png
<figcaptionSpanish bank overlay used by MaliBot (F5 Labs)
See Also: Recon Tool: Domain Analyzer Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
At the time of writing this, the websites distributing MaliBot remain online, so the malware distribution operation is still pretty much active.
See Also: The Difference between Vulnerability Assessment and Pentesting
Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Cisco_Systems_Bug-90x90.jpg Cisco Secure Email bug can let attackers bypass authentication1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android-malware-90x90.jpg Android malware on the Google Play Store gets 2 million downloads2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Linux-90x90.jpg New Linux rootkit, Syslogk uses magic packets to trigger backdoor3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Header-Python-Packages-Blog-Final-Image-90x90.jpg PyPI package ‘keep’ mistakenly included a password stealer4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/venom_superhero_movie_tom11_hardy-wallpaper-1920x1080-980x551-1-90x90.jpg This new Linux malware is ‘almost impossible’ to detect7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ran-download-33-1-e1639685560151-90x90.jpeg Black Basta Ransomware Teams Up with Malware Stalwart Qbot1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/InstallerFileTakeOver-Zero-Day-Security-Vulnerability-All-Windows-OS-Versions-90x90.jpg New ‘DogWalk’ Windows zero-day bug gets free unofficial patches1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ipad_update_1200x675-90x90.jpg Security Fixes Won’t Require Full iOS Update in iOS 16, Will Be Installed Automatically1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Confluence-90x90.jpg Exploit released for Atlassian Confluence RCE bug, update now2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/be60-article-210907-confluence-body-text-90x90.png Critical Atlassian Confluence zero-day actively used in attacks2 weeks ago
The post New MaliBot Android banking malware spreads as a crypto miner first appeared on Black Hat Ethical Hacking.
This is a sign that the development is very active, and new versions of MaliBot are expected to enter circulation soon, possibly raising the potency of the novel malware.
For now, MaliBot loads overlays that target Italian and Spanish banks, but it could expand its scope soon by adding more injections, just like FluBot gradually did.
https://www.bleepstatic.com/images/news/u/1220909/Android%20malware/caixa-bank.png
<figcaptionSpanish bank overlay used by MaliBot (F5 Labs)
See Also: Recon Tool: Domain Analyzer Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
At the time of writing this, the websites distributing MaliBot remain online, so the malware distribution operation is still pretty much active.
See Also: The Difference between Vulnerability Assessment and Pentesting
Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Cisco_Systems_Bug-90x90.jpg Cisco Secure Email bug can let attackers bypass authentication1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/android-malware-90x90.jpg Android malware on the Google Play Store gets 2 million downloads2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Linux-90x90.jpg New Linux rootkit, Syslogk uses magic packets to trigger backdoor3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Header-Python-Packages-Blog-Final-Image-90x90.jpg PyPI package ‘keep’ mistakenly included a password stealer4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/venom_superhero_movie_tom11_hardy-wallpaper-1920x1080-980x551-1-90x90.jpg This new Linux malware is ‘almost impossible’ to detect7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ran-download-33-1-e1639685560151-90x90.jpeg Black Basta Ransomware Teams Up with Malware Stalwart Qbot1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/InstallerFileTakeOver-Zero-Day-Security-Vulnerability-All-Windows-OS-Versions-90x90.jpg New ‘DogWalk’ Windows zero-day bug gets free unofficial patches1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/ipad_update_1200x675-90x90.jpg Security Fixes Won’t Require Full iOS Update in iOS 16, Will Be Installed Automatically1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/Confluence-90x90.jpg Exploit released for Atlassian Confluence RCE bug, update now2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/be60-article-210907-confluence-body-text-90x90.png Critical Atlassian Confluence zero-day actively used in attacks2 weeks ago
The post New MaliBot Android banking malware spreads as a crypto miner first appeared on Black Hat Ethical Hacking.
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Digital Forensics Tool: Lupo – Malware IOC Extractor Digital Forensics Tool: Lupo – Malware IOC ExtractorPost Views: 3 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Patreon.png Subscribe to Patreon…
05/Dorks-collections-list-90x90.png Recon Tool: Dorks collections list4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/malicious-pdf-90x90.png Offensive Security Tool: malicious-pdf1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/scanmycode-90x90.png Static Code Analysis Tool: scanmycode-ce1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/MOSINT-1-90x90.png OSINT Tool: MOSINT2 months ago
The post Digital Forensics Tool: Lupo – Malware IOC Extractor first appeared on Black Hat Ethical Hacking.
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/malicious-pdf-90x90.png Offensive Security Tool: malicious-pdf1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/scanmycode-90x90.png Static Code Analysis Tool: scanmycode-ce1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/MOSINT-1-90x90.png OSINT Tool: MOSINT2 months ago
The post Digital Forensics Tool: Lupo – Malware IOC Extractor first appeared on Black Hat Ethical Hacking.
Exploiting File Upload Vulnerability through different techniques
Hay frienss Assalom O lakum, I am Masaud Ahmad and today I am going to share with you various techniques to exploit file upload…Continue reading on Medium »
Read more...
Hay frienss Assalom O lakum, I am Masaud Ahmad and today I am going to share with you various techniques to exploit file upload…Continue reading on Medium »
Read more...
Exploiting File Upload Vulnerability through different techniques
https://medium.com/@Eagle.PakhtUn1337/exploiting-file-upload-vulnerability-through-different-techniques-b3cfe7a4c7c2?source=rss------bug_bounty-5
https://medium.com/@Eagle.PakhtUn1337/exploiting-file-upload-vulnerability-through-different-techniques-b3cfe7a4c7c2?source=rss------bug_bounty-5
Hay frienss Assalom O lakum, I am Masaud Ahmad and today I am going to share with you various techniques to exploit file upload…Continue reading on Medium » (https://medium.com/@Eagle.PakhtUn1337/exploiting-file-upload-vulnerability-through-different-techniques-b3cfe7a4c7c2?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
What is an ASA firewall? How to configure Adaptive Security Appliance?
https://cdn-images-1.medium.com/max/600/1*p0T8BYOLLVDlD3a3afqOBw.jpeg
The firewall is a barrier between LAN and WAN networks (trusted and untrusted networks), we configure the firewall in the forwarding path…
Continue reading on Medium »
What is an ASA firewall? How to configure Adaptive Security Appliance?
https://cdn-images-1.medium.com/max/600/1*p0T8BYOLLVDlD3a3afqOBw.jpeg
The firewall is a barrier between LAN and WAN networks (trusted and untrusted networks), we configure the firewall in the forwarding path…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
What is Drive-By Attack Virus?
https://cdn-images-1.medium.com/max/2600/1*CABHxpgY1e4UoQ_H91fsJg.jpeg
A drive-by attack, also called a drive-by download attack, occurs when a malicious script downloads and instals a program on a user’s…
Continue reading on Medium »
What is Drive-By Attack Virus?
https://cdn-images-1.medium.com/max/2600/1*CABHxpgY1e4UoQ_H91fsJg.jpeg
A drive-by attack, also called a drive-by download attack, occurs when a malicious script downloads and instals a program on a user’s…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
What is Form-Grabbing Malware?
https://cdn-images-1.medium.com/max/2600/1*PY9nByRuVnhXsCvYeiZ9LQ.jpeg
In order to get access to personal information, Form Grabbing Malware (Form-Grabbers) are used. The data they “collect” from browser forms…
Continue reading on Medium »
What is Form-Grabbing Malware?
https://cdn-images-1.medium.com/max/2600/1*PY9nByRuVnhXsCvYeiZ9LQ.jpeg
In order to get access to personal information, Form Grabbing Malware (Form-Grabbers) are used. The data they “collect” from browser forms…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Write-up: DOM-based cookie manipulation @ PortSwigger Academy
https://cdn-images-1.medium.com/max/843/0*s6tSYy-8AzetzRzg.png
This write-up for the lab DOM-based cookie manipulation is part of my walk-through series for PortSwigger’s Web Security Academy.
Continue reading on System Weakness »
Write-up: DOM-based cookie manipulation @ PortSwigger Academy
https://cdn-images-1.medium.com/max/843/0*s6tSYy-8AzetzRzg.png
This write-up for the lab DOM-based cookie manipulation is part of my walk-through series for PortSwigger’s Web Security Academy.
Continue reading on System Weakness »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How To Know If Your Site Has Been Hacked
Site security is an important consideration when developing your Website. In the digital age, websites have become centers of information…
Continue reading on Medium »
How To Know If Your Site Has Been Hacked
Site security is an important consideration when developing your Website. In the digital age, websites have become centers of information…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Best way to uninstall Microsoft Edge from Win 10
https://cdn-images-1.medium.com/max/740/0*lsPRYFb4P8NCttFH
If you are trying to figure out how to remove Microsoft Edge from Windows 10, rest assured, you are not alone. While it’s a pretty decent…
Continue reading on Medium »
Best way to uninstall Microsoft Edge from Win 10
https://cdn-images-1.medium.com/max/740/0*lsPRYFb4P8NCttFH
If you are trying to figure out how to remove Microsoft Edge from Windows 10, rest assured, you are not alone. While it’s a pretty decent…
Continue reading on Medium »