Ubisoft send 2FA recovery code by email
🗣-d4v3-

Once someone has access to your email they can take away the 2FA anyways. So it's not really weird or smth
👤Axua247


🎖@malwr

Emotet file hashes, Compromised IP addresses and domains, and malicious powershell artifacts
While collecting malware samples on pastebin, my bot found an anonymous paste that contained a large amount of data relating to emotet.

It includes a section of file hashes, malicious IP addresses, compromised servers, compromised domains, and a few obfuscated powershell artifacts that look to either be post-exploitation or an alternative infection method.

File samples can be collected by simply using wget on a live compromised domain.


Here is a link to a reupload of the document:
https://pastebin.com/V6GGEPVA
🗣NovateI


🎖@malwr

Fake Company, Real Threats: Logs From a Smart Factory Honeypot - Security News
🗣_TM_dude

The most interesting part of this piece was the layout they used on their website to show the story.

It looks like it was running for several months, but didn't produce any revealing information. A few non-technical ransomware attacks. Simple stuff caused by poor security, which, I get it, it was mainly to show how weak security is a main point of entry. Not exactly revolutionary.
👤DegenerateJC

Disappointed. I wish the guy came from real APT group doing more sophisticated or unknown exploits. No PLC system were harmed or attempted.
👤thanoscsgo

I like the guy who acted like he was installing ransomware then renamed their files instead.
👤steezefries


🎖@malwr

Problems with cracking a program with OllyDBG ( debugging )
Basically it's a game bot that used to be free to many players and now the owner of this bot ( who didn't even make this bot 100% himself ) made it VIP version and demands 20 bucks from everyone. I don't wanna pay for it and my new project is to crack it free.

So when i open the injector ( bot ) it opens a CMD and does some codes, 2 seconds later the CMD is gone and the bot launches. This was in the free version.. now after CMD vanishes, it opens a small window that says '' VIP IS REQUIRED '' and also opens a small image called '' splash screen '' and the image has a text '' VIP required '' at the same time it opens my google chrome and takes me to the '' VIP '' website.

How can i crack this? I've tried watching some videos about OllyDBG and changing the memory, but i can't find the memory for those things at all.

There are 3 DLL files ( 1 main DLL ) and the injector of course, what should i do? Are there easier ways to pass this than debugging?

EDIT: i've tried searching for certain texts in OllyDBG such as '' VIP '', '' free '', '' VIP is required '' and other stuff.. no luck. I have no idea how to find a memory to change or remove that '' VIP '' sign lol

EDIT 2: I tried opening the DLL file with '' JetBrains '' and copy the whole botting scripts and make my own bot but i couldn't find any scripts on the DLL files and it was full of codes, too complex :D.. even though the script on this small video game is pretty small lol
🗣BalkanRay

RE (reverse engineering) took me about seven years in IT and net sec to get into.

Between day zero year 1, and day 365 year 7 I...

- learned to write C
- learned to read / bang around assembly
- picked up OS and CPU specific knowledge
- learned many programming concepts
- several crash courses on RE
- 100s of hours with true wizards at this
- attended dozens of hack-a-thons
- finally ended up knowing several debugging tools enough when to use others.

Yes there is a 5 year old kid who likely blasts us all out of the park some where.

My point is, you need to try applying some staged learning here.

Crawl, walk, then run.

My first suggestion is to start getting a few methods of extracting strings and comments from the file.
👤eggumlaut


🎖@malwr