A buggy behavior located into CreateFile allows to hide malware from users and AV scanners. Microsoft will not fix it:
https://github.com/dalvarezperez/CreateFile_based_rootkit
#CreateFile #malware #rootkit #antivirus
ℹ️ Sent from one of our members
🎖@malwr
https://github.com/dalvarezperez/CreateFile_based_rootkit
#CreateFile #malware #rootkit #antivirus
ℹ️ Sent from one of our members
🎖@malwr
GitHub
GitHub - dalvarezperez/CreateFile_based_rootkit
Contribute to dalvarezperez/CreateFile_based_rootkit development by creating an account on GitHub.
Windows Process Injection: EM_GETHANDLE, WM_PASTE and EM_SETWORDBREAKPROC
🗣digicat
Can i have the name or twitter handle of the owner of this blog they do an amazing job
👤hilo25
https://twitter.com/modexpblog
👤digicat
🎖@malwr
🗣digicat
Can i have the name or twitter handle of the owner of this blog they do an amazing job
👤hilo25
https://twitter.com/modexpblog
👤digicat
🎖@malwr
modexp
Windows Process Injection: EM_GETHANDLE, WM_PASTE and EM_SETWORDBREAKPROC
Introduction Edit Controls Writing CP-1252 Compatible Code Initialization Set RAX to 0 Set RAX to 1 Set RAX to -1 Load and Store Data Two Byte Instructions Prefix Codes Generating Shellcode Injecti…
Fuzzing sockets in Teeworlds game
🗣logicaltrust-net
Never thought I'd see teeworlds here lol
👤MegaManSec2
🎖@malwr
🗣logicaltrust-net
Never thought I'd see teeworlds here lol
👤MegaManSec2
🎖@malwr
Security Audits, Penetration Tests - LogicalTrust
LogicalTrust - [EN] A-Z: Introducing SocketInjectingFuzzer and its first target - Teeworlds
The idea behind Socket Injecting Fuzzer is simple - fuzz applications working in the client-server architecture by mutating real data packets that are exchanged by them in real usage scenarios. Implementation is also simple because it is based on hooking…
[PDF ThaiCERT publishes "Threat Group Cards: A Threat Actor Encyclopedia" version 2.0 - Added 115 threat groups and many other updates - portal coming soon](https://www.dropbox.com/s/ds0ra0c8odwsv3m/Threat%20Group%20Cards.pdf?dl=0)
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Dropbox
Threat Group Cards.pdf
Shared with Dropbox
An offensive guide to the Authorization Code grant - Comprehensive and digestible enumeration of security concerns in the OAuth 2.0 Authorization Code flow
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
NCC Group Research Blog
An offensive guide to the Authorization Code grant
OAuth is the widely used standard for access delegation, enabling many of the “Sign in with X” buttons and “Connect your Calendar” features of modern Internet software. OAut…
Microsoft launches free Memory Forensics and Rootkit Detection service for Linux systems
🗣dreamygeek
Perhaps read the official blog post before you all get your pitch forks out over the free service thats intended to make hard to find, in memory malware incredibly expensive to keep using for attackers without risk of exposure.
"Project Freta was designed and built with survivor bias at its core."
God forbid microsoft and their academic researchers do a good thing here and get any credit.
Yeesh 🙄
https://www.microsoft.com/en-us/research/blog/toward-trusted-sensing-for-the-cloud-introducing-project-freta/
👤jdwashere
Soooo... Volatility in the cloud?
👤YXZs
mmm... a rootkit that detects rootkits
👤skyl4nk
🎖@malwr
🗣dreamygeek
Perhaps read the official blog post before you all get your pitch forks out over the free service thats intended to make hard to find, in memory malware incredibly expensive to keep using for attackers without risk of exposure.
"Project Freta was designed and built with survivor bias at its core."
God forbid microsoft and their academic researchers do a good thing here and get any credit.
Yeesh 🙄
https://www.microsoft.com/en-us/research/blog/toward-trusted-sensing-for-the-cloud-introducing-project-freta/
👤jdwashere
Soooo... Volatility in the cloud?
👤YXZs
mmm... a rootkit that detects rootkits
👤skyl4nk
🎖@malwr
HelpMeGeek
Microsoft has launched a Free Memory Forensics and Rootkit Detection Service for Linux - HelpMeGeek
Microsoft has just launched a Free online service Project Freta aimed to discover forensic evidence on Linux systems. With this service you will be able to dig up hard-to-find rootkits and malware. The project is named after the Birthplace of Marie Curie…
AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations
🗣DllEntryPoint
🎖@malwr
🗣DllEntryPoint
🎖@malwr
Unit 42
AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations
A new advanced malware, dubbed AcidBox, was discovered being used by an unknown threat actor against Russian organizations in 2017.
ThiefQuest Ransomware detects VM (possibly)
Set up a Mac VM on VMWare, tried running the ThiefQuest Ransomware. On the Activity Monitor, I Force Quit vmware-tools-daemon, hoping it won't detect it as a VM. But I guess I'm wrong. It's either the samples I've gotten are wrong, or the malware detects a VM.
https://preview.redd.it/qjsk2yyu0h951.png?width=1910&format=png&auto=webp&s=e5d5186bee11b35fdc5eaa1d7c06d577c4a3da32
🗣LMJR500Army
It can still detect that it's in a VM even without the vmware-tools-daemon running. Common methods in this VMware kb article.
There are plenty of other anti-forensic methods for detecting a VM as well. Sometimes you need to be as tricky as the creators to get the malware to actually run when you are trying to examine it.
👤TheDarthSnarf
🎖@malwr
Set up a Mac VM on VMWare, tried running the ThiefQuest Ransomware. On the Activity Monitor, I Force Quit vmware-tools-daemon, hoping it won't detect it as a VM. But I guess I'm wrong. It's either the samples I've gotten are wrong, or the malware detects a VM.
https://preview.redd.it/qjsk2yyu0h951.png?width=1910&format=png&auto=webp&s=e5d5186bee11b35fdc5eaa1d7c06d577c4a3da32
🗣LMJR500Army
It can still detect that it's in a VM even without the vmware-tools-daemon running. Common methods in this VMware kb article.
There are plenty of other anti-forensic methods for detecting a VM as well. Sometimes you need to be as tricky as the creators to get the malware to actually run when you are trying to examine it.
👤TheDarthSnarf
🎖@malwr
Digital forensics specialist's bookshelf: Top 11 books on digital forensics, incident response, and malware analysis
https://www.group-ib.com/blog/bookshelf
https://preview.redd.it/2bjsvygjyg951.png?width=1023&format=png&auto=webp&s=02c1aac3787d8620c8d8d0709c0c641bc035f27f
🗣Igor_Mikhaylov
Is rootkits and bootkits an updated sequel to practical malware analysis or a specialized deep dive?
👤QuietForensics
I would add Applied Incident Response
https://www.amazon.com/Applied-Incident-Response-Steve-Anson/dp/1119560268
👤sidi7
I don’t think #2 is with 508 anymore
👤bigt252002
🎖@malwr
https://www.group-ib.com/blog/bookshelf
https://preview.redd.it/2bjsvygjyg951.png?width=1023&format=png&auto=webp&s=02c1aac3787d8620c8d8d0709c0c641bc035f27f
🗣Igor_Mikhaylov
Is rootkits and bootkits an updated sequel to practical malware analysis or a specialized deep dive?
👤QuietForensics
I would add Applied Incident Response
https://www.amazon.com/Applied-Incident-Response-Steve-Anson/dp/1119560268
👤sidi7
I don’t think #2 is with 508 anymore
👤bigt252002
🎖@malwr
SpoolSystem is a CNA script for Cobalt Strike which uses the Print Spooler named pipe impersonation trick to gain SYSTEM privileges.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
nccfsas/Tools/spoolsystem at main · nccgroup/nccfsas
Information released publicly by NCC Group's Full Spectrum Attack Simulation (FSAS) team. - nccgroup/nccfsas
Analysis of EventBot: Android banking Trojan. There is available patched EventBot payload that displays debug logs while being executed on device to helps understand its malicious functionality
🗣barakadua131
🎖@malwr
🗣barakadua131
🎖@malwr
YouTube
Dynamic analysis of patched EventBot allows us read its detailed debug logs while running | Trojan
Malware analysis of Android banking Trojan - EventBot
Its encrypted payload has lots of detailed debug logs for almost every executed functionality, however not activated.
So, I patched encrypted payload. It should help malware analyst to understand how…
Its encrypted payload has lots of detailed debug logs for almost every executed functionality, however not activated.
So, I patched encrypted payload. It should help malware analyst to understand how…