Microsoft launches free Memory Forensics and Rootkit Detection service for Linux systems
🗣dreamygeek

Perhaps read the official blog post before you all get your pitch forks out over the free service thats intended to make hard to find, in memory malware incredibly expensive to keep using for attackers without risk of exposure.

"Project Freta was designed and built with survivor bias at its core."

God forbid microsoft and their academic researchers do a good thing here and get any credit.

Yeesh 🙄

https://www.microsoft.com/en-us/research/blog/toward-trusted-sensing-for-the-cloud-introducing-project-freta/
👤jdwashere

Soooo... Volatility in the cloud?
👤YXZs

mmm... a rootkit that detects rootkits
👤skyl4nk


🎖@malwr

ThiefQuest Ransomware detects VM (possibly)
Set up a Mac VM on VMWare, tried running the ThiefQuest Ransomware. On the Activity Monitor, I Force Quit vmware-tools-daemon, hoping it won't detect it as a VM. But I guess I'm wrong. It's either the samples I've gotten are wrong, or the malware detects a VM.

https://preview.redd.it/qjsk2yyu0h951.png?width=1910&format=png&auto=webp&s=e5d5186bee11b35fdc5eaa1d7c06d577c4a3da32
🗣LMJR500Army

It can still detect that it's in a VM even without the vmware-tools-daemon running. Common methods in this VMware kb article.

There are plenty of other anti-forensic methods for detecting a VM as well. Sometimes you need to be as tricky as the creators to get the malware to actually run when you are trying to examine it.
👤TheDarthSnarf


🎖@malwr

Reversing DexGuard, Part 2 – Assets and Code Encryption
🗣rijoultj

Part 1⃣: https://www.pnfsoftware.com/blog/reversing-dexguard/

🎖@malwr

Digital forensics specialist's bookshelf: Top 11 books on digital forensics, incident response, and malware analysis
https://www.group-ib.com/blog/bookshelf

https://preview.redd.it/2bjsvygjyg951.png?width=1023&format=png&auto=webp&s=02c1aac3787d8620c8d8d0709c0c641bc035f27f
🗣Igor_Mikhaylov

Is rootkits and bootkits an updated sequel to practical malware analysis or a specialized deep dive?
👤QuietForensics

I would add Applied Incident Response
https://www.amazon.com/Applied-Incident-Response-Steve-Anson/dp/1119560268
👤sidi7

I don’t think #2 is with 508 anymore
👤bigt252002


🎖@malwr

Handheld Computer/Controller
🗣0ne-autumn-leaf

THE HACKPAD
👤Savvasun

Terminator 2. ATM scene. My favorite.
👤eltoro3333

Sick
👤cosmicleanie


🎖@malwr

New network security scanner tool released by Google!
🗣frrossty

So, will all my vulnerabilities and weak creds be available on the Google, nicely indexed, after using it?
👤ptzxc68

I'm surprised a new tool was written in Java. I definitely would have expected Go instead of Java for a new security tool from Google.
👤abluedinosaur

this only checks for four known admin panels and weak creds.

great idea, but it needs ways more plugins to be useful
👤Snoo-92683


🎖@malwr

CVE-2020-1300: Remote code execution via Windows CAB files
🗣RedmondSecGnome

tldr; windows allows two different directory separators (/ and \\). By using one of them, you could bypass the directory traversal check. By abusing this with CAB files you get an arbitrary file write as system.
👤mdulin2


🎖@malwr

Best solution for unpacking most of the packed samples in a large dataset of malware statically
I have a large dataset of malware samples that are packed with variety of packers, and i need to unpack as many as possible (I want to build a machine learning model and this is my dataset)

i guess one way of unpacking the packed samples is first detecting the packer with the help of Peid or die with scripting and then call the appropriate unpacker like UPX, Aspack, ... unpackers

but the problem is the list of packers is too large and there are so many different unpackers and such


so what is the best solution to this? if you had a large dataset of malware how would you go about of unpacking the most possible (obviously we can't unpack all of them, but the more the better)

any open source project for this problem or any other solution?

and I also obviously don't care about samples that are packed with a custom packer/crypter since i doubt there is any easy static solution to that.
🗣BitDrill

I’d suggest checking out https://www.unpac.me/
👤jershmagersh


🎖@malwr