Malware News – Telegram

Malware News

15K subscribers

1.63K photos

7 videos

130 files

7.96K links

The latest NEWS about malwares, DFIR, hacking, security issues, thoughts and ...

Partner channel: @cveNotify

For ads: https://telega.io/c/malwr

Download Telegram

About

Blog

Apps

Platform

15K subscribers

How to unpack Chinoxy backdoor and decipher the configuration of the backdoor
🗣digicat

🎖@malwr

How to unpack Chinoxy backdoor and decipher the configuration of the backdoor

In my last article on Chinoxy backdoor, this version has its configuration in a resource called NNKK and it is deciphered. The purpose of…

80 views08:44

Deep Dive Into the M00nD3V Logger
🗣digicat

🎖@malwr

Deep Dive Into the M00nD3V Logger

M00nD3V is a multifunctional information-stealing trojan that has gained popularity on hacker forums.

80 views08:46

The Domain Generation Algorithm of BazarBackdoor - A DGA based on the Emercoin TLD .bazar
🗣digicat

🎖@malwr

Johannes Bader's Blog

The Domain Generation Algorithm of BazarLoader - A DGA based on the Emercoin TLD .bazar

BazarBackdoor is a module of the dreaded TrickBot Trojan. It is mostly used to gain a foothold in compromised enterprise networks.

87 views08:46

New Mirai Variant Expands Arsenal, Exploits CVE-2020-10173
🗣digicat

🎖@malwr

New Mirai Variant Expands, Exploits CVE-2020-1017

We discovered a new Mirai variant that exploits nine vulnerabilities, most notable of which is CVE-2020-10173 in Comtrend VR-3033 routers which we have not observed exploited by past Mirai variants.

92 views08:46

An Update for a Very Active DDos Botnet: Moobot
🗣digicat

🎖@malwr

360 Netlab Blog - Network Security Research Lab at 360

An Update for a Very Active DDos Botnet: Moobot

Moobot is a mirai based botnet. Spread through weak telnet passwords and some nday and 0day vulnerabilities.

92 views08:47

The new Bigviktor Botnet is Targeting DrayTek Vigor Router
🗣digicat

🎖@malwr

360 Netlab Blog - Network Security Research Lab at 360

The new Bigviktor Botnet is Targeting DrayTek Vigor Router

Overview

On June 17, 2020, 360Netlab Threat Detecting System flagged an interesting ELF sample (dd7c9d99d8f7b9975c29c803abdf1c33), further analysis shows that this is a DDos Bot program that propagates through the CVE-2020-8515 vulnerability which targets…

97 views08:47

More evil: A deep look at Evilnum and its toolset | WeLiveSecurity
🗣digicat

🎖@malwr

More evil: A deep look at Evilnum and its toolset

ESET research gives a detailed picture of the operations of Evilnum and its toolkit used in attacks against carefully chosen targets in the fintech sector.

105 views08:47

Writing YARA rules for Livehunt on VirusTotal
🗣digicat

🎖@malwr

126 views08:47

Impacket usage & detection
🗣digicat

🎖@malwr

neil-fox.github.io

Impacket usage & detection

Impacket is a collection of Python scripts that can be used by an attacker to target Windows network protocols. This tool can be used to enumerate users, capture hashes, move laterally and escalate privileges. Impacket has also been used by APT groups, in…

142 views08:50

I made an Awesome Security Tool List! 😆 A collection of common tools & useful commands for hacking 💪😎 (updates regularly)
🗣tina1998612

🎖@malwr

GitHub - tina1998612/Awesome-Security-Tool-List: This is a list of security tools that I have used or recommend. Welcome any contributions!

This is a list of security tools that I have used or recommend. Welcome any contributions! - tina1998612/Awesome-Security-Tool-List

130 views06:50

Grenam.exe Malware analysis paper
🗣dkaye_mal_anst18

Just curious, why the background cannot be full white paper?
👤Ali_Alnuaimi

🎖@malwr

Grenam_analysis_paper.pdf

Shared with Dropbox

136 views06:53

Cobalt Strike stagers used by FIN6 :: MWLab — Ladislav's Malware Lab
🗣digicat

🎖@malwr

Cobalt Strike stagers used by FIN6

Cobalt Strike stagers used by FIN6 :: MWLab — Ladislav's Malware Lab

In June, LIFARS team worked on engagement related to FIN6 threat actor. FIN6 group was also detected and described in April and May, by various other forensics firms, including SentinelOne and FireEye Managed Defense (Mandiant), which described intrusion…

130 views06:55

Operation ‘Honey Trap’: APT36 Targets Defense Organizations in India
🗣digicat

🎖@malwr

Blogs on Information Technology, Network & Cybersecurity | Seqrite

Operation ‘Honey Trap’: APT36 Targets Defence Organizations in India

<p>Summary In the last 3 months, we have noticed increased activity from APT36, a Pakistan-linked Cyber Threat actor. The target this time are personnel belonging to defence organizations & other Government organizations in India. In the recent wave of attacks…

158 views06:55

Bypassing AV (Windows Defender) … Cat vs. Mouse — CyberGuider Information Technology Services Inc.
🗣bm11100

🎖@malwr

CYBERGUIDER IT SERVICES INC.

Bypassing AV (Windows Defender)

Dont rely on AntiVirus (AV) as your security conrnerstone. Bypassing AV (Windows Defender) is still as trivial as ever ... Part II.

170 views06:56

Malware News pinned «📍Please invite experts to the channel📍»

13:55

How To Sinkhole A Botnet
🗣herrcore

Dude just finished watching it minutes ago after it popped up in my YouTube notification 🔔

Very informative and recommended watch 📺 👌
👤AchwaqKhalid

🎖@malwr

IRC Botnet Reverse Engineering Part 3 - How To Sinkhole A Botnet

This is the final part or our in-depth malware reverse engineering series analyzing an IRC worm from 2010. In this part we perform a final high level analysis of the malware then then use our analysis to build a sinkhole for the botnet!

-----
OALABS DISCORD…

148 views14:17

What is External Insecure Data Storage?
🗣Travisliska

🎖@malwr

Exploiting External Insecure Data Storage?

Files created on external storage, such as SD Cards, are globally readable and writable. Because external storage can be removed by the user and also modified by any application, you should not store sensitive information using external storage.
As with data…

123 views14:19

Introducing Winbindex - the Windows Binaries Index
🗣m417z

I love this for the level of detail and effort taken to find the file. you make me look like a help desk novice.
👤NoFaithInThisSub

Is it WinBinDex or WinBindEx? Bike shedding!
👤immibis

🎖@malwr

Introducing Winbindex - the Windows Binaries Index

I indexed all Windows files which appear in Windows update packages, and created a website which allows to quickly view information about the files and download some of them from Microsoft servers. The files that can be downloaded are executable files (currently…

106 views14:22

Monitoring with PowerShell: Monitoring Onedrive client limitations
Hi guys!

So my older blog about monitoring the Onedrive sync status was pretty well received, and I figured that this new blog might just help with a missing piece of the puzzle for some of your: https://www.cyberdrain.com/monitoring-with-powershell-monitoring-the-onedrive-client-limitations/

The Onedrive client tends to get some performance issues when syncing more than 300k objects(files and folders) and more often than not it takes some time to figure out where the issue is coming from. This monitoring set should work to tackle that for you.

Hope it helps, and if there's any questions, let me know!
🗣Lime-TeGek

🎖@malwr

Monitoring with PowerShell: Monitoring the Onedrive client limitations

This is meta description

99 views14:26

WebView - Android's most convenient footgun
🗣Glowreus

🎖@malwr

WebView - Android's most convenient footgun

Exploring iframe security through an Android WebView lens

98 views14:30

ROP Chaining on ARM for Research Purposes
🗣binwiederhier

🎖@malwr

datto.engineering

ROP Chaining on ARM for Research Purposes

Tutorial on how to construct ROP chains from difficult ROP gadgets in ARM assembly.

105 views14:31