AccChecker LOLBIN [AccCheckConsole.exe - load a managed DLL](https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340)
🗣digicat


🎖@malwr

WHAT?! 😂
If you provide /FS:FILESYSTEM parameter to the format[.]com utility, the resulting process will try to load ("U"+FILESYSTEM).DLL using the default search path...
The weirdest custom DLL launcher I have meet so far :D
🗣0gtweet


🎖@malwr

https://adcb-kyc-update.netlify[.]app/
🗣malwrhunterteam
#phishing

🎖@malwr

Introducing inject-assembly! Execute a .NET assembly in any existing process, including your current Beacon, and retrieve the output!
- Patches Environment.Exit()
- PE header stomping
- Random pipe name generation
- No blocking of the current Beacon
https://github.com/kyleavery/inject-assembly
🗣kyleavery_


🎖@malwr

Reverse Engineering Resources About All Platforms(Windows/Linux/macOS/Android/iOS/IoT) (use translate if you cannot read the original)
https://github.com/alphaSeclab/awesome-reverse-engineering
🗣Dinosn


🎖@malwr

Keeping the ball rolling on blog posts! MalwareBazaar is giving me lots of material to work with and I like walking through my thought process #malware
https://forensicitguy.github.io/a-tale-of-two-dropper-scripts/
🗣ForensicITGuy


🎖@malwr

PPTShots - Unintentionally shared data in PowerPoint presentations
🗣df_works

This project was nowhere near as fruitful as I thought it was going to be and there are probably other tools out there but feel free to check out a notebook I have shared on github. PPTshots scans the internet for cropped images in powerpoint presentations and returns locations of "unseen" or "trimmed" areas. The larger the % area, presumably the greater potential for data leaks and other interesting info.

It is actually pretty rare to find anything interesting, after several days only one presentation contained 'sensitive' information. In this instance an "unnamed US federal government executive branch organization" had unintentionally left some PII in a Facebook screenshot. I reported this to them and the presentation is no longer publicly facing.

Other less sensitive information included browser tabs and OS information from the screen peripheries which could be of minor value to an attacker but nothing too exciting. Interestingly, on a few occasions where screenshots had been taken with dual monitors there was an entire extra screen to examine - I didn't identify anything more valuable than a half filled in timesheet but there is potential for sizeable data to have been exposed if a spreadsheet or similar had been open.
👤df_works


🎖@malwr

Automated approach to Memory Analysis
Hello all,
So we’re on a Project and being the sole one to do the task, I was wondering if there’s to some extent we can automate the Memory Analysis part!

Currently, I do it using Volatility Framework! I came across Volatility Bot, but saw it was last pushed 5 years back, so step aside!

Any leads could really help me in!

Thanks
🗣GloryHunter9

I usually keep a shell script to run the volatility commands I know I’ll need to run and save the output. It’s also easy to tell volatility to save in a format that you can upload to other tools for analysis. VolDiff used to have a malware-checks option that also did some cool automation, but it’s older at this point.
👤sumdude1849

Hi!

Check Crowdstrike SuperMem. I use my own script and haven’t used SuperMem like a lot but I’d say it extracts pretty much everything you need in order for you to analyze.
👤delerium46


🎖@malwr

New Zloader Campaign exploits Microsoft’s Signature Verification putting users at risk
🗣digicat

Dang that's dangerous
👤ItsMiggity


🎖@malwr