Keeping the ball rolling on blog posts! MalwareBazaar is giving me lots of material to work with and I like walking through my thought process #malware
https://forensicitguy.github.io/a-tale-of-two-dropper-scripts/
🗣ForensicITGuy


🎖@malwr

PPTShots - Unintentionally shared data in PowerPoint presentations
🗣df_works

This project was nowhere near as fruitful as I thought it was going to be and there are probably other tools out there but feel free to check out a notebook I have shared on github. PPTshots scans the internet for cropped images in powerpoint presentations and returns locations of "unseen" or "trimmed" areas. The larger the % area, presumably the greater potential for data leaks and other interesting info.

It is actually pretty rare to find anything interesting, after several days only one presentation contained 'sensitive' information. In this instance an "unnamed US federal government executive branch organization" had unintentionally left some PII in a Facebook screenshot. I reported this to them and the presentation is no longer publicly facing.

Other less sensitive information included browser tabs and OS information from the screen peripheries which could be of minor value to an attacker but nothing too exciting. Interestingly, on a few occasions where screenshots had been taken with dual monitors there was an entire extra screen to examine - I didn't identify anything more valuable than a half filled in timesheet but there is potential for sizeable data to have been exposed if a spreadsheet or similar had been open.
👤df_works


🎖@malwr

Automated approach to Memory Analysis
Hello all,
So we’re on a Project and being the sole one to do the task, I was wondering if there’s to some extent we can automate the Memory Analysis part!

Currently, I do it using Volatility Framework! I came across Volatility Bot, but saw it was last pushed 5 years back, so step aside!

Any leads could really help me in!

Thanks
🗣GloryHunter9

I usually keep a shell script to run the volatility commands I know I’ll need to run and save the output. It’s also easy to tell volatility to save in a format that you can upload to other tools for analysis. VolDiff used to have a malware-checks option that also did some cool automation, but it’s older at this point.
👤sumdude1849

Hi!

Check Crowdstrike SuperMem. I use my own script and haven’t used SuperMem like a lot but I’d say it extracts pretty much everything you need in order for you to analyze.
👤delerium46


🎖@malwr

New Zloader Campaign exploits Microsoft’s Signature Verification putting users at risk
🗣digicat

Dang that's dangerous
👤ItsMiggity


🎖@malwr

Excited to share Part 1 of Malware RE for Beginners!

Learn about basic computing terms and assembly language from 0x0

https://www.intezer.com/blog/malware-analysis/malware-reverse-engineering-beginners/
@IntezerLabs
🗣AbbyMCH


🎖@malwr

Analysis of #Evilnum new attack activity (report is in chinese 🇨🇳)
http://blog.nsfocus.net/agentvxapt-evilnum/

🗣Cyber_O51NT


🎖@malwr

🍎👾 Just published my annual "Mac Malware of the Year" report, for 2021:

An in-depth technical analysis of the year's new Mac malware, covering each:
💉 Infection vector
💾 Persistence mechanism
🛰 Payload and capabilities

+ samples for download! 🦠
https://objective-see.com/blog/blog_0x6B.html
🗣patrickwardle


🎖@malwr

Subdomain enumeration on your phone?

1. Install Termux.
2. pkg update && pkg insta findomain -y
3. findomain -t example.tld

You can use the same options such as -i, -r, --http-status or even perform monitoring from there.

#bugbountytips #infosec #hacking #osint #automation
🗣FindomainApp


🎖@malwr

KQL is a powerful tool to explore data and discover patterns, identify anomalies, and more.

In this post, Microsoft DART team explained how to leverage KQL for incident response!🤓

#DFIR #infosec cc: @DebugPrivilege @msftsecresponse

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/leveraging-the-power-of-kql-in-incident-response/ba-p/3044795
🗣fr0gger_


🎖@malwr

Day 3 of #dailyyara for #100DaysofYARA
Malware authors often statically compile OpenSSL into Windows binaries. Let's hunt some artefacts.
https://github.com/secman-pl/yaras/blob/main/hunt_PE_openssl_statically_compiled.yar
🗣secman_pl


🎖@malwr

Another simple .NET executable to create and add a backdoor user
Another simple but useful .NET executable that creates and adds an arbitrary user or domain user to the Local Administrators groups. Very useful for privilege escalations on Windows (i.e. unquoted service path)

Repo: https://github.com/notdodo/LocalAdminSharp
🗣d_o_d_o_


🎖@malwr