🃏Just published a new research analyzing the #SysJoker backdoor.
SysJoker targets Windows, Linux and macOS.
Learn more about this new threat, its capabilities, behavior and (most importantly) how to detect it ->
https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/
@NicoleFishi19 @MhicRoibin
🗣AbbyMCH
🎖@malwr
SysJoker targets Windows, Linux and macOS.
Learn more about this new threat, its capabilities, behavior and (most importantly) how to detect it ->
https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/
@NicoleFishi19 @MhicRoibin
🗣AbbyMCH
🎖@malwr
👍1
yara: match x86 that appears to manually traverse the TEB/PEB/LDR data.
#100DaysofYARA
https://gist.github.com/williballenthin/08891865082a8bd5bf921b58fa312ada#file-peb_parsing-yara
🗣williballenthin
🎖@malwr
#100DaysofYARA
https://gist.github.com/williballenthin/08891865082a8bd5bf921b58fa312ada#file-peb_parsing-yara
🗣williballenthin
🎖@malwr
Useful logs for Incident Responders
Bigger format: https://github.com/corelight/bro-cheatsheets
🗣LetsDefendIO
🎖@malwr
Bigger format: https://github.com/corelight/bro-cheatsheets
🗣LetsDefendIO
🎖@malwr
Procdump works against Defender with a simple rename. It quarantines the generated .dmp file but you have a few seconds to make a copy of it before it's removed.
I've seen other security solutions that do this, try to copy the file quickly before it's removed.
🗣mrd0x
🎖@malwr
I've seen other security solutions that do this, try to copy the file quickly before it's removed.
🗣mrd0x
🎖@malwr
Linux kernel exploit development tutorial
ChrisTheCoolHut published this tutorial as GitBook:
https://breaking-bits.gitbook.io/breaking-bits/exploit-development/linux-kernel-exploit-development
🗣linkersec
🎖@malwr
ChrisTheCoolHut published this tutorial as GitBook:
https://breaking-bits.gitbook.io/breaking-bits/exploit-development/linux-kernel-exploit-development
🗣linkersec
🎖@malwr
breaking-bits.gitbook.io
Linux kernel exploit development | Breaking Bits
Windows Defender AV allows Everyone to read the configured exclusions on the system 🤦
reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s
🗣splinter_code
🎖@malwr
reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" /s
🗣splinter_code
🎖@malwr
New #SysJoker backdoor targets Windows, Linux and macOS
Discovered during an active attack on a Linux-based web server
Linux and Mac versions are fully undetected in VirusTotal 🚷
http://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker
🗣IntezerLabs
🎖@malwr
Discovered during an active attack on a Linux-based web server
Linux and Mac versions are fully undetected in VirusTotal 🚷
http://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker
🗣IntezerLabs
🎖@malwr
Technical details on APT35 attempts to exploit Log4j vulnerability:
💣Both targeted attacks and mass-scanning
💎CharmPower: still-in-development Powershell-based modular toolkit
🧩Shared infrastructure with previous mobile and ransomware campaigns.
https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit
🗣_CPResearch_
🎖@malwr
💣Both targeted attacks and mass-scanning
💎CharmPower: still-in-development Powershell-based modular toolkit
🧩Shared infrastructure with previous mobile and ransomware campaigns.
https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit
🗣_CPResearch_
🎖@malwr
Malware development serie:
• https://0xpat.github.io/Malware_development_part_1/
• https://0xpat.github.io/Malware_development_part_2/
• https://0xpat.github.io/Malware_development_part_3/
• https://0xpat.github.io/Malware_development_part_4/
• https://0xpat.github.io/Malware_development_part_5/
• https://0xpat.github.io/Malware_development_part_6/
• https://0xpat.github.io/Malware_development_part_7/
• https://0xpat.github.io/Malware_development_part_8/
• https://0xpat.github.io/Malware_development_part_9/
🗣aas_s3curity
🎖@malwr
• https://0xpat.github.io/Malware_development_part_1/
• https://0xpat.github.io/Malware_development_part_2/
• https://0xpat.github.io/Malware_development_part_3/
• https://0xpat.github.io/Malware_development_part_4/
• https://0xpat.github.io/Malware_development_part_5/
• https://0xpat.github.io/Malware_development_part_6/
• https://0xpat.github.io/Malware_development_part_7/
• https://0xpat.github.io/Malware_development_part_8/
• https://0xpat.github.io/Malware_development_part_9/
🗣aas_s3curity
🎖@malwr
❤4🔥2👍1
Signed kernel drivers – Unguarded gateway to Windows’ core | WeLiveSecurity
https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/
🗣tais9
🎖@malwr
https://www.welivesecurity.com/2022/01/11/signed-kernel-drivers-unguarded-gateway-windows-core/
🗣tais9
🎖@malwr
Welivesecurity
Signed kernel drivers – Unguarded gateway to Windows’ core
ESET researchers look at malware that abuses vulnerabilities in kernel drivers and outline mitigation techniques against this type of exploitation
Anyone else aware that .asd files can contain macros? Literally just found out.
Added to Filesec:
https://filesec.io/asd
https://filesec.io/wbk
🗣mrd0x
🎖@malwr
Added to Filesec:
https://filesec.io/asd
https://filesec.io/wbk
🗣mrd0x
🎖@malwr
📦 EtwTi-Syscall-Hook
👤 NinjaParanoid
⭐ 79 (+15)
🗒 C
A simple program to hook the current process t...
https://github.com/paranoidninja/EtwTi-Syscall-Hook
🗣gh_trending_
🎖@malwr
👤 NinjaParanoid
⭐ 79 (+15)
🗒 C
A simple program to hook the current process t...
https://github.com/paranoidninja/EtwTi-Syscall-Hook
🗣gh_trending_
🎖@malwr
GitHub
GitHub - paranoidninja/Process-Instrumentation-Syscall-Hook: A simple program to hook the current process to identify the manual…
A simple program to hook the current process to identify the manual syscall executions on windows - paranoidninja/Process-Instrumentation-Syscall-Hook
[Tooling ⚔️] Updated DInjector with 'RemoteThreadKernelCB' technique for shellcode invocation by spoofing the fnCOPYDATA value in kernel callback table based on @SoumyadeepBas12’s gist. Thread execution via SendMessageA. Works for GUI processes ⚙️ https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/RemoteThreadKernelCB.cs
🗣snovvcrash
🎖@malwr
🗣snovvcrash
🎖@malwr
Today's quick #malware analysis with #SecurityOnion: #TA551 / #SHATHAK / #IcedID / #BOKBOT pcap from 2022-01-06!
Thanks to @malware_traffic for sharing this pcap!
More screenshots:
https://blog.securityonion.net/2022/01/quick-malware-analysis-ta551-shathak_12.html
🗣securityonion
🎖@malwr
Thanks to @malware_traffic for sharing this pcap!
More screenshots:
https://blog.securityonion.net/2022/01/quick-malware-analysis-ta551-shathak_12.html
🗣securityonion
🎖@malwr