📦 EtwTi-Syscall-Hook
👤 NinjaParanoid
⭐ 79 (+15)
🗒 C
A simple program to hook the current process t...
https://github.com/paranoidninja/EtwTi-Syscall-Hook
🗣gh_trending_
🎖@malwr
👤 NinjaParanoid
⭐ 79 (+15)
🗒 C
A simple program to hook the current process t...
https://github.com/paranoidninja/EtwTi-Syscall-Hook
🗣gh_trending_
🎖@malwr
GitHub
GitHub - paranoidninja/Process-Instrumentation-Syscall-Hook: A simple program to hook the current process to identify the manual…
A simple program to hook the current process to identify the manual syscall executions on windows - paranoidninja/Process-Instrumentation-Syscall-Hook
[Tooling ⚔️] Updated DInjector with 'RemoteThreadKernelCB' technique for shellcode invocation by spoofing the fnCOPYDATA value in kernel callback table based on @SoumyadeepBas12’s gist. Thread execution via SendMessageA. Works for GUI processes ⚙️ https://github.com/snovvcrash/DInjector/blob/main/DInjector/Modules/RemoteThreadKernelCB.cs
🗣snovvcrash
🎖@malwr
🗣snovvcrash
🎖@malwr
Today's quick #malware analysis with #SecurityOnion: #TA551 / #SHATHAK / #IcedID / #BOKBOT pcap from 2022-01-06!
Thanks to @malware_traffic for sharing this pcap!
More screenshots:
https://blog.securityonion.net/2022/01/quick-malware-analysis-ta551-shathak_12.html
🗣securityonion
🎖@malwr
Thanks to @malware_traffic for sharing this pcap!
More screenshots:
https://blog.securityonion.net/2022/01/quick-malware-analysis-ta551-shathak_12.html
🗣securityonion
🎖@malwr
Here's a #dfir #malware analysis of the Dridex anti-analysis methods of obfuscating API calls with hashing and vector exception handling
#cybersecurity #infosec
https://www.0ffset.net/reverse-engineering/malware-analysis/dridex-veh-api-obfuscation/?s=09
🗣AGDCservices
🎖@malwr
#cybersecurity #infosec
https://www.0ffset.net/reverse-engineering/malware-analysis/dridex-veh-api-obfuscation/?s=09
🗣AGDCservices
🎖@malwr
0ffset Training Solutions | Practical and Affordable Cyber Security Training
DRIDEX: Analysing API Obfuscation Through VEH | 0ffset
DRIDEX is one of the most famous and prevalent banking Trojans that dates back to around late 2014. Throughout its improvement and variations, DRIDEX has been successful in targeting the financial services sector to steal banking information and crucial user…
I updated #IdaIFL plugin (v1.4.3): https://github.com/hasherezade/ida_ifl/releases/ - now you can load "*.imports.txt" report from #PEsieve into your IDB
🗣hasherezade
🎖@malwr
🗣hasherezade
🎖@malwr
🔍We publish 6⃣ #Yara rules to detect 🪓#HackTools that read / modify🖥️ #RDP system settings. The rules are deliberately not only limited to detect PE files since these modifications may also take place in scripts etc.
https://github.com/telekom-security/malware_analysis/blob/main/hacktools/hacktools.yar
#100DaysofYARA
- via @tbarabosch
🗣DTCERT
🎖@malwr
https://github.com/telekom-security/malware_analysis/blob/main/hacktools/hacktools.yar
#100DaysofYARA
- via @tbarabosch
🗣DTCERT
🎖@malwr
Today's quick #malware analysis with #SecurityOnion: #Emotet pcap from 2022-01-11!
Thanks to malware_traffic for sharing this pcap!
More screenshots:
https://blog.securityonion.net/2022/01/quick-malware-analysis-emotet-pcap-from.html
🗣securityonion
🎖@malwr
Thanks to malware_traffic for sharing this pcap!
More screenshots:
https://blog.securityonion.net/2022/01/quick-malware-analysis-emotet-pcap-from.html
🗣securityonion
🎖@malwr
XELFViewer - ELF file viewer/editor for Windows, Linux and MacOS.
0.04
[+] CMAKE build system
[+] New info file widget
[+] Many bugs have been fixed
#hacker #infosec #malware #hacking #programming #reversing #opensource #linux #linuxsecurity #unix
https://github.com/horsicq/XELFViewer
🗣horsicq
🎖@malwr
0.04
[+] CMAKE build system
[+] New info file widget
[+] Many bugs have been fixed
#hacker #infosec #malware #hacking #programming #reversing #opensource #linux #linuxsecurity #unix
https://github.com/horsicq/XELFViewer
🗣horsicq
🎖@malwr
GitHub
GitHub - horsicq/XELFViewer: ELF file viewer/editor for Windows, Linux and MacOS.
ELF file viewer/editor for Windows, Linux and MacOS. - horsicq/XELFViewer
dfirt: Collect information of Windows PC when doing incident response
#infosec #pentest #redteam
https://github.com/mamun-sec/dfirt
🗣CyberWarship
🎖@malwr
#infosec #pentest #redteam
https://github.com/mamun-sec/dfirt
🗣CyberWarship
🎖@malwr
One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password
https://github.com/ihebski/DefaultCreds-cheat-sheet
🗣Dinosn
🎖@malwr
https://github.com/ihebski/DefaultCreds-cheat-sheet
🗣Dinosn
🎖@malwr
GitHub
GitHub - ihebski/DefaultCreds-cheat-sheet: One place for all the default credentials to assist the Blue/Red teamers identifying…
One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️ - ihebski/DefaultCreds-cheat-sheet
Sentinel Labs' Amitai Ben Shushan Ehrlich looks into recent activity of the MuddyWater APT and presents the evolution of the PowGoop malware family, the usage of tunnelling tools, and the targeting of Exchange servers in high-profile organizations. https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/
🗣virusbtn
🎖@malwr
🗣virusbtn
🎖@malwr