Here's a #dfir #malware analysis of the Dridex anti-analysis methods of obfuscating API calls with hashing and vector exception handling



#cybersecurity #infosec
https://www.0ffset.net/reverse-engineering/malware-analysis/dridex-veh-api-obfuscation/?s=09
🗣AGDCservices


🎖@malwr

Lazy phishing attempt of the decade. Better luck next time.
🗣campuscodi


🎖@malwr

🔍We publish 6⃣ #Yara rules to detect 🪓#HackTools that read / modify🖥️ #RDP system settings. The rules are deliberately not only limited to detect PE files since these modifications may also take place in scripts etc.

https://github.com/telekom-security/malware_analysis/blob/main/hacktools/hacktools.yar

#100DaysofYARA

- via @tbarabosch
🗣DTCERT


🎖@malwr

XELFViewer - ELF file viewer/editor for Windows, Linux and MacOS.

0.04

[+] CMAKE build system
[+] New info file widget
[+] Many bugs have been fixed



#hacker #infosec #malware #hacking #programming #reversing #opensource #linux #linuxsecurity #unix
https://github.com/horsicq/XELFViewer
🗣horsicq


🎖@malwr

dfirt: Collect information of Windows PC when doing incident response

#infosec #pentest #redteam
https://github.com/mamun-sec/dfirt
🗣CyberWarship


🎖@malwr

One place for all the default credentials to assist the Blue/Red teamers activities on finding devices with default password
https://github.com/ihebski/DefaultCreds-cheat-sheet
🗣Dinosn


🎖@malwr

Sentinel Labs' Amitai Ben Shushan Ehrlich looks into recent activity of the MuddyWater APT and presents the evolution of the PowGoop malware family, the usage of tunnelling tools, and the targeting of Exchange servers in high-profile organizations. https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/
🗣virusbtn


🎖@malwr

Ukraine's MFA, MOD, State Emergency Service, Cabinet of Ministers, and Ministry of Education sites all hacked/defaced https://ru.interfax.com.ua/news/general/791451.html
🗣pwnallthethings


🎖@malwr

Scemu - X86 32bits Emulator, For Securely Emulating Shellcodes
http://www.kitploit.com/2022/01/scemu-x86-32bits-emulator-for-securely.html
🗣Dinosn


🎖@malwr

🇷🇺🇺🇲 The FSB, after an appeal from the United States, detained a group of REvil hackers who sent out viruses to extort money.

At 25 addresses of places of stay, 14 members of the organized criminal community seized over 426 million rubles, including in cryptocurrency, 600 thousand dollars, 500 thousand euros, as well as computer equipment, crypto wallets used to commit crimes, 20 premium cars, acquired with money obtained by criminal means.