Malware News
15.7K subscribers
1.64K photos
7 videos
130 files
8.07K links
The latest NEWS about malwares, DFIR, hacking, security issues, thoughts and ...

Partner channel: @cveNotify

For ads: https://telega.io/c/malwr
Download Telegram
Today's quick #malware analysis with #SecurityOnion: #Emotet pcap from 2022-01-11!

Thanks to malware_traffic for sharing this pcap!

More screenshots:
https://blog.securityonion.net/2022/01/quick-malware-analysis-emotet-pcap-from.html
πŸ—£securityonion


πŸŽ–@malwr
dfirt: Collect information of Windows PC when doing incident response

#infosec #pentest #redteam
https://github.com/mamun-sec/dfirt
πŸ—£CyberWarship


πŸŽ–@malwr
Sentinel Labs' Amitai Ben Shushan Ehrlich looks into recent activity of the MuddyWater APT and presents the evolution of the PowGoop malware family, the usage of tunnelling tools, and the targeting of Exchange servers in high-profile organizations. https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/
πŸ—£virusbtn


πŸŽ–@malwr
Ukraine's MFA, MOD, State Emergency Service, Cabinet of Ministers, and Ministry of Education sites all hacked/defaced https://ru.interfax.com.ua/news/general/791451.html
πŸ—£pwnallthethings


πŸŽ–@malwr
Forwarded from Intel Slava
πŸ‡·πŸ‡ΊπŸ‡ΊπŸ‡² The FSB, after an appeal from the United States, detained a group of REvil hackers who sent out viruses to extort money.

At 25 addresses of places of stay, 14 members of the organized criminal community seized over 426 million rubles, including in cryptocurrency, 600 thousand dollars, 500 thousand euros, as well as computer equipment, crypto wallets used to commit crimes, 20 premium cars, acquired with money obtained by criminal means.
While I'm still writing the 2nd article of Malware Analysis Series (MAS), which I'm on page 43 and far from the end, I dropped a short and simple write-up on malicious document to help beginners on threat analysis.

https://exploitreversing.com/2022/01/14/malicious-document-analysis-example-2/

#maldoc #threatanalysis
πŸ—£ale_sp_brazil


πŸŽ–@malwr
Use of Alternate Data Streams in Research Scans for index.jsp. #ntfs #ads #jsp https://i5c.us/d28240
πŸ—£sans_isc


πŸŽ–@malwr
Project Ares is a PoC loader written in C/C++ based on the Transacted Hollowing technique. It features:
* PPID spoofing
* Dynamic function resolution with API hashing
* NTDLL unhooking
* AES256 CBC Encryption
and more!
https://github.com/Cerbersec/Ares
πŸ—£cerbersec


πŸŽ–@malwr
Just released my DLL Injection blog post. The post covers:

1. How to use LoadLibrary to inject a DLL
2. How to load a DLL into memory, parse the headers, load sections, perform relocations, resolve imports, and finally inject the DLL into another process
https://kasimir123.github.io/blog-posts/DLL%20Injection.html
πŸ—£Abraxus7331


πŸŽ–@malwr
πŸ‘1
πŸ›‘οΈ Awesome Cloud Security Resources βš”οΈ

https://github.com/4ndersonLin/awesome-cloud-security

#cloudhacking #cybersecurity #appsec #bughunting
πŸ—£0xAsm0d3us


πŸŽ–@malwr