While I'm still writing the 2nd article of Malware Analysis Series (MAS), which I'm on page 43 and far from the end, I dropped a short and simple write-up on malicious document to help beginners on threat analysis.

https://exploitreversing.com/2022/01/14/malicious-document-analysis-example-2/

#maldoc #threatanalysis
🗣ale_sp_brazil


🎖@malwr

Use of Alternate Data Streams in Research Scans for index.jsp. #ntfs #ads #jsp https://i5c.us/d28240
🗣sans_isc


🎖@malwr

Project Ares is a PoC loader written in C/C++ based on the Transacted Hollowing technique. It features:
* PPID spoofing
* Dynamic function resolution with API hashing
* NTDLL unhooking
* AES256 CBC Encryption
and more!
https://github.com/Cerbersec/Ares
🗣cerbersec


🎖@malwr

Just released my DLL Injection blog post. The post covers:

1. How to use LoadLibrary to inject a DLL
2. How to load a DLL into memory, parse the headers, load sections, perform relocations, resolve imports, and finally inject the DLL into another process
https://kasimir123.github.io/blog-posts/DLL%20Injection.html
🗣Abraxus7331


🎖@malwr

🛡️ Awesome Cloud Security Resources ⚔️

https://github.com/4ndersonLin/awesome-cloud-security

#cloudhacking #cybersecurity #appsec #bughunting
🗣0xAsm0d3us


🎖@malwr

OH SHIT HERE WE GOOOOOO
https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
🗣jfslowik


🎖@malwr

Released VeraCryptThief which is an exercise of mine of playing with API hooking to capture clear-text VeraCrypt passwords and save them on disk 🔐 Features: hooking via Detours, reflective DLL shellcode via sRDI, process injection via D/Invoke in C# 🔥 https://github.com/snovvcrash/VeraCryptThief
🗣snovvcrash


🎖@malwr

Took a quick look at Stage1.exe malware, as reported by Microsoft. Whipped up a quick (and simple) yara rule for it. #100DaysofYARA
🗣CD_R0M_


🎖@malwr

A few more tricks when dealing with string literals in IDA:

https://hex-rays.com/blog/igors-tip-of-the-week-72-more-string-literals/

#IgorsTipOfTheWeek #IDAtips #IDAPro #HexraysDecompiler
🗣HexRaysSA


🎖@malwr

IOCTLDump https://github.com/Kharos102/IOCTLDump #pentesting #CyberSecurity #Infosec
🗣ptracesecurity


🎖@malwr

More samples of WhisperGate, the MBR Overwriter targeting Ukraine

Stage 2 downloads a Stage 3 binary from Discord. Stage 3 is reversed binary. Stage 3 is reversed and it becomes a DLL module

Special thanks to silascutler & ffforward

Download it here: https://www.vx-underground.org/apts.html#2022
🗣vxunderground


🎖@malwr

Jak and Daxter decompiled to GOAL and ported to the PC
🗣corysama

Supporting custom language/ tools during crunch time at a game company must have come with a ton of stress for the poor individuals supporting it
👤tnavda

Not my project. https://news.ycombinator.com/submitted?id=msk-lywenn might be related. They also posted https://blog.jakspeedruns.com/opengoal-project-update-september-2020/ to HN a while back
👤corysama


🎖@malwr