To people who asked me few minutes ago about how would be the IDA Pro's reversed code of the shellcode from previous message, few pictures follow. There isn't analysis here (not time to do it), but only structures and API hash resolving.
#malware #reversing
🗣ale_sp_brazil
🎖@malwr
#malware #reversing
🗣ale_sp_brazil
🎖@malwr
👍1
Took a quick look at Stage1.exe malware, as reported by Microsoft. Whipped up a quick (and simple) yara rule for it. #100DaysofYARA
🗣CD_R0M_
🎖@malwr
🗣CD_R0M_
🎖@malwr
A few more tricks when dealing with string literals in IDA:
https://hex-rays.com/blog/igors-tip-of-the-week-72-more-string-literals/
#IgorsTipOfTheWeek #IDAtips #IDAPro #HexraysDecompiler
🗣HexRaysSA
🎖@malwr
https://hex-rays.com/blog/igors-tip-of-the-week-72-more-string-literals/
#IgorsTipOfTheWeek #IDAtips #IDAPro #HexraysDecompiler
🗣HexRaysSA
🎖@malwr
👍1
IOCTLDump https://github.com/Kharos102/IOCTLDump #pentesting #CyberSecurity #Infosec
🗣ptracesecurity
🎖@malwr
🗣ptracesecurity
🎖@malwr
More samples of WhisperGate, the MBR Overwriter targeting Ukraine
Stage 2 downloads a Stage 3 binary from Discord. Stage 3 is reversed binary. Stage 3 is reversed and it becomes a DLL module
Special thanks to silascutler & ffforward
Download it here: https://www.vx-underground.org/apts.html#2022
🗣vxunderground
🎖@malwr
Stage 2 downloads a Stage 3 binary from Discord. Stage 3 is reversed binary. Stage 3 is reversed and it becomes a DLL module
Special thanks to silascutler & ffforward
Download it here: https://www.vx-underground.org/apts.html#2022
🗣vxunderground
🎖@malwr
Jak and Daxter decompiled to GOAL and ported to the PC
🗣corysama
Supporting custom language/ tools during crunch time at a game company must have come with a ton of stress for the poor individuals supporting it
👤tnavda
Not my project. https://news.ycombinator.com/submitted?id=msk-lywenn might be related. They also posted https://blog.jakspeedruns.com/opengoal-project-update-september-2020/ to HN a while back
👤corysama
🎖@malwr
🗣corysama
Supporting custom language/ tools during crunch time at a game company must have come with a ton of stress for the poor individuals supporting it
👤tnavda
Not my project. https://news.ycombinator.com/submitted?id=msk-lywenn might be related. They also posted https://blog.jakspeedruns.com/opengoal-project-update-september-2020/ to HN a while back
👤corysama
🎖@malwr
GitHub
GitHub - open-goal/jak-project: Reviving the language that brought us the Jak & Daxter Series
Reviving the language that brought us the Jak & Daxter Series - open-goal/jak-project
Wine 7.0 released.
🗣KindOne
WoW64 thunks are implemented for most Unix libraries, enabling a 32-bit PE module to call a 64-bit Unix library. Once the remaining modules are converted to PE, this will make it possible to run 32-bit applications without installing 32-bit Unix libraries.
🎖@malwr
🗣KindOne
WoW64 thunks are implemented for most Unix libraries, enabling a 32-bit PE module to call a 64-bit Unix library. Once the remaining modules are converted to PE, this will make it possible to run 32-bit applications without installing 32-bit Unix libraries.
🎖@malwr
WineHQ
The Wine team is proud to announce that the stable release Wine 7.0
Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members
🗣quellaman
🎖@malwr
🗣quellaman
🎖@malwr
Unit 42
Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members
Operation Falcon II, championed by INTERPOL and The Nigeria Police Force, led to the arrest of Nigerian business email compromise actors.
Kraken the Code on Prometheus - we were able to cluster a variety of different malware families they’ve used, based on Cobalt Strike Beacon configuration data.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
BlackBerry
Kraken the Code on Prometheus
The BlackBerry Research & Intelligence Team has uncovered a cluster of nine distinct Russian threat actors who have attacked U.S. government agencies using Prometheus, a network of malicious Traffic Direction Systems.
Memorandum on Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community Systems | The White House - USA
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
The White House
Memorandum on Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community Systems
NATIONAL SECURITY MEMORANDUM/NSM-8 MEMORANDUM FOR THE VICE PRESIDENT THE SECRETARY OF STATE THE SECRETARY OF THE TREASURY
Cyber-attack targets Red Cross Red Crescent data - details of 500,000 vulnerable people affected
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
ICRC
Sophisticated cyber-attack targets Red Cross Red Crescent data on 500,000 people
A sophisticated cyber security attack against computer servers hosting information held by the International Committee of the Red Cross (ICRC) was detected this week.