A few more tricks when dealing with string literals in IDA:
https://hex-rays.com/blog/igors-tip-of-the-week-72-more-string-literals/
#IgorsTipOfTheWeek #IDAtips #IDAPro #HexraysDecompiler
🗣HexRaysSA
🎖@malwr
https://hex-rays.com/blog/igors-tip-of-the-week-72-more-string-literals/
#IgorsTipOfTheWeek #IDAtips #IDAPro #HexraysDecompiler
🗣HexRaysSA
🎖@malwr
👍1
IOCTLDump https://github.com/Kharos102/IOCTLDump #pentesting #CyberSecurity #Infosec
🗣ptracesecurity
🎖@malwr
🗣ptracesecurity
🎖@malwr
More samples of WhisperGate, the MBR Overwriter targeting Ukraine
Stage 2 downloads a Stage 3 binary from Discord. Stage 3 is reversed binary. Stage 3 is reversed and it becomes a DLL module
Special thanks to silascutler & ffforward
Download it here: https://www.vx-underground.org/apts.html#2022
🗣vxunderground
🎖@malwr
Stage 2 downloads a Stage 3 binary from Discord. Stage 3 is reversed binary. Stage 3 is reversed and it becomes a DLL module
Special thanks to silascutler & ffforward
Download it here: https://www.vx-underground.org/apts.html#2022
🗣vxunderground
🎖@malwr
Jak and Daxter decompiled to GOAL and ported to the PC
🗣corysama
Supporting custom language/ tools during crunch time at a game company must have come with a ton of stress for the poor individuals supporting it
👤tnavda
Not my project. https://news.ycombinator.com/submitted?id=msk-lywenn might be related. They also posted https://blog.jakspeedruns.com/opengoal-project-update-september-2020/ to HN a while back
👤corysama
🎖@malwr
🗣corysama
Supporting custom language/ tools during crunch time at a game company must have come with a ton of stress for the poor individuals supporting it
👤tnavda
Not my project. https://news.ycombinator.com/submitted?id=msk-lywenn might be related. They also posted https://blog.jakspeedruns.com/opengoal-project-update-september-2020/ to HN a while back
👤corysama
🎖@malwr
GitHub
GitHub - open-goal/jak-project: Reviving the language that brought us the Jak & Daxter Series
Reviving the language that brought us the Jak & Daxter Series - open-goal/jak-project
Wine 7.0 released.
🗣KindOne
WoW64 thunks are implemented for most Unix libraries, enabling a 32-bit PE module to call a 64-bit Unix library. Once the remaining modules are converted to PE, this will make it possible to run 32-bit applications without installing 32-bit Unix libraries.
🎖@malwr
🗣KindOne
WoW64 thunks are implemented for most Unix libraries, enabling a 32-bit PE module to call a 64-bit Unix library. Once the remaining modules are converted to PE, this will make it possible to run 32-bit applications without installing 32-bit Unix libraries.
🎖@malwr
WineHQ
The Wine team is proud to announce that the stable release Wine 7.0
Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members
🗣quellaman
🎖@malwr
🗣quellaman
🎖@malwr
Unit 42
Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members
Operation Falcon II, championed by INTERPOL and The Nigeria Police Force, led to the arrest of Nigerian business email compromise actors.
Kraken the Code on Prometheus - we were able to cluster a variety of different malware families they’ve used, based on Cobalt Strike Beacon configuration data.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
BlackBerry
Kraken the Code on Prometheus
The BlackBerry Research & Intelligence Team has uncovered a cluster of nine distinct Russian threat actors who have attacked U.S. government agencies using Prometheus, a network of malicious Traffic Direction Systems.
Memorandum on Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community Systems | The White House - USA
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
The White House
Memorandum on Improving the Cybersecurity of National Security, Department of Defense, and Intelligence Community Systems
NATIONAL SECURITY MEMORANDUM/NSM-8 MEMORANDUM FOR THE VICE PRESIDENT THE SECRETARY OF STATE THE SECRETARY OF THE TREASURY
Cyber-attack targets Red Cross Red Crescent data - details of 500,000 vulnerable people affected
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
ICRC
Sophisticated cyber-attack targets Red Cross Red Crescent data on 500,000 people
A sophisticated cyber security attack against computer servers hosting information held by the International Committee of the Red Cross (ICRC) was detected this week.
PCAP Analysis
Hi there.
I am just starting to learn about PCAP analysis/forensics. I am experienced in Windows OS forensics and never really worked with PCAPs before. What's some of the tools everyone uses besides Wireshark? I've been reading up on Zeek.
🗣antmar9041
Look at BRIM (https://www.brimdata.io/)
But esential for pcap analysis is knowleadge about network, pacets etc.
👤sidi7
Network Miner is a good tool.
👤downtownatomizer
One thing I'd like to re-emphasize it that most tools do the same stuff with a few (mostly) minor differences. Ultimately, it's not the tool but how one uses it. There are a plethora of features in wireshark (or any one tool) and in my view, spending time to learn one or two but learning it to its fullest is the best way to excel.
Also, sorry, no one asked for me advice, I felt like mentioning so that if folks who are just getting into security read this, they shouldn't feel overwhelmed.
👤kaizen_kid
🎖@malwr
Hi there.
I am just starting to learn about PCAP analysis/forensics. I am experienced in Windows OS forensics and never really worked with PCAPs before. What's some of the tools everyone uses besides Wireshark? I've been reading up on Zeek.
🗣antmar9041
Look at BRIM (https://www.brimdata.io/)
But esential for pcap analysis is knowleadge about network, pacets etc.
👤sidi7
Network Miner is a good tool.
👤downtownatomizer
One thing I'd like to re-emphasize it that most tools do the same stuff with a few (mostly) minor differences. Ultimately, it's not the tool but how one uses it. There are a plethora of features in wireshark (or any one tool) and in my view, spending time to learn one or two but learning it to its fullest is the best way to excel.
Also, sorry, no one asked for me advice, I felt like mentioning so that if folks who are just getting into security read this, they shouldn't feel overwhelmed.
👤kaizen_kid
🎖@malwr
reddit
PCAP Analysis
Hi there. I am just starting to learn about PCAP analysis/forensics. I am experienced in Windows OS forensics and never really worked with PCAPs...
👍1
Time to chip in for #100DaysofYARA, this rule is a (fun) example that looks for a structure (#Regin VFS) instead of data.
Structures (often config) are useful to validate your understanding of malware functionality and for more resilient rules. But be careful with boundaries :)
🗣Int2e_
🎖@malwr
Structures (often config) are useful to validate your understanding of malware functionality and for more resilient rules. But be careful with boundaries :)
🗣Int2e_
🎖@malwr