Time to chip in for #100DaysofYARA, this rule is a (fun) example that looks for a structure (#Regin VFS) instead of data.
Structures (often config) are useful to validate your understanding of malware functionality and for more resilient rules. But be careful with boundaries :)
🗣Int2e_
🎖@malwr
Structures (often config) are useful to validate your understanding of malware functionality and for more resilient rules. But be careful with boundaries :)
🗣Int2e_
🎖@malwr
Forwarded from CVE Notify
We do not possess any samples from Lockbit Ransomware group. A new sample from Lockbit has not appeared on @abuse_ch since December, 2021.
We asked Lockbit for a new sample - they have provided us with a sample directly from their panel.
Download here: https://samples.vx-underground.org/samples/Families/
🗣vxunderground
🎖@malwr
We asked Lockbit for a new sample - they have provided us with a sample directly from their panel.
Download here: https://samples.vx-underground.org/samples/Families/
🗣vxunderground
🎖@malwr
After the Pro version earlier this week, I just released a new version of MacroPack Community!
#infosec #MacroPack
https://github.com/sevagas/macro_pack
🗣EmericNasi
🎖@malwr
#infosec #MacroPack
https://github.com/sevagas/macro_pack
🗣EmericNasi
🎖@malwr
GitHub
GitHub - sevagas/macro_pack: macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of Office documents…
macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of Office documents, VB scripts, shortcuts, and other formats for pentest, demo, and social engineering assessments...
😱1
About the WhisperGate, it's quite simple to setup the IDA Pro + Bochs to examine the MBR and I showed it step-by-step few slides in an introductory talk at HTIB Amsterdam 2019. Just it case you want to check slides:
https://exploitreversing.files.wordpress.com/2021/12/hitb_ams_2019-1.pdf
#malware #idapro
🗣ale_sp_brazil
🎖@malwr
https://exploitreversing.files.wordpress.com/2021/12/hitb_ams_2019-1.pdf
#malware #idapro
🗣ale_sp_brazil
🎖@malwr
Are you an admin with EXE blocked by #AppLocker? You can bypass the protection without any execution traces in the AppLocker Log! Load your DLL, steal the token from spooler and create the child process.
C source code and the compiled binary, as usual: https://github.com/gtworek/PSBits/tree/master/AppLockerBypass
🗣0gtweet
🎖@malwr
C source code and the compiled binary, as usual: https://github.com/gtworek/PSBits/tree/master/AppLockerBypass
🗣0gtweet
🎖@malwr
Best search🔎engines for Pentesters and Security Professionals.
→ google .com
→ Shodan .io
→ Censys .io
→ Hunter .io
→ redhuntlabs .com
→ fullhunt .io
→ onyphe .io
→ fofa .so
→ socradar .io
→ synapsint .com
→ binaryedge .io
→ ivre .rocks
→ crt .sh
→ spyse .com
→ vulners .com
→ PublicWWW .com
→ Pulsedive .com
→ ZoomEye .org
→ intelx .io
→ WiGLE .net
→ reposify .com
→ viz. greynoise .io
🗣NandanLohitaksh
🎖@malwr
→ google .com
→ Shodan .io
→ Censys .io
→ Hunter .io
→ redhuntlabs .com
→ fullhunt .io
→ onyphe .io
→ fofa .so
→ socradar .io
→ synapsint .com
→ binaryedge .io
→ ivre .rocks
→ crt .sh
→ spyse .com
→ vulners .com
→ PublicWWW .com
→ Pulsedive .com
→ ZoomEye .org
→ intelx .io
→ WiGLE .net
→ reposify .com
→ viz. greynoise .io
🗣NandanLohitaksh
🎖@malwr
For those following the news, the WhisperGate campaign (as initially described by Microsoft) has been quite impactful. Today, my blog for corporate has gone live regarding this wiper campaign, with the analysis of all four stages. Additionally, I uploaded the binary of stage 4 to VirusTotal, MalShare, and MalwareBazaar, making it accessible for all. The links are given below.
Link: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/return-of-pseudo-ransomware.html
ℹ️ Sent from one of our members
🎖@malwr
Link: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/return-of-pseudo-ransomware.html
ℹ️ Sent from one of our members
🎖@malwr
Trellix
Return of Pseudo Ransomware
Insights into the recent ransomware campaign targeting Ukraine.
An old sample of the Lamberts (probably #WhiteLambert) appeared on VirusTotal.
This driver file intel440x.sys is also mentioned by name on the infamous drv_list.txt from The Shadow Brokers' leak. The logic itself is contained inside a compressed resource.
https://www.virustotal.com/gui/file/1eede29007619d207842ddcaadf41b17b47a456004df43189d1f6cf54a3b785b
🗣_CPResearch_
🎖@malwr
This driver file intel440x.sys is also mentioned by name on the infamous drv_list.txt from The Shadow Brokers' leak. The logic itself is contained inside a compressed resource.
https://www.virustotal.com/gui/file/1eede29007619d207842ddcaadf41b17b47a456004df43189d1f6cf54a3b785b
🗣_CPResearch_
🎖@malwr
[1/n] Today I'm sharing the details of a research done by vaber_b, legezo, Ilya Borisov and myself on a UEFI firmware implant found in the wild, dubbed #MoonBounce. We assess that this formerly unknown threat is the work of the infamous #APT41. A 🧵
https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
🗣_marklech_
🎖@malwr
https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
🗣_marklech_
🎖@malwr
This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.
https://github.com/infosecn1nja/Red-Teaming-Toolkit
🗣Dinosn
🎖@malwr
https://github.com/infosecn1nja/Red-Teaming-Toolkit
🗣Dinosn
🎖@malwr
GitHub
GitHub - infosecn1nja/Red-Teaming-Toolkit: This repository contains cutting-edge open-source security tools (OST) for a red teamer…
This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter. - infosecn1nja/Red-Teaming-Toolkit
My research work from last year summarized in the blog post: Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA
https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/
🗣Pawp81
🎖@malwr
https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/
🗣Pawp81
🎖@malwr
Microsoft Security Blog
Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA | Microsoft Security Blog
We uncovered a large-scale, multi-phase campaign that adds a novel technique to traditional phishing tactics by joining an attacker-operated device to an organization’s network to further propagate the campaign.
3.0: The Next Chapter. Today, we’re proud to announce the release of Binary Ninja 3.0. More than 6 months in the making, Binary Ninja 3.0 represents a huge leap forward in analysis and usability. Pseudo C decompilation, stack view and an overhauled UI https://binary.ninja/2022/01/27/3.0-the-next-chapter.html
🗣vector35
🎖@malwr
🗣vector35
🎖@malwr
Day 29 #100DaysofYARA using maths; counting the number of resources in a PE that have MZ headers!
I can only count to 5 on one hand so thats why the counter went this high
https://github.com/g-les/100DaysofYARA/blob/main/100_days_of_yara.yar
🗣greglesnewich
🎖@malwr
I can only count to 5 on one hand so thats why the counter went this high
https://github.com/g-les/100DaysofYARA/blob/main/100_days_of_yara.yar
🗣greglesnewich
🎖@malwr
Process Hollowing Alert is now in #SIGMA.
Sysmon Event ID 25 with a type of “image is replaced”
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_process_hollowing.yml
🗣SecurePeacock
🎖@malwr
Sysmon Event ID 25 with a type of “image is replaced”
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_process_hollowing.yml
🗣SecurePeacock
🎖@malwr
GitHub
sigma/sysmon_process_hollowing.yml at master · SigmaHQ/sigma
Generic Signature Format for SIEM Systems. Contribute to SigmaHQ/sigma development by creating an account on GitHub.
I published a set of Python scripts that I use to integrate @dfir_iris , @MISPProject and @TimesketchProj #DFIR #CSIRT https://github.com/cudeso/dfir-iris-misp-timesketch
🗣cudeso
🎖@malwr
🗣cudeso
🎖@malwr