[1/n] Today I'm sharing the details of a research done by vaber_b, legezo, Ilya Borisov and myself on a UEFI firmware implant found in the wild, dubbed #MoonBounce. We assess that this formerly unknown threat is the work of the infamous #APT41. A 🧵
https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
🗣_marklech_


🎖@malwr

This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.
https://github.com/infosecn1nja/Red-Teaming-Toolkit
🗣Dinosn


🎖@malwr

My research work from last year summarized in the blog post: Evolved phishing: Device registration trick adds to phishers’ toolbox for victims without MFA
https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/
🗣Pawp81


🎖@malwr

3.0: The Next Chapter. Today, we’re proud to announce the release of Binary Ninja 3.0. More than 6 months in the making, Binary Ninja 3.0 represents a huge leap forward in analysis and usability. Pseudo C decompilation, stack view and an overhauled UI https://binary.ninja/2022/01/27/3.0-the-next-chapter.html
🗣vector35


🎖@malwr

65 page history of REvil looks really nice
https://t.co/4hvdloS9Vo?s=09
🗣maldr0id


🎖@malwr

Day 29 #100DaysofYARA using maths; counting the number of resources in a PE that have MZ headers!

I can only count to 5 on one hand so thats why the counter went this high

https://github.com/g-les/100DaysofYARA/blob/main/100_days_of_yara.yar
🗣greglesnewich


🎖@malwr

Process Hollowing Alert is now in #SIGMA.

Sysmon Event ID 25 with a type of “image is replaced”
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_process_hollowing.yml
🗣SecurePeacock


🎖@malwr

Stop Windows Defender programmatically
https://github.com/lab52io/StopDefender
🗣pentest_swissky


🎖@malwr

I published a set of Python scripts that I use to integrate @dfir_iris , @MISPProject and @TimesketchProj #DFIR #CSIRT https://github.com/cudeso/dfir-iris-misp-timesketch
🗣cudeso


🎖@malwr

#MalwareAnalysis: Detecting Process Hollowing
The first pattern to look for are any calls to create processes in a suspended state:

> CreateProcessA
"dwCreationFlags" set 0x04 CREATE_SUSPENDED

Purpose is to disguise malicious code in a legit exe by replacing the contents.

Following the process being started in a suspended state... (usually svchost.exe but who's counting). Then there are API calls to native/non native APIs:

> ZwUnmapviewofsection
> virtualallocex
> writeprocessmemory
> setthreadcontext
> NTgetcontextthread
> ntreadvirtualmemory

Other ones:
> NTResumethread
> NTwritevirtualmemory
> ntsetcontextthread

The logic is to look for signs of processes being started in suspended state - then the process being hollowed, replaced with "malicious" contents and resuming of execution.

🗣inversecos


🎖@malwr

Driver loader for bypassing Windows x64 Driver Signature Enforcement. #Hack #108 (2016)
https://github.com/hfiref0x/TDL
🗣OPOSEC


🎖@malwr

Have you noticed that IDA sometimes renames and marks up local variables automatically? Read up on how Parameter identification and tracking aka PIT works:

https://hex-rays.com/blog/igors-tip-of-the-week-74-parameter-identification-and-tracking-pit/

#IgorsTipOfTheWeek #IDAtips #IDAPro
🗣HexRaysSA


🎖@malwr

I wrote a C++ library to parse Windows minidumps (.dump /mx) for another project; go check it out 🙏🏽!
https://github.com/0vercl0k/udmp-parser/
🗣0vercl0k


🎖@malwr

As a YuGiOh fan I couldn't resist reverse engineering the new "Master Duel" game :)

I used Cpp2Il to generate the C# DLL and used the symbols to import the functions into GameAssembly.dll.

If you want to tag along, here's my current 1.0.1 script: https://github.com/ioncodes/master-duel
🗣layle_ctf


🎖@malwr

Curious how to dump the WhisperGate wiper? This blog provides a step-by-step analysis, and shows how to load the third stage, since the original URL does not contain the payload anymore.

Link: https://maxkersten.nl/binary-analysis-course/malware-analysis/dumping-whispergates-wiper-from-an-eazfuscator-obfuscated-loader/

ℹ️ Sent from one of our channel members


🎖@malwr

RonnieColemanYARAParser is a script that uses YARA's upcoming console module to bulk extract arbitrary features from files and jam them in a table for quick analysis. Have fun, but keep in mind it's an experiment. #100DaysofYARA
https://github.com/stvemillertime/RonnieColemanYARAParser
🗣stvemillertime


🎖@malwr

Releasing My first repo in months, using thread description to hide the shellcode, xor encryption, thread stack spoofing, and more ...
#bypassav #cobaltstrike #imbacm
https://github.com/ORCA666/T.D.P
🗣ORCA6665


🎖@malwr

released another poc on KernelCallbackTable hijacking to run your shellcode, inspired by this paper here: https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
the repo can be found here:
https://github.com/ORCA666/KCTHIJACK
#bypassav #shellcode #poc

🗣ORCA6665


🎖@malwr