Releasing My first repo in months, using thread description to hide the shellcode, xor encryption, thread stack spoofing, and more ...
#bypassav #cobaltstrike #imbacm
https://github.com/ORCA666/T.D.P
🗣ORCA6665


🎖@malwr

released another poc on KernelCallbackTable hijacking to run your shellcode, inspired by this paper here: https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
the repo can be found here:
https://github.com/ORCA666/KCTHIJACK
#bypassav #shellcode #poc

🗣ORCA6665


🎖@malwr

Mandiant's FLARE team is hiring malware reverse engineers!

https://jobs.smartrecruiters.com/Mandiant/743999802041669
🗣mrdurakovich


🎖@malwr

EvilSelenium - This project weaponizes Selenium to attack Chrome. Dump saved credentials, cookies, take (authenticated) screenshots, dump emails from gmail/o365 or chats from Whatsapp and exfiltrate & download files. ENJOY.
https://github.com/mrd0x/EvilSelenium
🗣mrd0x


🎖@malwr

I did a bit of research and learning and have blogged about it an released some code. I wanted to understand Nirvana Hooks, specifically in x86. So I did a thing:
https://blog.xenoscr.net/2022/01/17/x86-Nirvana-Hooks.html
🗣xenosCR


🎖@malwr

TIL.. want all images from a docx? Rename it .zip and extract the media folder.
🗣Jean_Maes_1994


🎖@malwr

Detect It Easy, or abbreviated "DIE" is a program for determining types of files.

3.04


#hacker #infosec #malware #hacking #programming #reversing #opensource #linux #linuxsecurity #unix #macos #detectiteasy #android #cybersecurity
https://github.com/horsicq/Detect-It-Easy
🗣horsicq


🎖@malwr

The second article of MAS (Malware Analysis Series) is available for reading! The PDF version (96 pages) can be downloaded from:

https://exploitreversing.com/2022/02/03/malware-analysis-series-mas-article-2/

Have an excellent day.

#malware #malwareanalysis #reverseengineering #programming #threathunting
🗣ale_sp_brazil


🎖@malwr

Published a new Repo Today, first one on gitlab ;) combining more than more tech to bypass av products:
u can check it here:
#bypassav #shellcode #payload
https://gitlab.com/ORCA666/3in1
🗣ORCA6665


🎖@malwr

Is it possible to start a process as SYSTEM using only CreateFile and WriteFile? Yes

Spoiler: Write a custom RPC client and create a temporary service using \\.\pipe\ntsvcs 🙂

https://www.x86matthew.com/view_post?id=create_svc_rpc
🗣x86matthew


🎖@malwr

Great report by threatintel

- The TA leveraged PowerShell, WMIC, ProcDump, LSASS, PsExec, AnyDesk, Winrar, and there is even evidence of it leveraging EternalBlue exploits in the backdoor.
- The campaign lasted around 18 months

*Yara rules included
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/china-apt-antlion-taiwan-financial-attacks
🗣nas_bench


🎖@malwr

EmbedExeLnk - Embedding an EXE inside a LNK with automatic execution

https://www.x86matthew.com/view_post?id=embed_exe_lnk
🗣x86matthew


🎖@malwr

We recently discovered an APT group leveraging a 0-day in Zimbra to try and steal e-mails from targeted user. We just shared details on the @Volexity blog. This is an interesting case where an XSS vulnerability is being used to facilitate cyber espionage.
https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/
🗣stevenadair


🎖@malwr

The ultimate backdoor doesn't exi-
🗣DuchyRE


🎖@malwr

a tiny DNS resolver
full program: https://github.com/jvns/tiny-resolver
🗣b0rk


🎖@malwr

Reversing Go Tip 0x0001. Here is an Assembler view of a simple, "Hello, world!" and "Hello, world again!" bin. Notice with modern Go the values about to be passed into Fprintln are in r8 on x64.
🗣mytechnotalent


🎖@malwr

My latest msdt uac bypass has been added to UACME. Thx @hFireF0X!
https://github.com/hfiref0x/UACME
🗣EmericNasi


🎖@malwr