I did a bit of research and learning and have blogged about it an released some code. I wanted to understand Nirvana Hooks, specifically in x86. So I did a thing:
https://blog.xenoscr.net/2022/01/17/x86-Nirvana-Hooks.html
🗣xenosCR


🎖@malwr

TIL.. want all images from a docx? Rename it .zip and extract the media folder.
🗣Jean_Maes_1994


🎖@malwr

Detect It Easy, or abbreviated "DIE" is a program for determining types of files.

3.04


#hacker #infosec #malware #hacking #programming #reversing #opensource #linux #linuxsecurity #unix #macos #detectiteasy #android #cybersecurity
https://github.com/horsicq/Detect-It-Easy
🗣horsicq


🎖@malwr

The second article of MAS (Malware Analysis Series) is available for reading! The PDF version (96 pages) can be downloaded from:

https://exploitreversing.com/2022/02/03/malware-analysis-series-mas-article-2/

Have an excellent day.

#malware #malwareanalysis #reverseengineering #programming #threathunting
🗣ale_sp_brazil


🎖@malwr

Published a new Repo Today, first one on gitlab ;) combining more than more tech to bypass av products:
u can check it here:
#bypassav #shellcode #payload
https://gitlab.com/ORCA666/3in1
🗣ORCA6665


🎖@malwr

Is it possible to start a process as SYSTEM using only CreateFile and WriteFile? Yes

Spoiler: Write a custom RPC client and create a temporary service using \\.\pipe\ntsvcs 🙂

https://www.x86matthew.com/view_post?id=create_svc_rpc
🗣x86matthew


🎖@malwr

Great report by threatintel

- The TA leveraged PowerShell, WMIC, ProcDump, LSASS, PsExec, AnyDesk, Winrar, and there is even evidence of it leveraging EternalBlue exploits in the backdoor.
- The campaign lasted around 18 months

*Yara rules included
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/china-apt-antlion-taiwan-financial-attacks
🗣nas_bench


🎖@malwr

EmbedExeLnk - Embedding an EXE inside a LNK with automatic execution

https://www.x86matthew.com/view_post?id=embed_exe_lnk
🗣x86matthew


🎖@malwr

We recently discovered an APT group leveraging a 0-day in Zimbra to try and steal e-mails from targeted user. We just shared details on the @Volexity blog. This is an interesting case where an XSS vulnerability is being used to facilitate cyber espionage.
https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/
🗣stevenadair


🎖@malwr

The ultimate backdoor doesn't exi-
🗣DuchyRE


🎖@malwr

a tiny DNS resolver
full program: https://github.com/jvns/tiny-resolver
🗣b0rk


🎖@malwr

Reversing Go Tip 0x0001. Here is an Assembler view of a simple, "Hello, world!" and "Hello, world again!" bin. Notice with modern Go the values about to be passed into Fprintln are in r8 on x64.
🗣mytechnotalent


🎖@malwr

My latest msdt uac bypass has been added to UACME. Thx @hFireF0X!
https://github.com/hfiref0x/UACME
🗣EmericNasi


🎖@malwr

For quite some time I wanted a command-line tool to calculate the entropy of files that was fast and supported Windows. I ended up coding my own.🙂 It could be useful for people in #malwareanalysis, #forensics, etc.
https://github.com/merces/entropy
🗣mer0x36


🎖@malwr

Hours of troubleshooting and some more evenings went into a Nim port of reflective PE loading. Learned a lot porting that one, special thanks to @am0nsec and @_EthicalChaos_ for answering all my questions regarding to issues! 🤓

https://github.com/S3cur3Th1sSh1t/Nim-RunPE
🗣ShitSecure


🎖@malwr

HijackFileHandle - Hijack a file in a remote process without code injection

A covert method of intercepting data from remote file streams (log files, etc)

https://www.x86matthew.com/view_post?id=hijack_file_handle
🗣x86matthew


🎖@malwr

Indicators of Compromise Associated with LockBit 2.0
Ransomware 🕵️👾🖥️🔐

https://www.ic3.gov/Media/News/2022/220204.pdf
🗣CryptoInsane


🎖@malwr