For quite some time I wanted a command-line tool to calculate the entropy of files that was fast and supported Windows. I ended up coding my own.🙂 It could be useful for people in #malwareanalysis, #forensics, etc.
https://github.com/merces/entropy
🗣mer0x36
🎖@malwr
https://github.com/merces/entropy
🗣mer0x36
🎖@malwr
GitHub
GitHub - merces/entropy: CLI program to calculate the entropy of files
CLI program to calculate the entropy of files. Contribute to merces/entropy development by creating an account on GitHub.
Hours of troubleshooting and some more evenings went into a Nim port of reflective PE loading. Learned a lot porting that one, special thanks to @am0nsec and @_EthicalChaos_ for answering all my questions regarding to issues! 🤓
https://github.com/S3cur3Th1sSh1t/Nim-RunPE
🗣ShitSecure
🎖@malwr
https://github.com/S3cur3Th1sSh1t/Nim-RunPE
🗣ShitSecure
🎖@malwr
This media is not supported in your browser
VIEW IN TELEGRAM
HijackFileHandle - Hijack a file in a remote process without code injection
A covert method of intercepting data from remote file streams (log files, etc)
https://www.x86matthew.com/view_post?id=hijack_file_handle
🗣x86matthew
🎖@malwr
A covert method of intercepting data from remote file streams (log files, etc)
https://www.x86matthew.com/view_post?id=hijack_file_handle
🗣x86matthew
🎖@malwr
👍1
Indicators of Compromise Associated with LockBit 2.0
Ransomware 🕵️👾🖥️🔐
https://www.ic3.gov/Media/News/2022/220204.pdf
🗣CryptoInsane
🎖@malwr
Ransomware 🕵️👾🖥️🔐
https://www.ic3.gov/Media/News/2022/220204.pdf
🗣CryptoInsane
🎖@malwr
If anyone wants practice with packet analysis, here’s a lab I give to my Security class each semester. Includes a real PCAP from @defcon #PcapsOrItDidntHappen
https://github.com/tuftsdev/DefenseAgainstTheDarkArts/blob/gh-pages/labs/lab02-pcaps.md
🗣0xmchow
🎖@malwr
https://github.com/tuftsdev/DefenseAgainstTheDarkArts/blob/gh-pages/labs/lab02-pcaps.md
🗣0xmchow
🎖@malwr
GitHub
DefenseAgainstTheDarkArts/labs/lab02-pcaps.md at gh-pages · tuftsdev/DefenseAgainstTheDarkArts
Contribute to tuftsdev/DefenseAgainstTheDarkArts development by creating an account on GitHub.
I've updated the Antivirus Event Analysis Cheat Sheet to v1.9.0
- updates in all sections
- MS Exchange exploitation related indicators
- updated identifiers
Could @SophosLabs please fix the spelling of Webshel+l?
https://www.nextron-systems.com/2022/02/06/antivirus-event-analysis-cheat-sheet-v1-9-0/
🗣cyb3rops
🎖@malwr
- updates in all sections
- MS Exchange exploitation related indicators
- updated identifiers
Could @SophosLabs please fix the spelling of Webshel+l?
https://www.nextron-systems.com/2022/02/06/antivirus-event-analysis-cheat-sheet-v1-9-0/
🗣cyb3rops
🎖@malwr
Decoding Cobalt Strike: Understanding Payloads
https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/
🗣pentest_swissky
🎖@malwr
https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/
🗣pentest_swissky
🎖@malwr
Gendigital
Decoding Cobalt Strike: Understanding payloads
Identifying and Parsing Cobalt Payloads
IDACode - An Integration For IDA And VS Code Which Connects Both To Easily Execute And Debug IDAPython Scripts https://ift.tt/9jM4DvH #cybersecurity #bugbountytips #hacking #tools
🗣santosomar
🎖@malwr
🗣santosomar
🎖@malwr
🔥4
The Walmart Global Tech security team write about the Sugar ransomware operation, which appears to actively target individual computers rather than entire enterprises. https://medium.com/walmartglobaltech/sugar-ransomware-a-new-raas-a5d94d58d9fb
🗣virusbtn
🎖@malwr
🗣virusbtn
🎖@malwr
Cuckoo and CAPE sandbox evasion in one legitimate Windows API function call? It is possible due to issues we found in Cuckoo and CAPE monitor.
@CapeSandbox @cuckoosandbox
https://research.checkpoint.com/2022/invisible-cuckoo-cape-sandbox-evasion
🗣_CPResearch_
🎖@malwr
@CapeSandbox @cuckoosandbox
https://research.checkpoint.com/2022/invisible-cuckoo-cape-sandbox-evasion
🗣_CPResearch_
🎖@malwr
Check Point Research
Invisible Sandbox Evasion - Check Point Research
Cuckoo and CAPE sandbox evasion in one legitimate Windows API function call? It is possible due to issues we found in Cuckoo and CAPE monitor.
Me watching somebody try to decrease Emotet AV detection by uploading stuff to VirusTotal 😅
🗣GossiTheDog
🎖@malwr
🗣GossiTheDog
🎖@malwr
Decrypted: Avast releases #free #decryptor for the #TargetCompany #ransomware: #AvastDecoded
https://decoded.avast.io/threatresearch/decrypted-targetcompany-ransomware/
🗣AvastThreatLabs
🎖@malwr
https://decoded.avast.io/threatresearch/decrypted-targetcompany-ransomware/
🗣AvastThreatLabs
🎖@malwr
Gendigital
Decrypted: TargetCompany ransomware
TargetCompany Ransomware Analysis Details
👍2
Another new post to start the week! This time around I take a look at a RTF document that exploits MS Office Equation Editor to deploy AgentTesla:
#malware #agenttesla
https://forensicitguy.github.io/agenttesla-rtf-dotnet-tradecraft/
🗣ForensicITGuy
🎖@malwr
#malware #agenttesla
https://forensicitguy.github.io/agenttesla-rtf-dotnet-tradecraft/
🗣ForensicITGuy
🎖@malwr
Tony Lambert
AgentTesla From RTF Exploitation to .NET Tradecraft
When adversaries buy and deploy threats like AgentTesla you often see this functional and entertaining chain of older exploitation activity with some .NET framework tradecraft you’d expect from some modern implants. In this post I’ll walk through analyzing…
Guess I will get to see how my theory on this will play out in real life now
https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
🗣HackingLZ
🎖@malwr
https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
🗣HackingLZ
🎖@malwr
TECHCOMMUNITY.MICROSOFT.COM
Helping users stay safe: Blocking internet macros by default in Office | Microsoft Community Hub
To protect our customers, users will no longer be able to enable macros obtained from the internet.
This media is not supported in your browser
VIEW IN TELEGRAM
Just released a new, fast-paced, interactive binary patching plugin for IDA Pro. Check out a small blurb about it on the @HexRaysSA blog: https://hex-rays.com/blog/introducing-the-patching-plugin/
Code: https://github.com/gaasedelen/patching
🗣ret2systems
🎖@malwr
Code: https://github.com/gaasedelen/patching
🗣ret2systems
🎖@malwr
Microsoft blocks VBA macros originating from Internet based on MOTW flag.
I'm now sharing a tool presenting risk for MOTW bypasses, which will play crucial role in evading MS default setting and smuggle macros back in.
Threat Actors already do that.
https://github.com/mgeeky/PackMyPayload
🗣mariuszbit
🎖@malwr
I'm now sharing a tool presenting risk for MOTW bypasses, which will play crucial role in evading MS default setting and smuggle macros back in.
Threat Actors already do that.
https://github.com/mgeeky/PackMyPayload
🗣mariuszbit
🎖@malwr
👍2
This media is not supported in your browser
VIEW IN TELEGRAM
How can we run arbitrary code without allocating/overwriting executable memory? We "borrow" (abuse) instructions from ntdll.dll!
https://www.x86matthew.com/view_post?id=windows_no_exec
🗣x86matthew
🎖@malwr
https://www.x86matthew.com/view_post?id=windows_no_exec
🗣x86matthew
🎖@malwr