Decrypted: Avast releases #free #decryptor for the #TargetCompany #ransomware: #AvastDecoded
https://decoded.avast.io/threatresearch/decrypted-targetcompany-ransomware/
🗣AvastThreatLabs
🎖@malwr
https://decoded.avast.io/threatresearch/decrypted-targetcompany-ransomware/
🗣AvastThreatLabs
🎖@malwr
Gendigital
Decrypted: TargetCompany ransomware
TargetCompany Ransomware Analysis Details
👍2
Another new post to start the week! This time around I take a look at a RTF document that exploits MS Office Equation Editor to deploy AgentTesla:
#malware #agenttesla
https://forensicitguy.github.io/agenttesla-rtf-dotnet-tradecraft/
🗣ForensicITGuy
🎖@malwr
#malware #agenttesla
https://forensicitguy.github.io/agenttesla-rtf-dotnet-tradecraft/
🗣ForensicITGuy
🎖@malwr
Tony Lambert
AgentTesla From RTF Exploitation to .NET Tradecraft
When adversaries buy and deploy threats like AgentTesla you often see this functional and entertaining chain of older exploitation activity with some .NET framework tradecraft you’d expect from some modern implants. In this post I’ll walk through analyzing…
Guess I will get to see how my theory on this will play out in real life now
https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
🗣HackingLZ
🎖@malwr
https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
🗣HackingLZ
🎖@malwr
TECHCOMMUNITY.MICROSOFT.COM
Helping users stay safe: Blocking internet macros by default in Office | Microsoft Community Hub
To protect our customers, users will no longer be able to enable macros obtained from the internet.
This media is not supported in your browser
VIEW IN TELEGRAM
Just released a new, fast-paced, interactive binary patching plugin for IDA Pro. Check out a small blurb about it on the @HexRaysSA blog: https://hex-rays.com/blog/introducing-the-patching-plugin/
Code: https://github.com/gaasedelen/patching
🗣ret2systems
🎖@malwr
Code: https://github.com/gaasedelen/patching
🗣ret2systems
🎖@malwr
Microsoft blocks VBA macros originating from Internet based on MOTW flag.
I'm now sharing a tool presenting risk for MOTW bypasses, which will play crucial role in evading MS default setting and smuggle macros back in.
Threat Actors already do that.
https://github.com/mgeeky/PackMyPayload
🗣mariuszbit
🎖@malwr
I'm now sharing a tool presenting risk for MOTW bypasses, which will play crucial role in evading MS default setting and smuggle macros back in.
Threat Actors already do that.
https://github.com/mgeeky/PackMyPayload
🗣mariuszbit
🎖@malwr
👍2
This media is not supported in your browser
VIEW IN TELEGRAM
How can we run arbitrary code without allocating/overwriting executable memory? We "borrow" (abuse) instructions from ntdll.dll!
https://www.x86matthew.com/view_post?id=windows_no_exec
🗣x86matthew
🎖@malwr
https://www.x86matthew.com/view_post?id=windows_no_exec
🗣x86matthew
🎖@malwr
Today we published a new report on the new ModifiedElephant APT, and the years of attacks against groups and individuals in India.
Blog: https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/
Full Report: https://assets.sentinelone.com/sentinellabs-apt/modified-elephant-apt
🗣TomHegel
🎖@malwr
Blog: https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/
Full Report: https://assets.sentinelone.com/sentinellabs-apt/modified-elephant-apt
🗣TomHegel
🎖@malwr
SentinelOne
ModifiedElephant APT and a Decade of Fabricating Evidence
A previously unreported threat actor has been targeting civil society for over a decade. Read about how it operates and its relationships to other threats.
Good news for all the infosec community. Now you can Export/Import VT Collections into/from MISP Events 🎉 by
@thetravelr https://blog.virustotal.com/2022/02/misp-and-vt-collections.html
🗣virustotal
🎖@malwr
@thetravelr https://blog.virustotal.com/2022/02/misp-and-vt-collections.html
🗣virustotal
🎖@malwr
FTK Imager Version 4.7.1 released >>
https://accessdata.com/product-download/ftk-imager-version-4-7-1
🗣chadtilbury
🎖@malwr
https://accessdata.com/product-download/ftk-imager-version-4-7-1
🗣chadtilbury
🎖@malwr
Exterro
Data Risk Management - Data Discovery & Privacy Platform | Exterro
Exterro's powerful data risk management platform unifies e-discovery, privacy, data governance, digital forensics, and cybersecurity compliance to…
Rewrote Simple Process Injection using HellsGate in C# for fun and learning :)
It involved parsing ntdll to find and map the syscall ids for the involved functions and use the syscall numbers to directly invoke the the corresponding syscall.
Github repo: https://github.com/sbasu7241/HellsGate
🗣SoumyadeepBas12
🎖@malwr
It involved parsing ntdll to find and map the syscall ids for the involved functions and use the syscall numbers to directly invoke the the corresponding syscall.
Github repo: https://github.com/sbasu7241/HellsGate
🗣SoumyadeepBas12
🎖@malwr
Here is my post about orphan file name entries found on exFAT volumes written using Linux or macOS. This means that file names (or their parts) of deleted files having their directory entries partially overwritten can be recovered. #DFIR
https://dfir.ru/2022/02/11/exfat-orphan-file-name-entries/
🗣errno_fail
🎖@malwr
https://dfir.ru/2022/02/11/exfat-orphan-file-name-entries/
🗣errno_fail
🎖@malwr
My DFIR Blog
exFAT: orphan file name entries
The exFAT file system was designed with Unicode file names and optional vendor-specific extensions in mind. To keep things simple, the file system specification allows the usage of multiple directo…
Exploring Windows UAC Bypasses : Techniques and Detection Strategies :
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
🗣binitamshah
🎖@malwr
https://elastic.github.io/security-research/whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/
🗣binitamshah
🎖@malwr
RE tip of the day: There are many PDF entries that can be misused by malware. For example, /Action with a /Launch argument can be used to execute an application specified with a /F entry. Arguments can be added using /P entry.
#infosec #cybersecurity #malware #reverseengineering
🗣re_and_more
🎖@malwr
#infosec #cybersecurity #malware #reverseengineering
🗣re_and_more
🎖@malwr
The MISP cheat sheet has been updated with a representation overview showing how MISP is used to model a security incident. It's a usually a nifty overview when you don't have the time to read all of the documentation. #CTI #ThreatIntelligence
https://www.misp-project.org/misp-training/cheatsheet.pdf
🗣MISPProject
🎖@malwr
https://www.misp-project.org/misp-training/cheatsheet.pdf
🗣MISPProject
🎖@malwr
This media is not supported in your browser
VIEW IN TELEGRAM
WATCH: Discover the social engineering tactics employed by #APT36 or #EarthKarkaddan actors in our latest video.
Read our full report here:
https://research.trendmicro.com/EarthKarkaddan
🗣TrendMicroRSRCH
🎖@malwr
Read our full report here:
https://research.trendmicro.com/EarthKarkaddan
🗣TrendMicroRSRCH
🎖@malwr
New #PEsieve/#HollowsHunter (v0.3.4): https://github.com/hasherezade/pe-sieve/releases/ & https://github.com/hasherezade/hollows_hunter/releases - with threads' callstack scan. Check it out!
🗣hasherezade
🎖@malwr
🗣hasherezade
🎖@malwr