Blog: Detecting Karakurt – an extortion focused threat actor by NCC Group's Cyber Incident Response Team members - Simon Biggs, Richard Footman and Michael Mullen -
https://research.nccgroup.com/2022/02/17/detecting-karakurt-an-extortion-focused-threat-actor/ #Karakurt
🗣NCCGroupInfosec
🎖@malwr
https://research.nccgroup.com/2022/02/17/detecting-karakurt-an-extortion-focused-threat-actor/ #Karakurt
🗣NCCGroupInfosec
🎖@malwr
I wrote API hook for simple Windows 10 x86 using Capstone engine 🎃
https://github.com/CaptanMoss/API-Hooking-on-Windows10
🗣ereborlugimli
🎖@malwr
https://github.com/CaptanMoss/API-Hooking-on-Windows10
🗣ereborlugimli
🎖@malwr
GitHub
GitHub - CaptanMoss/API-Hooking-on-Windows10: API Hooking on Windows 10
API Hooking on Windows 10. Contribute to CaptanMoss/API-Hooking-on-Windows10 development by creating an account on GitHub.
Added 2 PoCs for HackSys Extreme Vulnerable Driver to KernelWritePoCs.
One tries to get SYSTEM with SeCreateTokenPrivilege.
The other tries to get SYSTEM by secondary logon feature with SeCreateTokenPrivilege and SeImpersonatePrivilege.
https://github.com/daem0nc0re/PrivFu#KernelWritePoCs
🗣daem0nc0re
🎖@malwr
One tries to get SYSTEM with SeCreateTokenPrivilege.
The other tries to get SYSTEM by secondary logon feature with SeCreateTokenPrivilege and SeImpersonatePrivilege.
https://github.com/daem0nc0re/PrivFu#KernelWritePoCs
🗣daem0nc0re
🎖@malwr
Our software engineer Boyan Milanov introduces Maat, a low-level symbolic execution framework based on Ghidra's IR language p-code.
https://blog.trailofbits.com/2022/02/23/maat-symbolic-execution-made-easy/
🗣trailofbits
🎖@malwr
https://blog.trailofbits.com/2022/02/23/maat-symbolic-execution-made-easy/
🗣trailofbits
🎖@malwr
The Trail of Bits Blog
Maat: Symbolic execution made easy
We have released Maat, a cross-architecture, multi-purpose, and user-friendly symbolic execution framework. It provides common symbolic execution capabilities such as dynamic symbolic execution (DSE), taint analysis, binary instrumentation, environment simulation…
Windows Drivers Reverse Engineering Methodology : credits @Void_Sec
https://voidsec.com/windows-drivers-reverse-engineering-methodology/
🗣binitamshah
🎖@malwr
https://voidsec.com/windows-drivers-reverse-engineering-methodology/
🗣binitamshah
🎖@malwr
VoidSec
Windows Drivers Reverse Engineering Methodology
Methodology for reverse engineering Windows drivers, finding vulnerabilities and understanding their exploitability.
MISC study notes about ARM AArch64 Assembly and the ARM Trusted Execution Environment (TEE) : credits @0xricksanchez
Ref : Dissecting and exploiting ELF files :
https://0x434b.dev/misc-study-notes-about-arm-aarch64-assembly-and-the-arm-trusted-execution-environment-tee/
🗣binitamshah
🎖@malwr
Ref : Dissecting and exploiting ELF files :
https://0x434b.dev/misc-study-notes-about-arm-aarch64-assembly-and-the-arm-trusted-execution-environment-tee/
🗣binitamshah
🎖@malwr
Low-level adventures
MISC study notes about ARM AArch64 Assembly and the ARM Trusted Execution Environment (TEE)
Disclaimer: These are unfiltered study notes mostly for myself. Guaranteed not to be error free. So if you did land here, managed to get to the end of it and found some mistakes just hit me up, I'd love to know what's wrong :)
AArch64 - Preface
Basic assembly…
AArch64 - Preface
Basic assembly…
Fuzz your Rust code with a Rust fuzzer using the new LibAFL cargo extension
https://github.com/AFLplusplus/cargo-libafl
🗣andreafioraldi
🎖@malwr
https://github.com/AFLplusplus/cargo-libafl
🗣andreafioraldi
🎖@malwr
GitHub
GitHub - AFLplusplus/cargo-libafl: Fuzz Rust code with LibAFL
Fuzz Rust code with LibAFL. Contribute to AFLplusplus/cargo-libafl development by creating an account on GitHub.
Faking a positive COVID Test : https://labs.f-secure.com/blog/faking-a-positive-covid-test credits @Yogehi
🗣binitamshah
🎖@malwr
🗣binitamshah
🎖@malwr
My #BinaryNinja plugin obfuscation_detection can now identify uncommon instruction sequences (such as MBAs or weird calculations) based on stochastic n-gram analysis. Right now the feature works for x86-64; an architecture-agnostic version follows soon.
https://github.com/mrphrazer/obfuscation_detection/
🗣mr_phrazer
🎖@malwr
https://github.com/mrphrazer/obfuscation_detection/
🗣mr_phrazer
🎖@malwr
malware-and-exploitdev-resources : It serves as a list of resources, and other things that aid in malware analysis / dev and exploit dev
https://github.com/evilbuffer/malware-and-exploitdev-resources
🗣binitamshah
🎖@malwr
https://github.com/evilbuffer/malware-and-exploitdev-resources
🗣binitamshah
🎖@malwr
👍1
curl-impersonate : A special compilation of curl that makes it impersonate Chrome & Firefox : https://github.com/lwthiker/curl-impersonate
Making curl impersonate Firefox : https://lwthiker.com/reversing/2022/02/17/curl-impersonate-firefox.html
Impersonating Chrome, too : https://lwthiker.com/reversing/2022/02/20/impersonating-chrome-too.html
🗣binitamshah
🎖@malwr
Making curl impersonate Firefox : https://lwthiker.com/reversing/2022/02/17/curl-impersonate-firefox.html
Impersonating Chrome, too : https://lwthiker.com/reversing/2022/02/20/impersonating-chrome-too.html
🗣binitamshah
🎖@malwr
VMProtect Devirtualization: An experimental dynamic approach to devirtualize pure functions protected by VMProtect 3.x
https://github.com/JonathanSalwan/VMProtect-devirtualization
🗣JonathanSalwan
🎖@malwr
https://github.com/JonathanSalwan/VMProtect-devirtualization
🗣JonathanSalwan
🎖@malwr
GitHub
GitHub - JonathanSalwan/VMProtect-devirtualization: Playing with the VMProtect software protection. Automatic deobfuscation of…
Playing with the VMProtect software protection. Automatic deobfuscation of pure functions using symbolic execution and LLVM. - JonathanSalwan/VMProtect-devirtualization
👍1
In Depth Analysis of HermeticWiper - New Destructive Malware (Used In Cyber Attacks on Ukraine ) :https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/ credits @juanandres_gs
Threat Advisory : HermeticWiper : credits @asheermalhotra
https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
🗣binitamshah
🎖@malwr
Threat Advisory : HermeticWiper : credits @asheermalhotra
https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
🗣binitamshah
🎖@malwr
SentinelOne
HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine
A new malware is attacking Ukrainian organizations and erasing Windows devices. In this early analysis, we provide technical details, IOCS and hunting rules.
Make a USB Rubber Ducky with less than $3
'The best thing is, USB Rubber Ducky is not detected as a flash drive, but as a keyboard.'
#infosec #redteam #pentest
https://infosecwriteups.com/make-usb-rubber-ducky-with-less-than-3-fa72dac9e4de
🗣CyberWarship
🎖@malwr
'The best thing is, USB Rubber Ducky is not detected as a flash drive, but as a keyboard.'
#infosec #redteam #pentest
https://infosecwriteups.com/make-usb-rubber-ducky-with-less-than-3-fa72dac9e4de
🗣CyberWarship
🎖@malwr
Threat updates – A new IcedID GZipLoader variant
https://threatray.com/blog/a-new-icedid-gziploader-variant/
ℹ️ Sent from one of our channel members
🎖@malwr
https://threatray.com/blog/a-new-icedid-gziploader-variant/
ℹ️ Sent from one of our channel members
🎖@malwr
Threatray
Threat updates: A new IcedID GZipLoader variant | Threatray
IcedId is a modular banking Trojan discovered in 2017.
#Emotet strikes with new TTPs 🚨
Project X elevated to Project Y
#DFIR analysis report covers the new infection flow:
Initial Access
Execution
Privilege Escalation
Persistence
Defense Evasion
https://www.cynet.com/attack-techniques-hands-on/new-wave-of-emotet-when-project-x-turns-into-y/
🗣Max_Mal_
🎖@malwr
Project X elevated to Project Y
#DFIR analysis report covers the new infection flow:
Initial Access
Execution
Privilege Escalation
Persistence
Defense Evasion
https://www.cynet.com/attack-techniques-hands-on/new-wave-of-emotet-when-project-x-turns-into-y/
🗣Max_Mal_
🎖@malwr
Cynet XDR | Autonomous Breach Protection
New Wave of Emotet - When Project X Turns Into Y - Cynet XDR | Autonomous Breach Protection