A Detailed Analysis of the LockBit Ransomware : https://lifars.com/wp-content/uploads/2022/02/LockBitRansomware_Whitepaper.pdf (pdf)
🗣binitamshah
🎖@malwr
🗣binitamshah
🎖@malwr
If you're looking at #Golang binaries in IDA @SentinelOne's is by far one of the most useful tools. (cc: @LabsSentinel, @juanandres_gs @JusticeRage )
https://github.com/SentineLabs/AlphaGolang
🗣silascutler
🎖@malwr
https://github.com/SentineLabs/AlphaGolang
🗣silascutler
🎖@malwr
GitHub
GitHub - SentineLabs/AlphaGolang: IDApython Scripts for Analyzing Golang Binaries
IDApython Scripts for Analyzing Golang Binaries. Contribute to SentineLabs/AlphaGolang development by creating an account on GitHub.
#HermeticWiper is a #malware targeting #Ukraine by wiping every machine disk on its path. Here the @zlab_team dissection and analysis 👇👇
https://yoroi.company/research/diskkill-hermeticwiper-a-disruptive-cyber-weapon-targeting-ukraines-critical-infrastructures/
🗣Marco_Ramilli
🎖@malwr
https://yoroi.company/research/diskkill-hermeticwiper-a-disruptive-cyber-weapon-targeting-ukraines-critical-infrastructures/
🗣Marco_Ramilli
🎖@malwr
New Jetpack Site
DiskKill/HermeticWiper, a disruptive cyber-weapon targeting Ukraine’s critical infrastructures - New Jetpack Site
Introduction During the early hours of Thursday 24 February 2022, Russia launched an attack on the country of Ukraine due to the ongoing dispute over its possible inclusion within NATO countries. This event has led to a tense geo-political climate within…
I was honored to present on Program Analysis with Ghidra for @sergeybratus's @DartmouthCS course, "Basics of Reverse Engineering" yesterday -
Basic program analysis concepts, Ghidra API tour, demo code, SLEIGH, and opinionated takes on RE -
Slides:
🐲💻
https://github.com/sergeybratus/RE-basics-W22/blob/main/GHIDRA-For-Dartmouth.pdf
🗣0xAlexei
🎖@malwr
Basic program analysis concepts, Ghidra API tour, demo code, SLEIGH, and opinionated takes on RE -
Slides:
🐲💻
https://github.com/sergeybratus/RE-basics-W22/blob/main/GHIDRA-For-Dartmouth.pdf
🗣0xAlexei
🎖@malwr
GitHub
RE-basics-W22/GHIDRA-For-Dartmouth.pdf at main · sergeybratus/RE-basics-W22
Basics of Reverse Engineering Winter 2022. Contribute to sergeybratus/RE-basics-W22 development by creating an account on GitHub.
👍3
ContiLeaks continues to leak data from Conti... they have released source code - the Trickbot Command Dispatcher & Trickbot Data Collector. They have also doxxed one of the developers of Conti.
You can download the Trickbot source code here: https://share.vx-underground.org/Conti/
🗣vxunderground
🎖@malwr
You can download the Trickbot source code here: https://share.vx-underground.org/Conti/
🗣vxunderground
🎖@malwr
🔥1
My iOS QEMU fork is just published.
Some notable features:
- iOS Restore
- S8000 SecureROM emulation (always FORCE_DFU)
- USB
- SPRR/GXF emulation
The repo is at https://github.com/TrungNguyen1909/qemu-t8030
Tutorial/status can be found in the wiki section.
It is still very far from a usable device
🗣ntrung03
🎖@malwr
Some notable features:
- iOS Restore
- S8000 SecureROM emulation (always FORCE_DFU)
- USB
- SPRR/GXF emulation
The repo is at https://github.com/TrungNguyen1909/qemu-t8030
Tutorial/status can be found in the wiki section.
It is still very far from a usable device
🗣ntrung03
🎖@malwr
This media is not supported in your browser
VIEW IN TELEGRAM
#CVE-2022-22947 Spring Cloud Gateway SpEL Remote Code Execution
https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
🗣pyn3rd
🎖@malwr
https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/
🗣pyn3rd
🎖@malwr
Android Malware Research (aka the team I'm on :) is looking for an experienced Android malware reverse engineer in NYC!
https://careers.google.com/jobs/results/105670070832636614-senior-security-engineer-android-security/
🗣maldr0id
🎖@malwr
https://careers.google.com/jobs/results/105670070832636614-senior-security-engineer-android-security/
🗣maldr0id
🎖@malwr
Google
Build for Everyone - Google Careers
Careers at Google - find a job at Google. Look inside engineering jobs at Google.
Announcing Windows 11 Insider Preview Build 22567
https://blogs.windows.com/windows-insider/2022/03/02/announcing-windows-11-insider-preview-build-22567/
🗣windowsblog
🎖@malwr
https://blogs.windows.com/windows-insider/2022/03/02/announcing-windows-11-insider-preview-build-22567/
🗣windowsblog
🎖@malwr
Windows Insider Blog
Announcing Windows 11 Insider Preview Build 22567
UPDATE 3/7: We are starting to roll out Cumulative Update Build 22567.200 (KB5012432). This update does not include anything new and is designed to test our servicing pipeline for builds in the Dev Channel.
NOTE: Windows Insider
NOTE: Windows Insider
A deep dive into HermeticWiper's internals
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/digging-into-hermeticwiper.html
ℹ️ Sent from one of our channel members
🎖@malwr
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/digging-into-hermeticwiper.html
ℹ️ Sent from one of our channel members
🎖@malwr
Trellix
Digging into HermeticWiper
The HermeticWiper malware aims to destroy the boot sectors of any (removable) disk on the infected machine, with the help of a benign partition manager driver.
Find out how two flaws in NETGEAR DGND3700v2 devices allow remote unauthenticated attackers to trigger bypass the authentication mechanism and run commands as root
🗣SSDisclosure
🎖@malwr
🗣SSDisclosure
🎖@malwr
SSD Secure Disclosure
SSD Advisory – NETGEAR DGND3700v2 PreAuth Root Access - SSD Secure Disclosure
Find out how a vulnerability in multiple Uniview devices allow remote unauthenticated attackers to trigger a remote code execution vulnerability in the products the company offers.
Reversing embedded device bootloader (U-Boot) & decrypt the firmware - (Part
1 - Shielder ) : https://www.shielder.it/blog/2022/03/reversing-embedded-device-bootloader-u-boot-p.1/ credits
@zi0Black @Th3Zer0
🗣binitamshah
🎖@malwr
1 - Shielder ) : https://www.shielder.it/blog/2022/03/reversing-embedded-device-bootloader-u-boot-p.1/ credits
@zi0Black @Th3Zer0
🗣binitamshah
🎖@malwr
👍1
http://phishstats.info detected 111 new websites hosting #phishing | new today: 788 | #infosec #cybersecurity #malware
🗣PhishStats
🎖@malwr
🗣PhishStats
🎖@malwr
Malfrat's OSINT Map is live on https://map.malfrats.industries !
We forked http://osintframework.com since this is no longer maintained, so you can easily contribute on our repo.
Thanks for their original work.
🗣MalfratsInd
🎖@malwr
We forked http://osintframework.com since this is no longer maintained, so you can easily contribute on our repo.
Thanks for their original work.
🗣MalfratsInd
🎖@malwr
If you're looking to practice your #malware #analysis skills, I have several exercises available:
🎓 https://github.com/jstrosch/malware-samples
These include challenge tasks and detailed walk-throughs. You'll also find them as CTF challenges at CyberDefenders
👉 https://cyberdefenders.org/blueteam-ctf-challenges/
🗣jstrosch
🎖@malwr
🎓 https://github.com/jstrosch/malware-samples
These include challenge tasks and detailed walk-throughs. You'll also find them as CTF challenges at CyberDefenders
👉 https://cyberdefenders.org/blueteam-ctf-challenges/
🗣jstrosch
🎖@malwr
Day 78 #100DaysofYARA - fun with the dotnet module
looking for user strings (typically wide strings) that imply command execution. Why look in this way vs just as strings?
Well this rule tells us immediately that the file is a dotnet executable
🗣greglesnewich
🎖@malwr
looking for user strings (typically wide strings) that imply command execution. Why look in this way vs just as strings?
Well this rule tells us immediately that the file is a dotnet executable
🗣greglesnewich
🎖@malwr
A nice bit of #HermeticWiper reversing by @eln0ty–
https://eln0ty.github.io/malware%20analysis/HermeticWiper/
🗣juanandres_gs
🎖@malwr
https://eln0ty.github.io/malware%20analysis/HermeticWiper/
🗣juanandres_gs
🎖@malwr
eln0ty
HermeticWiper/FoxBlade Analysis (in-depth)
The malware which targeting Ukrainian infrastructure (Specially windows devices) has since been observed in the neighboring countries of Latvia and Lithuania and manipulating the MBR resulting in subsequent boot failure.