Check out my analysis of #LockBit #ransomware v2.0 where I analyze all of its functionalities in IDA!
https://chuongdong.com/reverse%20engineering/2022/03/19/LockbitRansomware/
h/t to @BushidoToken for the CTI and @demonslay335 for helping with the crypto!
🗣cPeterr
🎖@malwr
https://chuongdong.com/reverse%20engineering/2022/03/19/LockbitRansomware/
h/t to @BushidoToken for the CTI and @demonslay335 for helping with the crypto!
🗣cPeterr
🎖@malwr
👍2
I know I said that I was gonna publish on my blog this week but I decided to just write it up tonight. All materials at the end of the blog. Enjoy friends!: https://malwaremaycry.medium.com/my-malware-analysis-journey-and-ecmap-edd37dade775 #informationsecurity #malwareanalysis #malware #certification #tech #IT
https://malwaremaycry.medium.com/my-malware-analysis-journey-and-ecmap-edd37dade775
🗣MalwareMayCry1
🎖@malwr
https://malwaremaycry.medium.com/my-malware-analysis-journey-and-ecmap-edd37dade775
🗣MalwareMayCry1
🎖@malwr
Medium
My Malware Analysis Journey and eCMAP
On March 19th, 2022, I passed the eCMAP(eLearnSecurity Certified Malware Professional) exam. In this post, I’m going to talk about my…
Extracting Malware from Memory with Hollows_Hunter https://securityliterate.com/extracting-malware-from-memory-with-hollows-hunter/
https://securityliterate.com/extracting-malware-from-memory-with-hollows-hunter/
🗣pentest_swissky
🎖@malwr
https://securityliterate.com/extracting-malware-from-memory-with-hollows-hunter/
🗣pentest_swissky
🎖@malwr
Kyle Cucci's Cyber Ramblings
Extracting Malware from Memory with Hollows_Hunter
Sometimes I come across a tool that makes me stop and think what I have been doing all my life life without it. This is how I feel about hollows_hunter. Hollows_hunter is essentially a tool for aut…
My colleague recently reminded me that Python executes zip files which of course extends to other zip-based formats and lets you do things like this.
🗣ZetaTwo
🎖@malwr
🗣ZetaTwo
🎖@malwr
👍2🤔1
Adversary3 v1.0 - Malware vulnerability intel tool for third-party attackers.
https://github.com/malvuln/Adversary3
🗣malvuln
🎖@malwr
https://github.com/malvuln/Adversary3
🗣malvuln
🎖@malwr
GitHub
GitHub - malvuln/Adversary3: Malware vulnerability intel tool for third-party attackers
Malware vulnerability intel tool for third-party attackers - malvuln/Adversary3
👍1
Surtr #ransomware pays tribute to the now defunct #REvil (aka Sodinokibi) group by making a registry key change to the infected host.
https://areteir.com/surtr-ransomware-pays-tribute-to-revil/
🗣TheHackersNews
🎖@malwr
https://areteir.com/surtr-ransomware-pays-tribute-to-revil/
🗣TheHackersNews
🎖@malwr
Arete IR
Article: Surtr Ransomware Pays Tribute to REvil
Arete notes that developers of Surtr likely do not have a direct connection to the REvil group, but are likely leveraging their REvil tribute to gain popularity.
Digital Forensics Incident Response Cheat Sheet
Credit @sansforensics
#infosec #cybersecurity #cybersecuritytips #pentesting #oscp #cissp #CyberSec #networking #logs #CheatSheet #cyberattacks #security #vulnerabilities #forensics #dfir #incidentresponse
🗣hackinarticles
🎖@malwr
Credit @sansforensics
#infosec #cybersecurity #cybersecuritytips #pentesting #oscp #cissp #CyberSec #networking #logs #CheatSheet #cyberattacks #security #vulnerabilities #forensics #dfir #incidentresponse
🗣hackinarticles
🎖@malwr
Here is my #QuickNote - Analysis of #Pandora ransomware 🤧🤢
https://kienmanowar.wordpress.com/2022/03/21/quicknote-analysis-of-pandora-ransomware/
🗣kienbigmummy
🎖@malwr
https://kienmanowar.wordpress.com/2022/03/21/quicknote-analysis-of-pandora-ransomware/
🗣kienbigmummy
🎖@malwr
APT35 Automates Initial Access Using ProxyShell
➡️Initial Access: #ProxyShell
➡️Discovery: net, ipconfig, PowerShell, quser, etc.
➡️PrivEsc: Scheduled Task
➡️Defense Evasion: Real-time Monitoring & WDigest enablement
➡️Credential Access: Comsvcs.dll
https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
🗣TheDFIRReport
🎖@malwr
➡️Initial Access: #ProxyShell
➡️Discovery: net, ipconfig, PowerShell, quser, etc.
➡️PrivEsc: Scheduled Task
➡️Defense Evasion: Real-time Monitoring & WDigest enablement
➡️Credential Access: Comsvcs.dll
https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
🗣TheDFIRReport
🎖@malwr
The DFIR Report
PHOSPHORUS Automates Initial Access Using ProxyShell
In this intrusion, we observed the initial exploitation of the ProxyShell vulnerabilities followed by some further post-exploitation activity, which included web shells, credential dumping, and specialized payloads.
👍1
Threads, Threads, and More Threads http://scorpiosoftware.net/2022/03/21/threads-threads-and-more-threads/
🗣zodiacon
🎖@malwr
🗣zodiacon
🎖@malwr
Pavel Yosifovich
Threads, Threads, and More Threads
Looking at a typical Windows system shows thousands of threads, with process numbers in the hundreds, even though the total CPU consumption is low, meaning most of these threads are doing nothing m…
Windows API - Exploring Virtual Memory and the Virtual Memory Management API, by @coder_rc
https://de-engineer.github.io/Understanding-Virtual-Memory-Paging-and-other-memory-related-concepts/
🗣DirectoryRanger
🎖@malwr
https://de-engineer.github.io/Understanding-Virtual-Memory-Paging-and-other-memory-related-concepts/
🗣DirectoryRanger
🎖@malwr
de engineering
Exploring Virtual Memory and the Virtual Memory Management API.
Introduction to Virtual Memory, Paging and Windows API functions that allow us to play with the virtual memory!
👍4
We're hiring for the @Mandiant #AdvancedPractices Research team!🦅
➡️Self-driven defensive- and intel-oriented research
➡️Support Mandiant IRs with research and detection
➡️Codify attacker methodologies
➡️Surface new activity
🔥Great team/mission/data🔥
https://jobs.smartrecruiters.com/Mandiant/743999814012433
🗣matthewdunwoody
🎖@malwr
➡️Self-driven defensive- and intel-oriented research
➡️Support Mandiant IRs with research and detection
➡️Codify attacker methodologies
➡️Surface new activity
🔥Great team/mission/data🔥
https://jobs.smartrecruiters.com/Mandiant/743999814012433
🗣matthewdunwoody
🎖@malwr
Mandiant
Mandiant is looking for a Senior Security Researcher (Remote US) in Reston, VA, USA
The Role:Lay the foundation: research, model, and integrate threat dataBuild the layers: search telemetry to find new intrusions, malware and tradecraftWork the resolution: notify our clients and ...
My favorite IDA shortcut: ctrl-L lets you powerfully search across all func names & var names!
Want to find everything related to packets? Search it with Ctrl-L.
🗣whtaguy
🎖@malwr
Want to find everything related to packets? Search it with Ctrl-L.
🗣whtaguy
🎖@malwr
Started collecting observed/hardcoded #mutex from various #malware families.
Feel free to send PRs: https://github.com/albertzsigovits/malware-mutex/blob/main/README.md
🗣albertzsigovits
🎖@malwr
Feel free to send PRs: https://github.com/albertzsigovits/malware-mutex/blob/main/README.md
🗣albertzsigovits
🎖@malwr
GitHub
malware-mutex/README.md at main · albertzsigovits/malware-mutex
Muteces (mutexes/mutants) used by various malware families - albertzsigovits/malware-mutex
PlugX: A Talisman to Behold
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/plugx-a-talisman-to-behold.html
ℹ️ Sent from one of our channel members
🎖@malwr
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/plugx-a-talisman-to-behold.html
ℹ️ Sent from one of our channel members
🎖@malwr
Trellix
PlugX: A Talisman to Behold
This blog covers a PlugX variant that we have named Talisman and its rather long life since it first emerged in 2008.