Blog post #3
In this blog, I cover the basics of the translation process of a virtual memory address into physical memory address as well as the PTE structure and usage of another WinAPI function with examples.
https://de-engineer.github.io/Virtual-Address-Translation-and-structure-of-PTE
#infosec
🗣coder_rc
🎖@malwr
In this blog, I cover the basics of the translation process of a virtual memory address into physical memory address as well as the PTE structure and usage of another WinAPI function with examples.
https://de-engineer.github.io/Virtual-Address-Translation-and-structure-of-PTE
#infosec
🗣coder_rc
🎖@malwr
👍1
Updated my ScheduleRunner to include the "hiding scheduled task" technique used by Tarrask malware. This technique can literally make your scheduled task invisible from query tools and Task Scheduler.
https://github.com/netero1010/ScheduleRunner
🗣netero_1010
🎖@malwr
https://github.com/netero1010/ScheduleRunner
🗣netero_1010
🎖@malwr
This repository contains a Red team Offensive Security Exploitation Tool
which uses TOR and OnionShare as long with Meterpreter Session.
https://github.com/ToxicEnvelope/SetmPloit
ℹ️ Sent from one of our channel members
🎖@malwr
which uses TOR and OnionShare as long with Meterpreter Session.
https://github.com/ToxicEnvelope/SetmPloit
ℹ️ Sent from one of our channel members
🎖@malwr
GitHub
GitHub - ToxicEnvelope/SetmPloit
Contribute to ToxicEnvelope/SetmPloit development by creating an account on GitHub.
👍1
New Blog! Lessons from the Conti Leaks
https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html
🗣BushidoToken
🎖@malwr
https://blog.bushidotoken.net/2022/04/lessons-from-conti-leaks.html
🗣BushidoToken
🎖@malwr
👍1
New Trend Micro data shows that Purple Fox operators are using trojanized software packages to trick users into downloading their payloads.
Read about #PurpleFox’s infection chain and learn about its new campaign here: https://research.trendmicro.com/36x6pPz
🗣TrendMicroRSRCH
🎖@malwr
Read about #PurpleFox’s infection chain and learn about its new campaign here: https://research.trendmicro.com/36x6pPz
🗣TrendMicroRSRCH
🎖@malwr
👍1
Check out the new blog post about my journey in implementing the technical aspects of Windhawk - implementing global injection and hooking in Windows.
https://m417z.com/Implementing-Global-Injection-and-Hooking-in-Windows/
🗣m417z
🎖@malwr
https://m417z.com/Implementing-Global-Injection-and-Hooking-in-Windows/
🗣m417z
🎖@malwr
M417Z
Implementing Global Injection and Hooking in Windows
A couple of weeks ago, Windhawk, the customization marketplace for Windows programs, was released. You can read the announcement for more details and for the motivation behind creating it. In this post, I’ll focus on my journey in implementing the technical…
The FBI, CISA & US Treasury Department have released a joint advisory to highlight the threat associated with cryptocurrency thefts & tactics used by a North Korean state-sponsored APT group (Lazarus/APT38/BlueNoroff/Stardust Chollima) since at least 2020 https://www.cisa.gov/uscert/ncas/alerts/aa22-108a
🗣virusbtn
🎖@malwr
🗣virusbtn
🎖@malwr
A practical guide to bypassing userland API Hooking https://perspectiverisk.com/a-practical-guide-to-bypassing-userland-api-hooking/ #Pentesting #APIHooking #CyberSecurity #Infosec
🗣ptracesecurity
🎖@malwr
🗣ptracesecurity
🎖@malwr
Emotet Loader Technical Analysis
https://nikpx.github.io/malware/analysis/2022/04/19/Emotet_Loader.html
🗣xorsthingsv2
🎖@malwr
https://nikpx.github.io/malware/analysis/2022/04/19/Emotet_Loader.html
🗣xorsthingsv2
🎖@malwr
Wtf another RAT was released on GitHub.
58d577e0a9e182dc2fedede09dfb586cf62fb56cc36e2e5fecf4280d2395abfb
https://github.com/arsium/EagleMonitorRAT
malwrhunterteam probably skiddies will roll from LimeRAT to this shit?
🗣fr0s7_
🎖@malwr
58d577e0a9e182dc2fedede09dfb586cf62fb56cc36e2e5fecf4280d2395abfb
https://github.com/arsium/EagleMonitorRAT
malwrhunterteam probably skiddies will roll from LimeRAT to this shit?
🗣fr0s7_
🎖@malwr
GitHub
GitHub - arsium/EagleMonitorRAT: Remote Access Tool Written In C#
Remote Access Tool Written In C#. Contribute to arsium/EagleMonitorRAT development by creating an account on GitHub.
🥳🥳🥳BinAbsInspector (Binary Abstract Inspector)is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab.
https://github.com/KeenSecurityLab/BinAbsInspector
🗣keen_lab
🎖@malwr
https://github.com/KeenSecurityLab/BinAbsInspector
🗣keen_lab
🎖@malwr
GitHub
GitHub - KeenSecurityLab/BinAbsInspector: BinAbsInspector: Vulnerability Scanner for Binaries
BinAbsInspector: Vulnerability Scanner for Binaries - KeenSecurityLab/BinAbsInspector
jadx 1.3.5 got this cool split view now so you can view multiple decompilations at once!
https://github.com/skylot/jadx/releases/tag/v1.3.5
🗣leonjza
🎖@malwr
https://github.com/skylot/jadx/releases/tag/v1.3.5
🗣leonjza
🎖@malwr
🤩2👍1🎉1
You can plant an undetectable backdoor in any deep learning model
https://arxiv.org/abs/2204.06974
🗣neuroecology
🎖@malwr
https://arxiv.org/abs/2204.06974
🗣neuroecology
🎖@malwr
Here's my writeup on writing a wireshark dissector to parse data embedded in ICMP headers
https://medium.com/@kevin.massey1189/writing-a-wireshark-dissector-to-parse-data-embedded-in-icmp-headers-1f039cd4072d
🗣Scratchadams118
🎖@malwr
https://medium.com/@kevin.massey1189/writing-a-wireshark-dissector-to-parse-data-embedded-in-icmp-headers-1f039cd4072d
🗣Scratchadams118
🎖@malwr
Medium
Writing a Wireshark dissector to parse data embedded in ICMP headers
I recently spent some time repurposing fields in ICMP headers in order to do a basic file transfer. I decided to use the code, ID, and…
🔥2
Video recordings from OffensiveCon 2022 are now online: https://www.youtube.com/c/OffensiveCon/videos
🗣xorlgr
🎖@malwr
🗣xorlgr
🎖@malwr
My slide at #Zer0Con2022 is public now, hope it can help you :)
[https://github.com/474172261/slides/blob/main/Old%20School%2C%20New%20Story--Escape%20from%20Hyper-V%20by%20Path%20Traversal.pdf]
🗣vv474172261
🎖@malwr
[https://github.com/474172261/slides/blob/main/Old%20School%2C%20New%20Story--Escape%20from%20Hyper-V%20by%20Path%20Traversal.pdf]
🗣vv474172261
🎖@malwr
GitHub
slides/Old School, New Story--Escape from Hyper-V by Path Traversal.pdf at main · 474172261/slides
Collection of slides. Contribute to 474172261/slides development by creating an account on GitHub.
It took only 4 hours from initial access to domain-wide ransomware. "The payload was delivered within an ISO file; Containing two files, .dll and .lnk files, etc" So much to learn in this report with addition of diamond model info TheDFIRReport #dfir
https://thedfirreport.com/2022/04/25/quantum-ransomware/
🗣r3nzsec
🎖@malwr
https://thedfirreport.com/2022/04/25/quantum-ransomware/
🗣r3nzsec
🎖@malwr
The DFIR Report
Quantum Ransomware
In one of the fastest ransomware cases we have observed, in under four hours the threat actors went from initial access, to domain wide ransomware.