Researchers from Palo Alto Networks' Unit 42 Team recently discovered a new sample of Golang-based malware. GoBruteforcer targets web servers, specifically those running phpMyAdmin, MySQL, FTP and Postgres services. https://unit42.paloaltonetworks.com/gobruteforcer-golang-botnet/
🗣virusbtn


🎖@malwr

Linux Kernel Rootkits:

Part 3: A Backdoor to Root : https://xcellerator.github.io/posts/linux_rootkits_03/

Part 2: Ftrace and Function Hooking : https://xcellerator.github.io/posts/linux_rootkits_02/

Part 1: Introduction and Workflow : https://xcellerator.github.io/posts/linux_rootkits_01/ @TheXcellerator

DIY Linux Kernel Rootkit Detection : https://unfinished.bike/diy-linux-kernel-rootkit-detection
🗣binitamshah


🎖@malwr

Google Cloud Platform Exfiltration : A Threat Hunting Guide : https://www.mitiga.io/blog/google-cloud-platform-exfiltration-a-threat-hunting-guide
🗣binitamshah


🎖@malwr

Blink : tiniest x86-64-linux emulator : https://github.com/jart/blink credits @JustineTunney

cosmopolitan : build-once run-anywhere c library : https://github.com/jart/cosmopolitan
🗣binitamshah


🎖@malwr

Modern x64 Assembly ( 16 Part video series) : https://www.youtube.com/watch?v=rxsBghsrvpI&list=PLKK11Ligqitg9MOX3-0tFT1Rmh3uJp7kA
🗣binitamshah


🎖@malwr

Win32 Offensive Cheatsheet

Win32 and Kernel abusing techniques for pentesters & red-teamers.

https://github.com/matthieu-hackwitharts/Win32_Offensive_Cheatsheet

#pentesting #redteam https://t.me/hackgit/7899
🗣hack_git


🎖@malwr

Want to learn about EoP on windows? check this amazing series from @hasherezade
https://hshrzd.wordpress.com/2017/06/22/starting-with-windows-kernel-exploitation-part-3-stealing-the-access-token/
🗣hardik05


🎖@malwr

Win32 and Kernel abusing techniques for pentesters

https://github.com/matthieu-hackwitharts/Win32_Offensive_Cheatsheet
🗣Dinosn


🎖@malwr

Did you know that IDA Free has been updated to 8.2 and gained some new features 👇 Give it a try today 🌐 https://hex-rays.com/ida-free/?utm_source=Social-Media-Post&utm_medium=Twitter&utm_campaign=ida-free-updated-8-2

#IDAFree #HexRays #ReverseEngineering #MalwareAnalysis
🗣HexRaysSA


🎖@malwr

Bypass Windows Defender with FilelessPELoader
Offensive security professional 'TheD1rkMtr' released a C++ tool, titled 'FilelessPELoader' on his Github repository earlier this year in 2023.

The publicly available tool was able to bypass the latest Windows Defender and successfully load and execute Mimikatz on a Windows system. The proof of concept along with the source code of the tool can be found in the author's Github repository over here.

As publicly available tools that claim to bypass Windows Defender are usually rapidly signatured and prevented by the AV/EDR vendors, an attempt was conducted to verify if the C++ 'FilelessPELoader' tool is still functional, and if it is still possible to bypass the latest Windows Defender on an updated Windows system.

This video posted by the Gemini Security channel on Youtube provides a step-by-step walkthrough on how to compile the C++ tool FilelessPELoader and the usage of it, demonstrating that it is STILL possible to bypass Windows Defender, loading and executing the Mimikatz.exe binary. The video also provides a demonstration on using the FilelessPELoader tool to load and execute a Meterpreter reverse shell, successfully establishing a functional reverse shell back to a Kali OS.

If you're up against Windows Defender and require a bypass, this might be the solution for you.
🗣cybermepls


🎖@malwr

You suspect there should be a cross-reference in the listing, but IDA isn’t showing it? See how to find it 🌐 https://hex-rays.com/blog/igors-tip-of-the-week-132-finding-hidden-cross-references/?utm_source=Social-Media-Post&utm_medium=Twitter&utm_campaign=Igor-Tip-132

#IgorsTipOfTheWeek #IDAtips #IDAPro
🗣HexRaysSA


🎖@malwr