New polymorphic techniques pushed to Revenant.
Rev now uses the python build script to generate C code at build time, compile randomly different binaries, and combine runtime polymorphic patches to give better obfuscation
Check it out!
https://github.com/0xTriboulet/Revenant
@deadvolvo
🗣0xTriboulet
🎖@malwr
Rev now uses the python build script to generate C code at build time, compile randomly different binaries, and combine runtime polymorphic patches to give better obfuscation
Check it out!
https://github.com/0xTriboulet/Revenant
@deadvolvo
🗣0xTriboulet
🎖@malwr
🔥1
Nice research by Maciej Domanski (@trailofbits) on cURL command line interface fuzzing and vulnerabilties
https://blog.trailofbits.com/2023/02/14/curl-audit-fuzzing-libcurl-command-line-interface/
#fuzzing
🗣0xor0ne
🎖@malwr
https://blog.trailofbits.com/2023/02/14/curl-audit-fuzzing-libcurl-command-line-interface/
#fuzzing
🗣0xor0ne
🎖@malwr
Microsoft Incident Response (formerly DART) provides guidance and strategies on how to detect, recover, and prevent CVE-2022-21894 exploits via a UEFI bootkit called BlackLotus. #microsoftincidentresponse #microsoftIR: https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
🗣bmcder02
🎖@malwr
🗣bmcder02
🎖@malwr
Microsoft News
Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign
A guide to assess whether users have been targeted or compromised by threat actors exploiting CVE-2022-21894 via BlackLotus UEFI bootkit.
In depth analysis on Valorants anti cheat tech "guarded regions" worth a read if you are interested in anti cheat tech
https://reversing.info/posts/guardedregions/
🗣AntiCheatPD
🎖@malwr
https://reversing.info/posts/guardedregions/
🗣AntiCheatPD
🎖@malwr
Xyrem Engineering
In-depth analysis on Valorant's Guarded Regions
In this post, we will analyze how Vanguard attempts to keep away bad actors by utilizing a simple yet brutally strong method
MinHash-based Code Relationship & Investigation Toolkit (MCRIT), a framework created by the Cyber Analysis & Defense team from Fraunhofer FKIE institute to simplify the application of the MinHash algorithm in the context of code similarity.
https://github.com/fkie-cad/mcritweb
#Botconf2023
🗣Requiem_fr
🎖@malwr
https://github.com/fkie-cad/mcritweb
#Botconf2023
🗣Requiem_fr
🎖@malwr
🔥2
Reverse Engineering Tofsee Spambot to find vaccine - Malware Lead @RaashidBhatt discloses two vaccines and a network-based kill switch. First up, it's part one, how to inject a malware vaccine into the binary file.👇
https://hubs.ly/Q01LkdrX0
#MalwareVaccine #Spambot #Tofsee
🗣SpamhausTech
🎖@malwr
https://hubs.ly/Q01LkdrX0
#MalwareVaccine #Spambot #Tofsee
🗣SpamhausTech
🎖@malwr
Introduction to Windows kernel drivers for red team tools development
(credits @Idov31)
Part 1: https://idov31.github.io/2022/07/14/lord-of-the-ring0-p1.html
Part 2: https://idov31.github.io/2022/08/04/lord-of-the-ring0-p2.html
Part 3: https://idov31.github.io/2022/10/30/lord-of-the-ring0-p3.html
#windows #kernel #redteam #malware #infosec #cybersecurity
🗣0xor0ne
🎖@malwr
(credits @Idov31)
Part 1: https://idov31.github.io/2022/07/14/lord-of-the-ring0-p1.html
Part 2: https://idov31.github.io/2022/08/04/lord-of-the-ring0-p2.html
Part 3: https://idov31.github.io/2022/10/30/lord-of-the-ring0-p3.html
#windows #kernel #redteam #malware #infosec #cybersecurity
🗣0xor0ne
🎖@malwr
🔥1
Part 3.2 on my blog analyzing a recent #Android #malware sample. https://n0psn0ps.github.io/2023/04/13/android-malware-analysis-series-ato.apk-part-3.2/
#re #reverseengineering
🗣n0ps3
🎖@malwr
#re #reverseengineering
🗣n0ps3
🎖@malwr
n0ps
Android Malware Analysis Series - ATO.apk - Part 3.2
Permanent dark(er) theme for Poole
Check it out! WinDbg has just released out of preview, out of the Windows store and (what I worked on) with Time Travel Debugging support for ARM64. http://aka.ms/windbg
🗣TheJCAB
🎖@malwr
🗣TheJCAB
🎖@malwr
Docs
Install WinDbg - Windows drivers
Start here for an overview on the Windows debugger and installing WinDbg.
👍1
Revizor automatically detects microarchitectural leakage in CPUs, speeding up discovery of vulnerabilities that previously required persistent hacking and painstaking manual labor. This new tool helps the industry protect customers from risk: https://msft.it/6013gHEGd
🗣MSFTResearch
🎖@malwr
🗣MSFTResearch
🎖@malwr
Microsoft Research
Hunting speculative information leaks with Revizor - Microsoft Research
Spectre and Meltdown are two security vulnerabilities that affect the vast majority of CPUs in use today. CPUs, or central processing units, act as the brains of a computer, directing the functions of its other components. By targeting a feature of the CPU…
Celebrating the 10th anniversary of releasing Noriben!
https://github.com/Rurik/Noriben
What started as a way to make filemon/regmon/procmon analysis easier for work mentoring has turned into an awesome automated tool I've used for large-scale ransomware analysis, and more.
🗣bbaskin
🎖@malwr
https://github.com/Rurik/Noriben
What started as a way to make filemon/regmon/procmon analysis easier for work mentoring has turned into an awesome automated tool I've used for large-scale ransomware analysis, and more.
🗣bbaskin
🎖@malwr
GitHub
GitHub - Rurik/Noriben: Noriben - Portable, Simple, Malware Analysis Sandbox
Noriben - Portable, Simple, Malware Analysis Sandbox - Rurik/Noriben
IOCs available...
Threat actors strive to cause Tax Day headaches https://rodtrent.com/j7j
#MicrosoftSentinel #MicrosoftDefender #M365D #Cybersecurity #MicrosoftSecurity #Security #MicrosoftThreatIntelligence
🗣rodtrent
🎖@malwr
Threat actors strive to cause Tax Day headaches https://rodtrent.com/j7j
#MicrosoftSentinel #MicrosoftDefender #M365D #Cybersecurity #MicrosoftSecurity #Security #MicrosoftThreatIntelligence
🗣rodtrent
🎖@malwr
😁1
Elevating your user-mode debugger into a Protected Process level, by Clément Labro (@itm4n):
https://itm4n.github.io/debugging-protected-processes/
🗣SEKTOR7net
🎖@malwr
https://itm4n.github.io/debugging-protected-processes/
🗣SEKTOR7net
🎖@malwr
itm4n’s blog
Debugging Protected Processes
Whenever I need to debug a protected process, I usually disable the protection in the Kernel so that I can attach a User-mode debugger. This has always served me well until it sort of backfired.
👍1