Binary Ninja 3.4 released. They are getting scary good at C++ decompilation. Can't wait for @vector35 to get scary-good at Go, Rust, and other compiled languages https://binary.ninja/2023/05/03/3.4-finally-freed.html
🗣OpenMalware
🎖@malwr
🗣OpenMalware
🎖@malwr
Binary Ninja
Binary Ninja - 3.4: Finally Freed
Binary Ninja is a modern reverse engineering platform with a scriptable and extensible decompiler.
Zero Trust Architecture (NIST Special Publication 800-207)
Download Link in PDF:
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
For more unique resources and tools for the cyber community, please visit:
https://cyberstartupobservatory.com/cyber-startup-observatory-community/
#CyberSecurity #InfoSec #InformationSecurity
🗣CyberSecOb
🎖@malwr
Download Link in PDF:
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
For more unique resources and tools for the cyber community, please visit:
https://cyberstartupobservatory.com/cyber-startup-observatory-community/
#CyberSecurity #InfoSec #InformationSecurity
🗣CyberSecOb
🎖@malwr
Security Researcher @BushidoToken shares an overview of the Raspberry Robin (DEV-0856/Storm-0856) USB malware campaign providing access to ransomware operators. https://blog.bushidotoken.net/2023/05/raspberry-robin-global-usb-malware.html
🗣virusbtn
🎖@malwr
🗣virusbtn
🎖@malwr
Added EA information dumping tool.
https://github.com/daem0nc0re/TangledWinExec/commit/9beabf2ea1bb465aa65421f97e76028d103cddb1
🗣daem0nc0re
🎖@malwr
https://github.com/daem0nc0re/TangledWinExec/commit/9beabf2ea1bb465aa65421f97e76028d103cddb1
🗣daem0nc0re
🎖@malwr
dracon: Security scanning orchestration and results enrichment framework - The purpose of this project is to provide a scalable and flexible framework to execute arbitrary security scanning tools on code and infrastructure while processing the results in a versatile way.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - ocurity/dracon: Security scanning & static analysis tool - forked and rewritten from @thought-machine/dracon
Security scanning & static analysis tool - forked and rewritten from @thought-machine/dracon - ocurity/dracon
Clean Rooms, Nuclear Missiles, and SideCopy, Oh My! - file is named “DRDO-K4-Missile-Clean-room.zip”.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Fortinet Blog
Clean Rooms, Nuclear Missiles, and SideCopy, Oh My! | FortiGuard Labs
The FortiGuard Labs team highlights threat actors conducting a targeted campaign that takes the time to create a lure relevant enough for the target to pursue.…
攻撃キャンペーンDangerousPasswordに関連する攻撃動向 - Attack trends related to the attack campaign DangerousPassword - continues to carry out attacks against cryptocurrency exchange operators in Japan. This attack group may contact the target from LinkedIn, so be careful when using SNS.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
JPCERT/CC Eyes
攻撃キャンペーンDangerousPasswordに関連する攻撃動向 - JPCERT/CC Eyes
JPCERT/CCは、2019年6月から継続して攻撃キャンペーンDangerou...
NEW BLOG: How works Microsoft Defender Threat Intelligence / Defender TI – and what is the difference between free and paid
Included in the blog is the Sentinel TI feed integration and UI experience in Defender 365 which is recently announced.
https://jeffreyappel.nl/how-works-microsoft-defender-threat-intelligence-defender-ti-and-what-is-the-difference-between-free-and-paid/
🗣JeffreyAppel7
🎖@malwr
Included in the blog is the Sentinel TI feed integration and UI experience in Defender 365 which is recently announced.
https://jeffreyappel.nl/how-works-microsoft-defender-threat-intelligence-defender-ti-and-what-is-the-difference-between-free-and-paid/
🗣JeffreyAppel7
🎖@malwr
Jeffrey Appel - Microsoft Security blog
How works Microsoft Defender Threat Intelligence / Defender TI - and what is the difference between free and paid
Microsoft Defender Threat Intelligence (MDTI), previously known as RiskIQ brings threat Intelligence data together from multiple sources. With Microsoft Defender Threat Intelligence (MDTI), customers will have direct access to real-time data and signals to…
I created a GitHub repo for learning application security from scratch. It's perfect for beginners and includes a comprehensive list of reference links. But it's not complete yet! Contributors are welcome to add more details. https://github.com/Anof-cyber/Application-Security
🗣_r_netsec
🎖@malwr
🗣_r_netsec
🎖@malwr
GitHub
GitHub - Anof-cyber/Application-Security: Resources for Application Security including Web, API, Android, iOS and Thick Client
Resources for Application Security including Web, API, Android, iOS and Thick Client - Anof-cyber/Application-Security
#Malware_analysis
1. Malware Analysis Course at Hack Space Con 2023
https://github.com/archcloudlabs/HackSpaceCon_Malware_Analysis_Course
2. Privacy-invasive/Clicker Android Adware
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea
3. BabLock/Rorschach Ransomware
https://www.trendmicro.com/en_us/research/23/d/an-analysis-of-the-bablock-ransomware.html
🗣akaclandestine
🎖@malwr
1. Malware Analysis Course at Hack Space Con 2023
https://github.com/archcloudlabs/HackSpaceCon_Malware_Analysis_Course
2. Privacy-invasive/Clicker Android Adware
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/goldoson-privacy-invasive-and-clicker-android-adware-found-in-popular-apps-in-south-korea
3. BabLock/Rorschach Ransomware
https://www.trendmicro.com/en_us/research/23/d/an-analysis-of-the-bablock-ransomware.html
🗣akaclandestine
🎖@malwr
GitHub
GitHub - archcloudlabs/HackSpaceCon_Malware_Analysis_Course: Free training course offered at Hack Space Con 2023
Free training course offered at Hack Space Con 2023 - archcloudlabs/HackSpaceCon_Malware_Analysis_Course
Enterprise DevSecOps Strategy Guide
Source: US DoD
Download Link: https://dodcio.defense.gov/Portals/0/Documents/Library/DoD%20Enterprise%20DevSecOps%20Strategy%20Guide_DoD-CIO_20211019.pdf
For more unique resources and tools for the cyber community, please visit:
https://cyberstartupobservatory.com/cyber-startup-observatory-community/
#CyberSecurity #InfoSec #InformationSecurity
🗣JMonteagudoE
🎖@malwr
Source: US DoD
Download Link: https://dodcio.defense.gov/Portals/0/Documents/Library/DoD%20Enterprise%20DevSecOps%20Strategy%20Guide_DoD-CIO_20211019.pdf
For more unique resources and tools for the cyber community, please visit:
https://cyberstartupobservatory.com/cyber-startup-observatory-community/
#CyberSecurity #InfoSec #InformationSecurity
🗣JMonteagudoE
🎖@malwr
Ghidra Setup Guide for World of Warcraft 4.1.0.13850
🗣LifeIsACurse
Took the time to also create a Ghidra Setup Guide for World of Warcraft 4.1.0.13850
This was a PTR version compiled for MacOS x86 during Cataclysm.
A lot closer to my targeted 3.3.5a.12340 and for another OS, but still a lot of info which can be mined from this one.
The video not only shows how to set up the Ghidra repository, but also how to correct some of the missing struct definitions in order to improve the decompilation output.
You can download a copy of my repository by following the link in the pinned post on the video - a tutorial video how to import local Ghidra projects (or exporting them yourself) can be found on that post as well.
Maybe there are some interesting tidbits for you - happy reversing :)
👤LifeIsACurse
🎖@malwr
🗣LifeIsACurse
Took the time to also create a Ghidra Setup Guide for World of Warcraft 4.1.0.13850
This was a PTR version compiled for MacOS x86 during Cataclysm.
A lot closer to my targeted 3.3.5a.12340 and for another OS, but still a lot of info which can be mined from this one.
The video not only shows how to set up the Ghidra repository, but also how to correct some of the missing struct definitions in order to improve the decompilation output.
You can download a copy of my repository by following the link in the pinned post on the video - a tutorial video how to import local Ghidra projects (or exporting them yourself) can be found on that post as well.
Maybe there are some interesting tidbits for you - happy reversing :)
👤LifeIsACurse
🎖@malwr
YouTube
Ghidra Setup Guide for World of Warcraft 4.1.0.13850
Here is the next Ghidra Setup Guide, this time for a version a lot closer to my target 3.3.5a.12340.
This video shows off how to set up the repository and also how to correct some of the data structures, so the decompiler can properly infer what is going…
This video shows off how to set up the repository and also how to correct some of the data structures, so the decompiler can properly infer what is going…
Release Version 0.4 Release - Nidhogg - The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for red team engagements that can be integrated with your C2 framework via a single header file - this version introduced various new capabilities
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
Release Version 0.4 Release · Idov31/Nidhogg
Version 0.4 Release
New features:
DLL Injection
Via APC
Via NtCreateThread
Shellcode Injection
Via APC
Via NtCreateThread
Unregistering and restoring callbacks
ObCallbacks
PsSetCreatePro...
New features:
DLL Injection
Via APC
Via NtCreateThread
Shellcode Injection
Via APC
Via NtCreateThread
Unregistering and restoring callbacks
ObCallbacks
PsSetCreatePro...