Shielder - Hunting for Unauthenticated n-days in Asus Routers

Notes on patch diffing, reverse engineering and exploiting CVE-2023-39238, CVE-2023-39239, and CVE-2023-39240.

https://www.shielder.com/blog/2024/01/hunting-for-~~un~~authenticated-n-days-in-asus-routers/


🎖@malwr

Agent Tesla [Part 1: Unpacking] | Ryan Weil
Introduction

https://ryan-weil.github.io/posts/AGENT-TESLA-1/


🎖@malwr

Agent Tesla [Part 2: Deobfuscation] | Ryan Weil
Introduction

https://ryan-weil.github.io/posts/AGENT-TESLA-2/


🎖@malwr

“CVE-2024-21388”- Microsoft Edge’s Marketing API Exploited for Covert Extension Installation | by Guardio | Mar, 2024 | Medium

At Guardio, making browsing safer is what we do best, with one of our key products being a browser extension that boosts users’ security on desktop browsers. Our expertise in this area led us to…

https://labs.guard.io/cve-2024-21388-microsoft-edges-marketing-api-exploited-for-covert-extension-installation-879fe5ad35ca


🎖@malwr

Uncovering Malicious Infrastructure with DNS Pivoting
Demonstrating DNS pivoting and analysis techniques for uncovering Malicious infrastructure

https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/


🎖@malwr

Reverse Engineering Snake Keylogger: Full .NET Malware Analysis
Discover an in-depth analysis of the Snake Keylogger malware, exposing its config, infostealing features, and anti-analysis techniques.

https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/


🎖@malwr

Lazarus and the FudModule Rootkit: Beyond BYOVD with an Admin-to-Kernel Zero-Day - Avast Threat Labs

The Lazarus Group is back with an upgraded variant of their FudModule rootkit, this time enabled by a zero-day admin-to-kernel vulnerability for CVE-2024-21338. Read this blog for a detailed analysis of this rootkit variant and learn more about several new techniques, including a handle table entry manipulation technique that directly targets Microsoft Defender, CrowdStrike Falcon, and HitmanPro.

https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/


🎖@malwr

WithSecureLabs/drozer: The Leading Security Assessment Framework for Android.

✅ Recent update

https://github.com/WithSecureLabs/drozer


🎖@malwr

Operation FlightNight: Indian Government Entities and Energy Sector Targeted by Cyber Espionage Campaign
EclecticIQ analysts identified a threat actor that utilized information stealer HackBrowserData to target Indian government entities and energy sector.

https://blog.eclecticiq.com/operation-flightnight-indian-government-entities-and-energy-sector-targeted-by-cyber-espionage-campaign


🎖@malwr

Analysis of DinodasRAT Linux implant | Securelist
In this article, we share our analysis of a recent version of the DinodasRAT implant for Linux, which may have been active since 2022.

https://securelist.com/dinodasrat-linux-implant/112284/


🎖@malwr

Introducing SharpConflux - LRQA Nettitude Labs
SharpConflux, a .NET application built to facilitate Confluence exploitation during Red Team and Penetration Testing engagements.

https://labs.nettitude.com/blog/introducing-sharpconflux/


🎖@malwr

✅✅✅ Forward posts to the other groups ✅✅✅

Interesting Multi-Stage StopCrypt Ransomware Variant Propagating in the Wild

Overview The SonicWall Capture Labs threat research team recently observed an interesting variant of StopCrypt ransomware. The ransomware executes its malicious activities by utilizing multi-stage shellcodes before launching a final payload that contains the file

https://blog.sonicwall.com/en-us/2024/03/new-multi-stage-stopcrypt-ransomware/


🎖@malwr

Malware Development Essentials Part 1 | by Smukx | Mar, 2024 | Medium
For Malware development and security professionals, understanding the inner workings of Windows is crucial. Windows internals, the hidden world beneath the user interface, can harbor vulnerabilities…

https://smukx.medium.com/malware-development-essentials-part-1-5f4626652ed9


🎖@malwr

Windows Memory Forensics
How to hunt for anomalies in a Windows Memory Dump

https://blog.cyber5w.com/anomalies-hunting-in-windows-memory-dump


🎖@malwr