Uncovering Malicious Infrastructure with DNS Pivoting
Demonstrating DNS pivoting and analysis techniques for uncovering Malicious infrastructure

https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/


🎖@malwr

Reverse Engineering Snake Keylogger: Full .NET Malware Analysis
Discover an in-depth analysis of the Snake Keylogger malware, exposing its config, infostealing features, and anti-analysis techniques.

https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/


🎖@malwr

Lazarus and the FudModule Rootkit: Beyond BYOVD with an Admin-to-Kernel Zero-Day - Avast Threat Labs

The Lazarus Group is back with an upgraded variant of their FudModule rootkit, this time enabled by a zero-day admin-to-kernel vulnerability for CVE-2024-21338. Read this blog for a detailed analysis of this rootkit variant and learn more about several new techniques, including a handle table entry manipulation technique that directly targets Microsoft Defender, CrowdStrike Falcon, and HitmanPro.

https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day/


🎖@malwr

WithSecureLabs/drozer: The Leading Security Assessment Framework for Android.

✅ Recent update

https://github.com/WithSecureLabs/drozer


🎖@malwr

Operation FlightNight: Indian Government Entities and Energy Sector Targeted by Cyber Espionage Campaign
EclecticIQ analysts identified a threat actor that utilized information stealer HackBrowserData to target Indian government entities and energy sector.

https://blog.eclecticiq.com/operation-flightnight-indian-government-entities-and-energy-sector-targeted-by-cyber-espionage-campaign


🎖@malwr

Analysis of DinodasRAT Linux implant | Securelist
In this article, we share our analysis of a recent version of the DinodasRAT implant for Linux, which may have been active since 2022.

https://securelist.com/dinodasrat-linux-implant/112284/


🎖@malwr

Introducing SharpConflux - LRQA Nettitude Labs
SharpConflux, a .NET application built to facilitate Confluence exploitation during Red Team and Penetration Testing engagements.

https://labs.nettitude.com/blog/introducing-sharpconflux/


🎖@malwr

✅✅✅ Forward posts to the other groups ✅✅✅

Interesting Multi-Stage StopCrypt Ransomware Variant Propagating in the Wild

Overview The SonicWall Capture Labs threat research team recently observed an interesting variant of StopCrypt ransomware. The ransomware executes its malicious activities by utilizing multi-stage shellcodes before launching a final payload that contains the file

https://blog.sonicwall.com/en-us/2024/03/new-multi-stage-stopcrypt-ransomware/


🎖@malwr

Malware Development Essentials Part 1 | by Smukx | Mar, 2024 | Medium
For Malware development and security professionals, understanding the inner workings of Windows is crucial. Windows internals, the hidden world beneath the user interface, can harbor vulnerabilities…

https://smukx.medium.com/malware-development-essentials-part-1-5f4626652ed9


🎖@malwr

Windows Memory Forensics
How to hunt for anomalies in a Windows Memory Dump

https://blog.cyber5w.com/anomalies-hunting-in-windows-memory-dump


🎖@malwr

VMware ESXi Forensic with Velociraptor
Introduction During our investigations, we have come across more and more VMware ESXi hypervisors.

https://www.synacktiv.com/en/publications/vmware-esxi-forensic-with-velociraptor.html


🎖@malwr

New DinodasRAT Used as Linux Implants Worldwide: First Known Variant Still remains a Mystery

DinodasRAT is a C++ backdoor that was initially used to attack government organizations in Guyana. A new Linux variant targeting Red Hat and Ubuntu Linux has been discovered. The malware establishes persistence using Systemd and SystemV, communicates with C2 servers via TCP or UDP, and uses encryption. Its infrastructure has been linked to specific IP addresses and domains, affecting several countries.

https://hackhunting.com/2024/03/29/new-dinodasrat-used-as-linux-implants-worldwide-first-known-variant-still-remains-a-mystery/


🎖@malwr

New Malicious PyPI Packages used by Lazarus

JPCERT/CC has confirmed that Lazarus has released malicious Python packages to PyPI, the official Python package repository...

https://blogs.jpcert.or.jp/en/2024/02/lazarus_pypi.html


🎖@malwr

Quick Forensics Analysis of Apache logs - SANS Internet Storm Center
Quick Forensics Analysis of Apache logs, Author: Xavier Mertens

https://isc.sans.edu/diary/30792


🎖@malwr