Windows Memory Forensics
How to hunt for anomalies in a Windows Memory Dump

https://blog.cyber5w.com/anomalies-hunting-in-windows-memory-dump


🎖@malwr

VMware ESXi Forensic with Velociraptor
Introduction During our investigations, we have come across more and more VMware ESXi hypervisors.

https://www.synacktiv.com/en/publications/vmware-esxi-forensic-with-velociraptor.html


🎖@malwr

New DinodasRAT Used as Linux Implants Worldwide: First Known Variant Still remains a Mystery

DinodasRAT is a C++ backdoor that was initially used to attack government organizations in Guyana. A new Linux variant targeting Red Hat and Ubuntu Linux has been discovered. The malware establishes persistence using Systemd and SystemV, communicates with C2 servers via TCP or UDP, and uses encryption. Its infrastructure has been linked to specific IP addresses and domains, affecting several countries.

https://hackhunting.com/2024/03/29/new-dinodasrat-used-as-linux-implants-worldwide-first-known-variant-still-remains-a-mystery/


🎖@malwr

New Malicious PyPI Packages used by Lazarus

JPCERT/CC has confirmed that Lazarus has released malicious Python packages to PyPI, the official Python package repository...

https://blogs.jpcert.or.jp/en/2024/02/lazarus_pypi.html


🎖@malwr

Quick Forensics Analysis of Apache logs - SANS Internet Storm Center
Quick Forensics Analysis of Apache logs, Author: Xavier Mertens

https://isc.sans.edu/diary/30792


🎖@malwr

In-the-Wild Windows LPE 0-days: Insights & Detection Strategies — Elastic Security Labs
This article will evaluate detection methods for Windows local privilege escalation techniques based on dynamic behaviors analysis using Elastic Defend features.

https://www.elastic.co/security-labs/itw-windows-lpe-0days-insights-and-detection-strategies


🎖@malwr

Advanced CyberChef Techniques for Configuration Extraction - Detailed Walkthrough and Examples
Advanced CyberChef techniques using Registers, Regex and Flow Control

https://embee-research.ghost.io/advanced-cyberchef-operations-netsupport/


🎖@malwr

Android Malware Vultur Expands Its Wingspan – Fox-IT International blog
Authored by Joshua Kamp Executive summary The authors behind Android banking malware Vultur have been spotted adding new technical features, which allow the malware operator to further remotely interact with the victim's mobile device. Vultur has also started masquerading more of its malicious activity by encrypting its C2 communication, using multiple encrypted payloads that are…

https://blog.fox-it.com/2024/03/28/android-malware-vultur-expands-its-wingspan/


🎖@malwr

[Nullcon Berlin 2024] The complexity of reversing Flutter applications

Flutter is a cross-platform application development platform. With the same codebase, developers write and compile native applications for Android,...

https://filestore.fortinet.com/fortiguard/research/nullcon.pdf

🎖@malwr

🚨 CVE-2024-3094
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

🎖@cveNotify

Mindmap/Tools at main · Ignitetechnologies/Mindmap · GitHub

Red Team & Blue Team Tools Cheat Sheet

https://github.com/Ignitetechnologies/Mindmap/tree/main/Tools


🎖@malwr

Malware Analysis - JS to PowerShell to XWorm with Binary Refinery - YouTube
We deobfuscate a JScript loader that downloads a powershell script, then we unpack the payload using Binary Refinery. We decrypt the configuration of the fin...

https://youtube.com/watch?v=5ZtmYNmVMKo


🎖@malwr