Forwarded from Order of Six Angles
Malware Analysis - Malicious MS Office files without Macros
https://www.youtube.com/watch?v=RtHHckH5IsI
https://www.youtube.com/watch?v=RtHHckH5IsI
YouTube
Malware Analysis - Malicious MS Office files without Macros
We look at two techniques for MS Office files to load and execute malicious code without Macros, namely VSTO Add-ins and External Templates. At the end I provide a checklist for analyzing office files to determine if they are clean.
Discord: https://dis…
Discord: https://dis…
🔥3👍1
Dropping some tooling to assist with Windows RE (or any really); bulk download modules across all versions, search for call chains from references, immediates, instructions, etc. Has been useful for mass-analysis, cross-version diffing, variant analysis, and just generally locating candidates for more thorough investigation (ioctl dispatch, rpc handlers/chains, what functions eventually call a desired target).
analyze.py - IDA Pro 9.X Python for automated call chain analysis
runner.ps1 - PowerShell batch runner for mass binary analysis
download-all-versions.ps1 - Download historical binary versions + PDBs
https://github.com/daaximus/ida-reach/
👾4
New post: "Browser Dumping — The Core Tactic Behind Most Infostealers"
(This blog is mainly for sharing my personal notes and learning journey)
#stealer #browser #Chrome_AppBound
(This blog is mainly for sharing my personal notes and learning journey)
This blog contains my own research collected from the internet, along with ideas from other blogs and studies. While many parts are written in my own words, the Most sections were copied directly from external sources because they were already very well written and clearly expressed. This blog is mainly for sharing my personal notes and learning journey.
#stealer #browser #Chrome_AppBound
👾8
Ｓｅｃ Ｎｏｔｅ
New post: "Browser Dumping — The Core Tactic Behind Most Infostealers" (This blog is mainly for sharing my personal notes and learning journey) This blog contains my own research collected from the internet, along with ideas from other blogs and studies.…
Wanna bypass chrome ABE? Read this and let the ideas flow
🔥6🕊1
Ｓｅｃ Ｎｏｔｅ
Red Team Infrastructure The Full Picture: From Domain to Beacon #infra #c2
A well-structured analysis of the most effective infrastructure strategy
Does your team operate with this level of structured, strategic thinking?
Does your team operate with this level of structured, strategic thinking?
👍8
Sec Controls: The Art of Breaking Through
#malware #evasion
The definitive red team guide to understanding and bypassing Windows security controls: Windows Defender (static + AMSI + behavioral), AppLocker, WDAC, SmartScreen, ASR Rules, Credential Guard (VBS/LSAIso), Sysmon, PPL, and a comprehensive EDR deep-dive covering kernel callbacks, ETW-TI, API hooks, BYOVD, EDRKillShifter, EDRSilencer, sleep obfuscation, call stack spoofing, process injection, and the complete EDR kill chain. Every bypass mapped to MITRE ATT&CK.
#malware #evasion
👍7👾5
Media is too big
VIEW IN TELEGRAM
🔥My new project 😁
Lor-C2 — A Custom C2 Framework
Operate. Execute. Stay focused.
Lor-C2 lets you run red team operations while enjoying Lori music.
Lor-C2 — A Custom C2 Framework
Operate. Execute. Stay focused.
Lor-C2 lets you run red team operations while enjoying Lori music.
😁10🔥7🕊2
Approaching stealers devs: a brief interview with notnullOSX (ex-0xfff)
https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-notnullosx-ex-0xfff-4ca8f1600ac0
#stealer
https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-notnullosx-ex-0xfff-4ca8f1600ac0
#stealer
👾4
Forwarded from Mirza Σλθ 🧙♂️
A Go implementation (With ELF, PE, Mach-o releases) of the original pymauistore tool for extracting assemblies from .NET MAUI 9 binary blobs such as
https://github.com/kousha1999/gomauistore
libassemblies.arm64-v8a.blob.so.https://github.com/kousha1999/gomauistore
GitHub
GitHub - kousha1999/gomauistore: A Go implementation of the original "pymauistore" tool for extracting assemblies from .NET MAUI…
A Go implementation of the original "pymauistore" tool for extracting assemblies from .NET MAUI 9 binary blobs such as libassemblies.arm64-v8a.blob.so. - kousha1999/gomauistore
👍3👎1
Good write-up on building a kernel-based EDR and understanding how Windows telemetry is actually implemented.
https://blog.whiteflag.io/blog/from-windows-drivers-to-a-almost-fully-working-edr/
Focus is on real detection primitives like:PsSetCreateProcessNotifyRoutine(Ex)for process lifecycle monitoringPsSetLoadImageNotifyRoutinefor image/DLL trackingObRegisterCallbacksfor process/thread handle filtering
kernel → user-mode communication via IOCTL + agent design
https://blog.whiteflag.io/blog/from-windows-drivers-to-a-almost-fully-working-edr/
👾2
TL;DR: Two command injection vulnerabilities exist in the Windows Explorer “Open PowerShell window here” context menu due to improper quoting and command injection through user-controlled folder paths. By creating folders with crafted names (e.g., folder; calc), an attacker can trigger arbitrary PowerShell command execution when a user uses Shift + Right-Click → Open PowerShell window here. One variant affects modern Windows 11 builds, while another existed since Windows 10 1703 (2017).
You can find the scenarios and the slides of the Insomni’hack 2026 talk in https://github.com/p0dalirius/Shift-Happens-Uncovering-to-builtin-command-injection-in-Windows-context-menus
👍2
Malware, Cats and Cryptography
2026-cocomelonc-bsideslux.pdf
Let me keep it short… use uncommon stuff for static
(here is my conference ┐( ∵ )┌)
chain things smart to get past behavior detection.