Firos

Security Researcher • Threat Hunter • Mobile Security Expert • Incident Response

[Firos @0FiR0S_]

https://t.co/B91oQQdmTo

My first macOS article on Bypassing macOS Sandbox using AppleScript 🍏

[יוסף חדאד - Yoseph Haddad @YosephHaddad]

Exclusive document leaked from an investigation of a Hamas terrorist‼️

Palestinian propaganda works hard to whitewash the actions of Hamas - share with all your might so that they see the terrorists are that participated in the terrorist attack and admit what they did there! About the shocking massacre, beheading, rape and more... the whole world will hear!

[Firos @0FiR0S_]

@MalFuzzer I agree.
Also asking yourself the right questions it's a key for a successful investigation.

[eli salem @elisalem9]

My new article on #Rhadamanthys stealer. As always, it's a mix between a step-by-step tutorial \ training and a presentation.
Some cool parts:
🗒️ Anti analysis
🗒️ Anti hooking
🗒️ Multiple Defense evasion
🗒️ SEH manipulation
🗒️ Shellcode callback execution
https://t.co/JWhbW2uJuB

[Firos @0FiR0S_]

@Kostastsale @elisalem9

[Firos @0FiR0S_]

@inversecos Great content! Keep rockin'! 🤘💯

[Or Chechik @orchechik]

Check out my blogpost about Banking
Trojan Techniques and their potential
mitigations.

https://t.co/SnieoyDokC

#malware #bankingtrojan #unit42

[Firos @0FiR0S_]

@IdoNaor1 Well described!
Sad and funny at the same time 😅

[Shodan @shodanhq]

The Shodan Membership is on sale now for $5 until the end of Sunday, July 17th (GMT): https://t.co/0iqiq2MWrn

[Firos @0FiR0S_]

@struppigel Congrats!!! ♥️🙏

[Firos @0FiR0S_]

@chen_erlich @CONFidenceConf 🔥🔥🔥

[Firos @0FiR0S_]

@TheDFIRReport @elisalem9 @Brianz_J

[Chen Erlich @chen_erlich]

1/ Our newest, @CR_Nocturnus research is out! 🇨🇳🔥

Uncovering a global #Chinese #espionage campaign, performing a massive multi-year intellectual property theft, carried out by the #Winnti (#APT41) group.

https://t.co/KJ8GACUK1l

[Firos @0FiR0S_]

@elisalem9 Good job Eli!
You're a rockstar 💯🥇👏

[eli salem @elisalem9]

My new article about the #Bumblebee malware. As always, it's a mix between a step-by-step tutorial and a presentation.
Key parts:
🗒️ Unique unpacking mechanism
🗒️Inline hooks for different purposes + shared code with Trickbot
🗒️ Copied anti-analysis code
https://t.co/MWJd0AaRjF

[Firos @0FiR0S_]

@elisalem9 Amazing, as always 👏🏆👏

[eli salem @elisalem9]

Had some free time lately due to covid isolation, so I thought why not write something?
This is my new article about #BazarLoader. Similar to my previous articles, this writeup is a hybrid between a presentation and a step-by-step tutorial.
https://t.co/MnexCtUy8a

[Grzegorz Tworek @0gtweet]

Are you an admin with EXE blocked by #AppLocker? You can bypass the protection without any execution traces in the AppLocker Log! Load your DLL, steal the token from spooler and create the child process.
C source code and the compiled binary, as usual: https://t.co/ZXiRPpEAvO

[Firos @0FiR0S_]

@reecdeep @elisalem9 @Brianz_J

[Firos @0FiR0S_]

@mrd0x @Brianz_J @elisalem9

[Firos @0FiR0S_]

@elisalem9 Noiceee 🔥💯💪