0x4143

Purple Teaming by day, Malware Hunter by night 🏴󠁧󠁢󠁥󠁮󠁧󠁿 (All opinions are my own, not of my employer)

[0b1d1 @_0b1d1]

🕵️ Windows Forensic Commands: Investigate, Analyze & Respond 🔍💻

When a security incident occurs on a Windows system, knowing which commands to run can make the difference between guessing and solid digital forensics 🧠⚖️

⤵️ Blue Team ⤵️

[0x4143 @0x4143]

Unknown(?) golang ransomware/wiper
MD5: f184b9d19baaa682472598556c74e469
SHA256: ac4c4fff973e0609d61d8b37b0536271b2c7e4a2ead8bed5de238ad697d651e0
filename: rhs.exe
backup_log.txt
spawns: reg.exe, takeown.exe, icacls.exe, vssadmin.exe, powershell.exe

[Back Engineering Labs @BackEngineerLab]

Given the recent events with VMPSoft DMCA'ing educational YouTube videos demonstrating how to unpack malware protected with VMProtect, we have decided to release a free to use unpacker which works for all versions of VMP 3.x including the most recent version.

Simply sign up/login here: https://t.co/7xp43sCIwv and then click on "Unpacker" on the top right corner.

For context:
https://t.co/8z6V6232YN https://t.co/kHm3O764FL https://t.co/T9EyF53FEV

[0x4143 @0x4143]

G:\Mammon\Release\Mammon.pdb - so maybe Mammon ransomware?

[0x4143 @0x4143]

New ransomware...
MD5: c85b8d8a130e475bd294feb1be152890
SHA256: db7244e877f1801fd83dc504295ba04f362bc1b7966fc5c41a06f0fb1ddd7bd7

file.ext -[https://t.co/[email protected]]id-[<10randomchars>].aaabbbccc
ransom note: howtoDecrypt.txt

[0x4143 @0x4143]

@bbaskin @sublime_sec Awesome, congrats!🔥

[Takahiro Haruyama @cci_forensics]

My presentation slides "UEFI Bootkit Hunting: In-Depth Search for Unique Code Behavior" @REverseConf are available online https://t.co/QCQaFi8SaY

[wetw0rk @wetw0rk7]

The Windows Kernel Exploitation tutorial series is complete for both English and Spanish speakers. Huge thank you to @HackSysTeam for creating HEVD to begin with and thank you to @corelanc0d3r and @ret2wargames for creating resources that are free for those who can't afford them!

[Mar_Pich @Mar_Pich]

6 months ago, I started working on a way to better map the #ransomware ecosystem and its evolution, including rebrands.🔎
I am really happy to share this handmade cartography, which is based on @orangecyberdef resources, #OSINT and reverse engineering.
➡️ https://t.co/cKK57AM07f

[nao_sec @nao_sec]

Interesting maldoc was submitted from Belarus. It uses Word's external link to load the HTML and then uses the "ms-msdt" scheme to execute PowerShell code.
https://t.co/hTdAfHOUx3

[0x4143 @0x4143]

Unknown (new?) #ransomware
Encrypts files with .vgvx extension

SHA256: 81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740

CC: @demonslay335 @Amigo_A_

[Kostas @Kostastsale]

I usually make short-form satirical videos for fun, but never share them with the world. This time tho, I thought I'd make one for the infosec community. Some might even find it educational 😅

If you're in #infosec and you feel a little down this week, this video is for you💙

[payloadartist @payloadartist]

☁️ Awesome Cloud Security ⚔️

Collection of awesome #Cloud security tools, standards, and other resources

🔗 https://t.co/tY3exOX9Sj

#cloudsecurity #DevOps #Pentesting #infosec #cybersecurity

[mr.d0x @mrd0x]

Bypass Defender AV static detection:

If you name a malicious file DumpStack.log Defender doesn't scan it.

[0x4143 @0x4143]

@0xAsm0d3us Thx for the mention @0xAsm0d3us ! I aim to update this again very soon! 😎

[Cryptolaemus @Cryptolaemus1]

🚨🚨WARNING 🚨🚨 We have confirmed that #Emotet is dropping CS Beacons on E5 Bots and we have observed the following as of 10:00EST/15:00UTC. The following beacon was dropped: https://t.co/imJDQTGqxV Note the traffic to lartmana[.]com. This is an active CS Teams Server. 1/x

[ESET Research @ESETresearch]

#ESETresearch discovered a trojanized IDA Pro installer, distributed by the #Lazarus APT group. Attackers bundled the original IDA Pro 7.5 software developed by @HexRaysSA with two malicious components. @cherepanov74 1/5

[mr.d0x @mrd0x]

Today I've launched https://t.co/ioguLMcADN. I've been analyzing malware source code that utilizes WinAPIs and have been categorizing them. Please feel free to contribute as I know the current list is not exhaustive.

[Didier Stevens @DidierStevens]

I found some private keys on VT, enabling all of us to decrypt C2 traffic from a subset of all the malicious Cobalt Strike servers that are out there on the Internet. More details: "Cobalt Strike: Using Known Private Keys To Decrypt Traffic – Part 1" https://t.co/HMBZEV4akv

[newlog @Newlog_]

I tweaked https://t.co/Sahc22ongY a little bit and I uploaded trainings, courses, papers, presentations, and posts with the idea in mind that knowledge should be free. Some of the most interesting content follows: