Drew Schmitt

Malware dude, DFIR, Power-Response, former US Army cavalry scout, all thoughts and opinions are my own

[Gi7w0rm @Gi7w0rm]

#Aurora #Stealer #panel recovered.
#Aurora #Stealer #builder 2023 recovered .
#Aurora #Stealer #builder 2022 recovered.
#Aurora #Auth Server recovered.
An article on reversing the builder is already in development by a fellow #infosec researcher.
Happy Sunday :)

[Germán Fernández @1ZRR4H]

#ESXiArgs ransomware decompiled 🔦👀
https://t.co/UnLbzX3YB3

[Jiří Vinopal @vinopaljiri]

If you are looking for #IDA plugin/script list, @fr0gger_ has a great list 😊👍
https://t.co/VlDn4YSTsr
But here are some of my personal best I am using and I would like to recommend:

[Max_Malyutin @Max_Mal_]

#IcedID (A.K.A #Bokbot) ISO Infection 🧊🆔

#DFIR Exec Flow & TTPs:
ZIP > ISO > LNK > Rundll32

Defense Evasion (TA0005)
[+] CMD line carets obfuscation "^"
[+] Rundll32 to proxy exec of DLL payload

start r^un^dl^l3^2 9bs6gHsN.d^l^l, #1"

C2: hxxp://aviadronazhed[.]com:80

[Florian Hansemann @CyberWarship]

"Malware development tricks. Download and inject logic. C++ example."

#infosec #pentest #redteam
https://t.co/oYJfRwPXCJ

[Florian Hansemann @CyberWarship]

"Shell Code Injector with AES Encryption - EDR Bypass"

#infosec #redteam #pentest
https://t.co/CblemKKpOZ

[vx-underground @vxunderground]

REvil ransomware group has ransomed Chinese electrical manufacturer Midea Group. Midea Group has an estimated annual revenue of ¥343,400,000,000 or approx. $49,000,000,000.

REvil is continuing its big game hunting.

[vx-underground @vxunderground]

Leaked documents online show the purchase (and documentation of) an $8,000,000 iOS Remote Code Execution 0day exploit

[vx-underground @vxunderground]

Lockbit ransomware group has put out a statement regarding the Entrust breach and subsequent DDoS attack they are (still) under. Lockbit states they are changing their operation practices to combat DDoS attacks

*Intel via @S0ufi4n3
*Image: Lockbit message translated into English

[Arda Büyükkaya @WhichbufferArda]

Unpacked Bumblebee loader performing some anti analysis checks, this technique was copied from open source project called "al-khaser" :=)

[R. @0xrb]

#systemBC #malware Targeting various #Mexico corp/enterprise network
#Mexico Victim List (1145) : https://t.co/bGBvmSxhYO
cc: @vxunderground @b3ard3dav3ng3r

[vx-underground @vxunderground]

This is the source code to Thanos Ransomware Builder. It is password protected.

https://t.co/SgPCdI00TS

[SANS.edu Internet Storm Center @sans_isc]

Excel 4 Emotet Maldoc Analysis using CyberChef https://t.co/AuHzYgmxNL

[vx-underground @vxunderground]

Lockbit has informed us that this is "normal behavior" and this report from @malvuln is the result of an incorrect password.

"[the] binary file can't decrypt without[sic] wrong password. It's not bug"

[ςεяβεяμs - мαℓωαяε яεsεαяςнεя & мαℓωαяε gεиεтιςιѕт @c3rb3ru5d3d53c]

Destroying #Bitter #APT's #ZxxZ #Backdoor

✅ #Exploit+#Shellcode Analysis
✅ Building it's C2 Server to Execute a #Meterpreter Payload
✅ YARA/Suricata/Sigma
✅ #Ghidra Project
✅ #Malware Reverse Engineering
✅ Config Extraction

https://t.co/1nNAHMattv
https://t.co/rb0FuxB1HR

[Arda Büyükkaya @WhichbufferArda]

Lockbit Black 3.0 can yeet the Windows Defender and Event logs of it. Look at the Enabled key, it's set to 0 by Ransomware at the start.
@vxunderground @malwrhunterteam

[vx-underground @vxunderground]

.@malvuln found an exploit in Lockbit 3 (Lockbit Black). Lockbit does not verify the length of the Execution Key - resulting in a Buffer Overflow.

Lockbit, are you going to pay out like your site says you will?

#lockbit #bugbounty

Details: https://t.co/TMJnVtpyLa

[Florian Roth ⚡️ @cyb3rops]

This obfuscator for Go binaries replaces values with exactly 8 byte long random chars, which we can use to create a YARA rule to detect that obfuscation 🥳

[vx-underground @vxunderground]

Yanluowang ransomware groups claims to have ransomed Walmart - a United States-based multi-national grocery store with an est. annual revenue of $572,800,000,000.

*We are unable to confirm the legitimacy of these claims
*Information and photograph via @BrettCallow

[ςεяβεяμs - мαℓωαяε яεsεαяςнεя & мαℓωαяε gεиεтιςιѕт @c3rb3ru5d3d53c]

Tell me all your secrets in the clear #malware. 😘