stuckinVim🐉

Computer Virologist

[stuckinVim🐉 @AGertani]

@real_redp This one was great!

[stuckinVim🐉 @AGertani]

Are you attending BlackHat this year and you are based in the US or EU? please DM lets get together and chat as I’m hiring for an open Malware Analyst/Reverse Engineer positions in my team #BlackHat #BHUSA #BHUSA2022

[stuckinVim🐉 @AGertani]

@fabio_viggiani A classic heart breaker

[stuckinVim🐉 @AGertani]

@pmelson @drb_ra ✔️

[stuckinVim🐉 @AGertani]

#Emotet today

[stuckinVim🐉 @AGertani]

we need to step up our game!

[stuckinVim🐉 @AGertani]

😅😅😅😅

[Myrtus @Myrtus0x0]

hate to say it, but I agree. #Emotet is back

[stuckinVim🐉 @AGertani]

@fabio_viggiani Fanatasitc research! Thank you so much for sharing

[stuckinVim🐉 @AGertani]

"This seems to be a plugin built into Qbot." Yes! #Qbot #malware has an Independent module to load #CobaltStrike on infected systems https://t.co/MsIP92kPnz

[Fabio Viggiani @fabio_viggiani]

More information and IOCs on the ProxyShell+QBot+Conti ransomware attacks that we are investigating

[stuckinVim🐉 @AGertani]

@0verfl0w_ https://t.co/BUuBo9HieE was a great help!

[stuckinVim🐉 @AGertani]

If you are working with #Qbot #Malware stagers and modules consider using this #IDApro python script to resolve the imports statically. https://t.co/j38GzVRUao

[stuckinVim🐉 @AGertani]

@kxynos @_n1ghtw0lf Sweet! Will check it out

[stuckinVim🐉 @AGertani]

If you are working with #Qbot #Malware consider using this IDA pro python script to decrypt the stager strings.
https://t.co/1cT1B6GF69

[stuckinVim🐉 @AGertani]

@elisalem9 Thank you!

[stuckinVim🐉 @AGertani]

@James_inthe_box Thank you! @James_inthe_box

[stuckinVim🐉 @AGertani]

So apparently this binary was designed to debug #Qbot #Malware and it was found on a #Qbot infected device.
🥲🥲🥲

[stuckinVim🐉 @AGertani]

Found a possible #Qbot #QakBot #malware module you suspect to be a #CobaltStrike shellcode loader. Run it through this script it will extract the config for you https://t.co/MsIP92kPnz

[stuckinVim🐉 @AGertani]

@herrcore @fr0gger_ Yup I see the bulk import option in the GitHub repo 🤠

[stuckinVim🐉 @AGertani]

@herrcore @fr0gger_ @herrcore I didn't try it my self yet but I noticed that API was recovered only once but it was used multiple times in the binary

[stuckinVim🐉 @AGertani]

@RolfRolles Thank you! a lot of analysts don't see value in applying types and its indeed important for correct analysis and the "force call" feature is interesting will give it a shot