Aleandro Sy

Malware analyst

[Aleandro Sy @AleandroSy]

EtherHiding
Decrypting ClickFix C2 with CyberChef and https://t.co/eCgKBkuywb

[JFrog Security @JFrogSecurity]

TeamPCP is back.
The xinference PyPI package (680K downloads, 9.3K stars) was hijacked. Import it and your cloud credentials, SSH keys, and .env secrets are instantly harvested and exfiltrated.
Versions 2.6.0–2.6.2 are malicious. If you installed them, assume compromise and rotate everything now.
Full technical breakdown 👇

[Karsten Hahn @struppigel]

I have created a website, where you can share your sample analysis (via links or posts) and search samples for training based on tags and difficulty.

If you write analysis blogs, you can share them there.
https://t.co/9jlkRxfYW5

[Aleandro Sy @AleandroSy]

Malware self-defense by protecting the process and preventing termination from a non-admin user.

[Aleandro Sy @AleandroSy]

#Vatet options.dat decryption

[nickharbour @nickharbour]

#flareon9 is happening. Let your family know you'll miss them. https://t.co/ymB08dVnjh

[Jakub Kroustek @JakubKroustek]

A few hours ago, we blocked a #ransomware sample in-the-wild that looks like a new #Sodinokibi / #REvil variant. Timestamp 2022-04-27, new config, new mutex, campaign ID, etc. Funny thing... it does not encrypt files; only adds a random extension 🤔 42 BTC https://t.co/UL1ECGLpmg

[Thomas Roccia 🤘 @fr0gger_]

New Microsoft Threat Intelligence report providing insight into Russia's cyberattack activity in Ukraine. The report deals with the recent destructive attacks as well as the organization of Russia! #Infosec #threatintelligence #MSTIC @MsftSecIntel
📰https://t.co/Y93Uomh3l1

[Daniel Lunghi @thehellu]

Part of the #APT Operation GamblingPuppet investigation we presented at #Botconf2022 is now public. It contains analysis of Windows malware families. Expect the slides, full paper with infection vectors, Linux and Mac malware analysis and attribution soon https://t.co/WmUMuiyJJm

[x64dbg @x64dbg]

Finally it dropped! https://t.co/bCstTazcfX

[Aleandro Sy @AleandroSy]

@cryptonft_dude @GodsUnchained @whereislesliesy @TheProfesserf @ParedesKenneth

[Aleandro Sy @AleandroSy]

@CopperPitch @GodsUnchained @TheProfesserf @whereislesliesy

[Marco Ramilli @Marco_Ramilli]

Let's share my CONTI ransomware cheat Sheet to contribute to the fight ! Feel free to grab and use it. If you have suggestions feel free to drop me a message

https://t.co/0ZVE5wLg6v

#conti #ransomware #doublextortion

[Thomas Roccia 🤘 @fr0gger_]

This is really awesome @HexRaysSA released a PDFs format of their tips of the week series 🤩 #ReverseEngineering

👉 https://t.co/fvbKv7tMvs

[Alex Garcia 🔍 @alexgarcia_atx]

6. Pace

A story with no pace is dead on a page.

And your punctuation is where it lies.

Speed things up with short sentences.

Use long-winded sentences to propel the reader into a 400M dash with hurdles they’re prepared to overcome.

Gary Provost with the breakdown:

[Aleandro Sy @AleandroSy]

#BlackMatter 3.0 adds a few more anti-debugging tricks
1. Heap Flags
2. Heap ForceFlags
3. DbgUiRemoteBreakin

[𝕸𝓎𝖐𝖎𝖑𝖑 ☠️ @mykill]

OK here's my RE tweet for 2021.

In up-to-date Hex-Rays decompilers, clicking a brace character and hitting % (percent) will take you to the matching brace.

This is a Vim-style keybinding that I have fervently wished for it until, one day, it just worked. Praise be to @HexRaysSA

[Aleandro Sy @AleandroSy]

GetExitCodeThread can be used to get a thread's return value.