Navdeep

malware executor @IndianCERT, ex @ZSAssociates

[Navdeep @ItsNavdeep]

@nickharbour Looks like a couple of names from as early as top 30 were removed. That’s quite interesting..

[Navdeep @ItsNavdeep]

@milved Thanks!

[Navdeep @ItsNavdeep]

Just completed the Flare-On challenge for this year!
Planning to do it at a more relaxed pace over the full six weeks next time.
#flareon11

[Navdeep @ItsNavdeep]

Every year I spend a lot of time learning some new witchcraft, thanks to @6502_ftw - only to realise later that I didn’t need to. #flareon11

[Navdeep @ItsNavdeep]

@fsharp123 I patched the 10k score in memory after crc32 check.

[Navdeep @ItsNavdeep]

@thehellu Great analysis!

Would like to just point out one minor oversight in the report:

The bytes 08 08 08… are not a hard-coded delimiter. They are instead the 4 DNS lookup IP addresses used to resolve C2 domains:
8.8.8.8
8.8.4.4
4.4.4.4
4.2.2.2

[Navdeep @ItsNavdeep]

Completed another Flare-On challenge. FLARE team didn't hold back on difficulty this time around.
Was (mostly) fun though! #flareon10

[Navdeep @ItsNavdeep]

@m_r_tz Thanks! Definitely didn’t have Patience to type or try OCR..

[Navdeep @ItsNavdeep]

https://t.co/diml9h1ISL

[Navdeep @ItsNavdeep]

Blog post: “Operations of an APT malware written in PureBasic” #malware #PureBasic #APT #Lazarus https://t.co/1Xb4S3I0s9

[Navdeep @ItsNavdeep]

Kaspersky has released a report on the malware I described in my blog last year. #EarlyRAT #Lazarus #Andariel

[BleepingComputer @BleepinComputer]

New EarlyRAT malware linked to North Korean Andariel hacking group - @billtoulas
https://t.co/6mFl7RDdt8

[Navdeep @ItsNavdeep]

@IngHidaka @G2Thijs AAECAfHhBByW6AP36AOm7wPN+QPhpATlsATHsgSWtwSY1ASa1AS42QT04wT84wT+4wSU5ASJ5gSP7QSk7wSH9gSy9wSz9wS2+gSrgAWogQWimQWXpAWfpAXipAUBieQEAA==

[Navdeep @ItsNavdeep]

@verixvogel Nice job. Congrats!

[Navdeep @ItsNavdeep]

@milved @nickharbour Thanks!

[Navdeep @ItsNavdeep]

Time has been scarce recently.. happy to still complete #flareon9 much faster than last year. Thanks @nickharbour and rest of the FLARE team.
Looking forward to next year!

[Navdeep @ItsNavdeep]

@suvaditya_ @nickharbour Thank you!

[Navdeep @ItsNavdeep]

@MrT4ntr4 @nickharbour Thanks!

[Navdeep @ItsNavdeep]

@suvaditya_ Congrats!

[Navdeep @ItsNavdeep]

Blog post: “Operations of an APT malware written in PureBasic” #malware #PureBasic #APT #Lazarus https://t.co/1Xb4S3I0s9

[Navdeep @ItsNavdeep]

@gsatpathy I have submitted a PR with the changes to oletools repo. https://t.co/S66D02O6kP

[Navdeep @ItsNavdeep]

Blog post: “Extracting userform field values from VBA maldocs” https://t.co/0x1weRgX9k

[Navdeep @ItsNavdeep]

@milved Thanks!