weed peddler

[weed peddler @WeedPeddler]

Windows' phishing protection ships a hidden crypto engine 🔍

ThreatAssessment.dll = the DLL that evaluates suspicious files for phishing.
It bundles OpenSSL with a full AES-256 — but exports zero crypto.

🔗 https://t.co/WEdvrDXN45

#infosec #reverseengineering #malware

[weed peddler @WeedPeddler]

cryptoss.dll = a Microsoft-signed OpenSSL hidden in System32. Only 2 exports — the AES isn't. By reversing I found the offsets: any binary can encrypt/decrypt with zero crypto code, evading static detection.
https://t.co/bxR39J5oFV
#infosec #reverseengineering #malware

[weed peddler @WeedPeddler]

MEMEXEC — a Cobalt Strike BOF that runs a Windows EXE fully in-memory. https://t.co/8pptavZ8G7

[weed peddler @WeedPeddler]

@MsftSecIntel https://t.co/axMT5y9QMZ

[weed peddler @WeedPeddler]

@MalDevAcademy tlscsp.dll — Ghosted Microsoft RC4 LOLBin (BYOK encrypt/decrypt primitive) https://t.co/D9C8tQGIIl

[weed peddler @WeedPeddler]

tlscsp.dll — Ghosted Microsoft RC4 Decryption
https://t.co/axMT5y9QMZ

[weed peddler @WeedPeddler]

@Dinosn tlscsp.dll — Ghosted Microsoft RC4 LOLBin (BYOK encrypt/decrypt primitive) https://t.co/D9C8tQGIIl

[weed peddler @WeedPeddler]

tlscsp.dll — Ghosted Microsoft RC4 Decryption
https://t.co/axMT5y9QMZ

[weed peddler @WeedPeddler]

tlscsp.dll — Ghosted Microsoft RC4 Decryption
https://t.co/axMT5y9QMZ

[weed peddler @WeedPeddler]

Undefend (MS-Nightmares) focused on blocking Windows Defender updates. This is v2: the same class of technique, extended across most AV/EDR update pipelines — Kaspersky, ESET, Microsoft Defender, and Windows Update- https://t.co/mdvHKAwGKi
#cyber #cve #microsoft #EDR #malware

[weed peddler @WeedPeddler]

I just published The Reflection Trick: Next-Gen PPID Spoofing Using Process Cloning https://t.co/1t0BGz5zpo
#Cybersecurity