Yeti

Sr. Malware Reverse Engineer & Threat Researcher, Unit 42 Threat Intelligence @unit42_intel | Ex-Incident Response. Opinions are my own.

[Duncan Ogilvie 🍍 @mrexodia]

Was really cool to hang out and demonstrate the IDA Pro MCP with a bit more nuance than 2 minute videos! 🔥

[Unit 42 @Unit42_Intel]

2024-08-21 (Wednesday): First reported in July 2024, a #PowerShell #Stealer named #Kematian Stealer (#KematianStealer) still appears to be active. Details on a recent sample are available at https://t.co/xCprgvPRou

#Unit42ThreatIntel #TimelyThreatIntel

[Unit 42 @Unit42_Intel]

2024-08-06 (Tuesday): We found a #Xerxes Android #botnet server on 144.217.61[.]133 that was active until Monday. Pivoting on data from the server, we found two domains used for other Xerxes botnet servers in 2023. More info at https://t.co/syaUCMbzpi

[Yeti @Yeti_Sec]

Stargazers Ghost Network continuing to push malware on GitHub.

Sampling the data today, found Lumma Stealer under the repo name "Fortnitehck-seuj".

SHA256: d326e987fdb5fe5da2b52e73556a382ff945b526c4394c7747f26bc8be08d136

https://t.co/A6yNRU3iWD

#lummastealer

[Aidan H @thehappydinoa]

Found some XehookStealer C2 instances using Censys Search https://t.co/KDgo8muXuM #c2 #xehookstealer

[Yeti @Yeti_Sec]

Tried hunting for RisePro panels ? Try using this search term.

Censys -> services.http.response.body_hashes:"sha256:5e52c3d964fc5e71ca6ed84cb3061f3d48921f12c08beb5f13e19be0fe5065c2"

Censys: 21 results

#RisePro #malware #threatintelligence

[Yeti @Yeti_Sec]

My latest research blog in collaboration with my colleague @rerednawyerg

[Unit 42 @Unit42_Intel]

With the release of #MaaS #BunnyLoader 3.0, our researchers distill the information gained from new samples of this upgraded malware.

Capable of #CredentialStealing and more, this article provides a thorough overview of BunnyLoader’s progression: https://t.co/vDkpZ08CDm

[Unit 42 @Unit42_Intel]

With the release of #MaaS #BunnyLoader 3.0, our researchers distill the information gained from new samples of this upgraded malware.

Capable of #CredentialStealing and more, this article provides a thorough overview of BunnyLoader’s progression: https://t.co/vDkpZ08CDm

[Unit 42 @Unit42_Intel]

#MedusaRansomware gang launched a dedicated leak site as part of their multi-extortion strategy. This article covers their victimology, toolkit and an ind-depth look at their #TTPs — a close examination of the literal gaze of Medusa’s binary. https://t.co/hcvEISaKjp

[Yeti @Yeti_Sec]

Tried hunting for Meduza Stealer panels ? Try using these search terms.

Censys -> services.http.response.html_tags="<title>Meduza Stealer</title>"

Hunter -> web.title="Meduza Stealer"

Censys: 9 results
Hunter: 11 results

#MeduzaStealer #malware #threatintelligence

[Yeti @Yeti_Sec]

Virtually attending CYBERWARCON this week. Excited to check out the conference for the first time. Curious to hear the talk from @cglyer on RomCom malware usage 🤘

#CYBERWARCON

[Yeti @Yeti_Sec]

Curious about exploited CVE-2023-3519 Citrix Gateways?

Try using these search terms on these platforms.
Censys -> https://t.co/iqTwwiKnKx
Hunter -> https://t.co/OJV4Kb1wgq

Censys: 258 results
Hunter: 301 results

#CVE20233519 #CitrixNetScaler #RemoteCodeExecution

[Unit 42 @Unit42_Intel]

2023-10-17 (Tuesday): We have been monitoring #RemoteCodeExecution vulnerability CVE-2023-3519 affecting #CitrixNetScaler products in the wild. This is a recent snapshot of associated activity. Indicators available at https://t.co/EUjkf1a1ea #CVE20233519 #TimelyThreatIntel

[Yeti @Yeti_Sec]

@r3dbU7z Appreciate you level setting, no issues here

[Yeti @Yeti_Sec]

Tried hunting for DarkGate servers ?

Try using this search term on Censys. ->
(Autoit3.exe) and services.service_name=`DARKGATE`

Censys: 10 results

#darkgate #threathunting #malware #threatintelligence #threatintel

[Yeti @Yeti_Sec]

@1ZRR4H @GoogleAds @malwrhunterteam @JAMESWT_MHT @StopMalvertisin @AnFam17 @pr0xylife @0xToxin @executemalware @James_inthe_box @Max_Mal_ @malware_traffic Dropping that actor name

[Matthew @embee_research]

Defeating API Hashing Using x32dbg and Conditional Breakpoints.

By setting simple log conditions on functions related to API hashing, you can quickly print out decoded hash values without needing to identify or reverse the hashing algorithm.

[1/11]
#Malware

[Yeti @Yeti_Sec]

My team is hiring for a Reverse Engineer at Unit 42. If you feel like you might be a good fit then take a look at the job posting. Hot off the press as of today.
#unit42 #reverseengineer #malware

https://t.co/jZ69cVVTdm

[Yeti @Yeti_Sec]

@CryptoprenuerUK On https://t.co/MQ1MgCVKHW this is what I used to find interesting exfil tooling, typically seen in incident response cases for ransomware.

web.body="chisel.exe"

[Yeti @Yeti_Sec]

#OpenDir, lot's of red team tools

Discovered using https://t.co/MQ1MgCVKHW platform 🔍

Urlscan:
https://t.co/0NngkPjPXR

#ThreatIntelligence #redteam #malware #CyberSecurity

[Yeti @Yeti_Sec]

#OpenDir, 34.238.123.45:8448

Tools: Metasploit, Chisel

Found using https://t.co/VmKlkHyYbD 🔎🔎

UrlScan: https://t.co/FPwKqWHzFv