OD

Threat Researcher @SophosLabs

[OD @___OD___]

@unpacker <3

[OD @___OD___]

@YungBinary do you mean 0x22050C ?

[OD @___OD___]

@weezerOSINT Opus is HON HAI PRECISION INDUSTRY, foxxcon, wonder if others are vuln https://t.co/316YSYVAeT

[OD @___OD___]

@HalifaxBank You too :) if I change my name to o’droptables! Might not be as fun :)

[OD @___OD___]

@HalifaxBank fun bug adding a standing order :)

[OD @___OD___]

@HalifaxBank Replicates 3 time, standing order, any recipient. Any amount. Monthly.
If you type the password it’s fine :)
I am going to guess, the bug is due to a apostrophe in my name :)))

[OD @___OD___]

@struppigel can you add the data.bin to VT plz :)

[OD @___OD___]

@luke92881 @AnFam17 @SquiblydooBlog @JAMESWT_MHT @ankit_anubhav nice extractor :)

[Karsten Hahn @struppigel]

I created a NightHawk String Decoder IDAPython Script.
It will add the decoded strings as comments to IDA.

https://t.co/MCc1aJ9I5r

[OD @___OD___]

@nahamike01 my fave bit so far o.O

[Cryptolaemus @Cryptolaemus1]

Loader update from @lazyactivist192: Seems Ivan is a bit upset at @Sophos today. Gotta love those UTF-16 "Fuck Sophos" strings.

Additionally, to add fuel to the fire, here's a yara rule that hits off all binaries today:
https://t.co/zSikGpWMHB
Enjoy :)

[Joshua Saxe @joshua_saxe]

1\ I've written a little compiler to ship ML models as standalone Yara rules, and done proof of concept detectors for Macho-O, RTF files, and powershell scripts. So far I have decision trees, random forests, and logistic regression (LR) working. https://t.co/QR4T3gEztm

[OD @___OD___]

Cobalt shellcode saying hello... o.O

[Albert Zsigovits @albertzsigovits]

Technical synopsis and IoCs of new DarkRat #darkrat.
Now distributed via #RigEK.
https://t.co/R1DGSvMXAo

@benkow_ @egeblc @siri_urz @Xylit0l @fumik0_ @prsecurity_ @MisterCh0c @sS55752750 @ViriBack @v0id_hunter @voidm4p @nao_sec @P3pperP0tts @FewAtoms @0xffff0800 @executemalware

[PeterM🌻 @AltShiftPrtScn]

#Colbalt beacon: C:\Users\<username>\Chrome.exe (490ea728a239f448f17a669fbbb0fa7548bf58d5858692d450ca94ce791456e9) used in #RYUK attack. Talks to C2: 45.77.141.82 which has an interesting shodan result https://t.co/KzOuA3QygZ pretending to be signed by Rapid7.

[Gabor Szappanos @GaborSzappanos]

CVE-2018-0798 was a less-known Equation Editor exploit. Until the end of June. Then we started to see crimeware infection campaigns (Formbook, Lokibot, AzoruLT, Fareit) using it. Over 200 new samples since then.
https://t.co/wfDvsKFGE0

[Mark Loman @markloman]

BlueKeep file-less RCE PoC demonstrates risk of Remote Desktop exploit https://t.co/CjokuN2WVT via @SophosLabs Video: https://t.co/8OpnfhZpmE

[Nicolas Krassas @Dinosn]

A Debugging Primer with CVE-2019-0708
https://t.co/vo5mU2qTDY

[Tavis Ormandy @taviso]

Am I the first person to pop a shell in notepad? 🤣 ....believe it or not, It's a real bug! 🐞

[OD @___OD___]

@BlueKeepTracker before anyone bothers, J("start <rickrolluri>....