raw-data

[raw-data @_raw_data_]

Had fun with some network protocol 🔍RE and BugSleep 🐞👇

https://t.co/nnvXOVohze

#MuddyWater #ida

[raw-data @_raw_data_]

@txhaflaire @MarceloRivero yup, +1 for #MioLab

[raw-data @_raw_data_]

@suyog41 #MioLab

[Pavel Yosifovich @zodiacon]

Part 2 of the custom PE resources series: how to embed any binary as a resource in Visual Studio and extract it at runtime.
https://t.co/eiyKeHjQnw

[Victor M. Alvarez @plusvic]

YARA-X 1.17.0 has been released. This time with the long-awaited `--fast-scan` option. https://t.co/bmmQP7Rp8A

[hasherezade @hasherezade]

New #TinyTracer (4.0) is ready: https://t.co/hNcO4b3zJ9 - refactored for compatibility with the latest PIN - and with some new features!

[Pavel Yosifovich @zodiacon]

Process Explorer has no driver file in its directory. It embeds the driver, and the 64-bit variant, as custom PE resources inside its own binary. Here's how that works: https://t.co/OiTrhB4UGZ

[Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦 @yo_yo_yo_jbo]

Introduction to the Mach-O file structure, plus a bug I found in Apple's own Mach-O parser!
Read about it here: https://t.co/jt5XjfnKi5

[Duncan Ogilvie 🍍 @mrexodia]

Spent some time battle-testing my LLVM Python bindings by building a basic lifter for x86: https://t.co/Z1T1073RkU

[raw-data @_raw_data_]

@suyog41 #MioLab

[Marcelo Rivero @MarceloRivero]

New #macOS #Stealer in pure #Rust 🦀

🤦‍♂️ Dev forgot to strip TOML defaults from __const:
-- author = "SysAdmin Team"
-- service_name = "com.sysmonitor.agent"
🧬 Crate: sysmonitor::services::{grabber,searcher,tdata,telegram,keylogger}
🧱 Tokio + rustls + native LevelDB
💼 Targets corporate infra → .terraform .kube .helm .azure .docker
🐌 Playing the long game → grabber waits 24h before re-collecting

🤿 Deeper dive: https://t.co/Z6HOCE5MSd

[raw-data @_raw_data_]

@L0Psec MacSync (downloader) vibes ...

[clearbluejar @clearbluejar]

pyghidra-mcp v0.2.0 is out with new --gui mode. 👀

Your local LLM drives a real Ghidra CodeBrowser, not a plugin.

New blog post shows firmware RE of the CVE-2024-3273 RCE chain with Gemma4.
https://t.co/8ShfEIraXY

[raw-data @_raw_data_]

@L0Psec looks like you found some #MioLab / #NovaStealer payloads, check the __data section, it's fun ... also what gets downloaded next ;)

[jaybird1291 @jaybird1291]

I pushed v2.0 of my macOS Persistence Cheatsheet:
https://t.co/tNtFHiHKxS
It’s more than a cheatsheet now: 49 mechanisms, acquisition guidance, source-of-truth notes, collection/triage commands, triggers, review points, and clickable refs.

[Brandon Dalton @PartyD0lphin]

Repository is here (PRs welcome): https://t.co/oYwf1bmpkk

Let me know if you find this handy :)

[Vector 35 @vector35]

Binary Ninja 5.3 (Jotunheim) is released: https://t.co/jfRRcNRbYI

Major highlights: NDS32 support, AArch64 ILP32 ABI, new Universal MachO UI, command palette upgrade, new type library helpers, ghidra export, updated IDB import, HW and conditional breakpoints, and much more!

[Vector 35 @vector35]

Tired of unzipping your password-protected malware samples just to analyze them? We've got you covered.

Our latest blog post covers Container Transforms and how Binja now handles nested binary formats with structure and provenance intact.

Read it here: https://t.co/mZvQl2OkZz

[Patrick Wardle @patrickwardle]

Apple (copied BlockBlock 👀) and added ClickFix protections… but kept the good stuff private 😤

Reversed xprotectd to see how it really works and emerged with enough detail to build your own (kinda)!

Read: No Paste for You!
https://t.co/hoWodAY53h

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[Virus Bulletin @virusbtn]

LevelBlue SpiderLabs profiles MioLab, a Mac MaaS advertised on Russian-language forums. The platform offers C2 & API integrations, with a strong focus on crypto theft including an add-on module built to target Ledger & Trezor hardware wallets. https://t.co/hevIwdn3wq