YCY

🇹🇼 Malware Research Freelancer / Threat Intelligence Analyst / Security Engineer

* My thoughts are my own *

[Black Hat @BlackHatEvents]

More people are proposing using machine learning to classify malware families or detect malware. @Aragorn32328247 presents convolution neural networks with ensemble on memory-resident malware detection framework named "Mem2Img" in this Briefing https://t.co/SNtFTZe3QE

[YCY @batrix20]

Attribute to Lazarus's operation "DangerousPassword" in this Sept.

File name: New Profits Distribution.lnk
MD5: 50ed1ba7abdb38d75e68258275b9f2c7
C&C: filehost[.]network
#dprk #lazarus #apt

[_re_fox @_re_fox]

#malware #lnk New Profits Distribution[.]lnk (50ed1ba7abdb38d75e68258275b9f2c7)

mshta -> https://bit[.]ly/31pI6gC -> www.filehost[.]network

Drops js in temp and lnk in startup which reaches out to https://bit[.]ly/2HhIXsB

https://t.co/BVfJyggjBH

[YCY @batrix20]

@l3_lvm @trungduc751995 Neither do I :/

[YCY @batrix20]

@Aragorn32328247 Hey cool. Thanks for the samples. I know this :) Yeah, personally name it as Xuoncola downloader. Sounds like chocolate in VN 😄

[YCY @batrix20]

Hello #APT32!
MD5: cc2027319a878ee18550e35d9b522706
MD5: e2511f009b1ef8843e527f765fd875a7
C&C: accounts.getmyip[.]com

Deliver #Xuoncola, which uses chocolate like oreo, socola (chocolate in Vietnamese!) in the beacons.

Should I compose a snort signature by "meiji.png"?

[YCY @batrix20]

Might be helpful in the future 🤣🤣
alert tcp any any -> any 443 (pcre:"meiji.png?.{10,50};.{3,20}.exe;";)

[YCY @batrix20]

Fresh cross-platform #APT malware #NukeSped from #Lazarus / #HiddenCobra

#OSX version
MD5: 5357477cccaed037b45d79907d1b404c
Filename: cassoosx

#Windows version
MD5: 6ca14a62e95569bbef1b9d65ab8fb730
Filename: casso.exe

Both of them call to C2: lastedforcast/.com

[YCY @batrix20]

@ninoseki Adorable meme 😂😂

[YCY @batrix20]

#slidewinder #apt used new board announcement as lure theme. Mmm F.. stands for football? 🤔

Filename: AFC New Board.pdf.lnk
C2: www-afc.chrom3/.net r0dps/.net
MD5: b6932a288649b3ceb9a454f808d6eb35

[YCY @batrix20]

@NJay_x00 @virustotal This is wonderful. Thanks for sharing! How about behaviour_files:"8.t" and tag:"rtf"? It can extend to more samples and reduce some noises.

[YCY @batrix20]

Amazed by @virustotal's search capability. An alternative way to hunt #royalroad exploit template.
Syntax: behaviour_files:"wll" and tag:"rtf"

[Clément Labro @itm4n]

Here is my detailed write-up about CVE-2020-0787 - Windows Background Intelligent Transfer Service Elevation of Privilege 🙂

👉 https://t.co/fcXIUSYkT3

[YCY @batrix20]

I am so glad they are safe ;)

[ᴘᴀʀᴛʜɪ @cyber__sloth]

A #mustangpanda #lnk sample possibly targets Taiwan using #coronavirus lure. Uses tencentsoso.exe for DLL sideloading. The final payload is #cobaltstrike. Domain fronting via "https://t.co/pcBohEhAV7". C2: 123.51.185[.]75 hash: fc00964131a8c9407ba77484e724fc9d

[Panos Gkatziroulis 🦄 @ipurple]

A Trivial Privilege Escalation Bug in Windows Service Tracing https://t.co/40Y4fknV76

[Samir @SBousseaden]

cve-2019-19363 is a good example of why one should baseline "normal" execution of the PrintIsolationHost.exe since this represent a valid vector for exploiting print drivers (any user can install) with weak ACL for privesc and/or persistence.

https://t.co/JS77W7VcO0

[YCY @batrix20]

@Aragorn32328247 Nice discovery!

[YCY @batrix20]

@PINKSAWTOOTH Plus, the detection name "Enfal" seems to be abused and might lead to wrong attribution.

[YCY @batrix20]

Great analysis of Royal Load and its attribution in #JSAC2020 from @PINKSAWTOOTH.

The one delivering "Enfal" acts similar role like Lurid downloader. But we prefer gave it a new name since its code structure is quite different!

[YCY @batrix20]

@PINKSAWTOOTH These actors often love to create new downloader: https://t.co/GpTyIAXKal

[Nicolas Krassas @Dinosn]

Applying Cache Probing Attack over multiple Google platforms https://t.co/kW9p3yyKSm