Alex

[Alex @cryptogramfan]

Here's my write-up on how to use perceptual hash algorithms to track malware campaigns that use visually similar maldocs (e.g. #Emotet, #QakBot, #Ursnif). Also released graph_similar_document_images.py that will graph out visually similar maldocs.

https://t.co/0HIuIbQSaO

[HP Wolf Security @hpsecurity]

We’ve just published YARA rules and Python scripts to our GitHub that detects and extracts #IcedID and #BazaLoader malware from Excel add-in (#XLL) files.

[HP Wolf Security @hpsecurity]

New #PurpleFox EK campaign spotted in the wild.

An IE Exploit was hosted on this domain:
hxxps://feneffecsdoteteat.aixgedbubirtsabkhotsswse[.]shop

C2 (registered on 25/07/2021):
hxxps://8ze[.]me/u.php?id=1

[HP Wolf Security @hpsecurity]

We’re super excited to share our research into #opendir malware hunting and announce a new framework at #VBLOCALHOST @virusbtn this October! Hope to see many of you there.

[HP Wolf Security @hpsecurity]

#PurpleFox EK now exploits CVE-2021-26411, demonstrating a short PoC-to-ITW time. On 12 April we isolated a sample from a HP Sure Click Enterprise customer in the Middle East. More details in our write-up by @stoerchl on the HP Threat Research blog.
https://t.co/VZnIqgO29u

[HP Wolf Security @hpsecurity]

We saw high volumes of #Dridex malspam last week, showing up as three groups when clustering samples by filename similarity.

[Virus Bulletin @virusbtn]

Bromium's Patrick Schläpfer explains how to extract payload URLs from Dridex samples and provides a python script to do that https://t.co/sqoYfD6Nae

[HP Wolf Security @hpsecurity]

We're pleased to share the HP-Bromium Threat Insights Report for July 2020. Highlights include a look at the top document malware file types and office exploits we've seen in 2020 so far, and insights into recent #Aggah, #QakBot and #WannaMine campaigns.

https://t.co/aMsu2nZYfr

[Alex @cryptogramfan]

Here's my write-up on changes to the #Aggah malspam campaign which looks at their mail infrastructure, lures, targets, PowerPoint Add-In dropper and Bitcoin stealer.

[HP Wolf Security @hpsecurity]

In May, the attackers behind the #Aggah malicious spam campaign impersonated B2B companies in Europe, the Middle East and Asia to compromise businesses. They also adopted a PowerPoint dropper and cryptocurrency stealer. https://t.co/Wg6UbXTwls

[BSides Bristol @bsidesbristol]

At present we still intend to run the event at the end of July. We are monitoring the situation and will make a final call over the coming month.

[Alex @cryptogramfan]

A closer visualisation of the #Nemty campaign that targeted APAC organisations in February 2020.

[Alex @cryptogramfan]

I've been seeing a lot of #Nemty malspam activity lately.

[BSides Bristol @bsidesbristol]

SPONSORS. We need your support. See our Sponsor Information Pack and levels available on our website. https://t.co/KWuuP4ZoOD Let's make this happen!

[OWASP Cambridge UK @OwaspCambs]

Extremely informative overview of reverse engineering of “Ransomware as a Service” #Buran by @cryptogramfan @bromium for Joint @BcsForensics @owasp @OwaspCambs @ARUCyberRes “Aspects Of Digital Forensics” Workshop @AngliaRuskin @aru_fse #cambridge on Wednesday 19th Feb

[Alex @cryptogramfan]

The CfP for #bsidesbristol is officially open. This year we're accepting shorter talks (20 mins) as well as regular presentations (45 mins, including Q&A). If it's your first time presenting, we also have friendly mentors on hand to give advice and feedback.

[BSides Bristol @bsidesbristol]

Save the date... 29th and 30th July 2020 BSides Bristol is back! And our Call for Presentations is now open - get submitting! https://t.co/k2ZuCYspwn

[Alex @cryptogramfan]

Direct link to script: https://t.co/QBvPtlO1qo

[Alex @cryptogramfan]

Here's my write-up on how to use perceptual hash algorithms to track malware campaigns that use visually similar maldocs (e.g. #Emotet, #QakBot, #Ursnif). Also released graph_similar_document_images.py that will graph out visually similar maldocs.

https://t.co/0HIuIbQSaO

[Alex @cryptogramfan]

#Emotet malspam activity resumed on 13 January 2020. This festive period its actors took a 21 day break, compared with 23 days in 2018/19. cc @Cryptolaemus1 @abuse_ch

[Alex @cryptogramfan]

If you're interested in malware analysis & RE, I highly recommend the #Zero2Hero course by @VK_Intel and @0verfl0w_. Props to @SentinelOne for releasing ~7 hrs of content for free. It's community contributions like these that close the gap between defensive & offensive capability

[Alex @cryptogramfan]

@QW5kcmV3 My sources suggest the term has military origins. Earliest reference I could find is R. E. Conley: Military Command and Control (c2) (Signal, Vol 33 No 4, Jan 1979, p 14). The Joint Doctrine for Command and Control Warfare (C2W) from 1996 also uses it:
https://t.co/ux8PWmXAN5

[Alexandre Borges @ale_sp_brazil]

Tracking Malware Campaigns Using String Metrics:

https://t.co/TtCJ1q60mG

#malware