csgaee

Malware researcher @EG_CERT | threat intelligence @nowhere_reallll

[csgaee @csgaee]

analysis of #parallax Loader, in this blogpost I've tried to dissect implemented techniques that make it very obfuscated malware 📈

https://t.co/Ugp5gNuvzs

#malware #reverseengineering

[R136a1 @TheEnergyStory]

Have you noticed that those deep-dive stories about complex Windows malware have pretty much vanished, especially in recent years? It feels like the era of "blockbuster" Windows malware has just gone silent, and this blog post tries to give some answers why.

https://t.co/sFsf3uPm5o

[Back Engineering Labs @BackEngineerLab]

Given the recent events with VMPSoft DMCA'ing educational YouTube videos demonstrating how to unpack malware protected with VMProtect, we have decided to release a free to use unpacker which works for all versions of VMP 3.x including the most recent version.

Simply sign up/login here: https://t.co/7xp43sCIwv and then click on "Unpacker" on the top right corner.

For context:
https://t.co/8z6V6232YN https://t.co/kHm3O764FL https://t.co/T9EyF53FEV

[Gynvael Coldwind @gynvael]

Paged Out! #6 is out!
https://t.co/8GiM1IwmHD
Totally free, 80 pages, best issue so far!
'nuff said, enjoy!

(please RT to help spread out the news!)

[csgaee @csgaee]

@c3rb3ru5d3d53c Any updates regarding that blog !?

[Thomas Roccia 🤘 @fr0gger_]

🤓 I was reading the fascinating report from @Volexity about the Nearest Neighbor Attack presented at @CyberWarCon.

To keep it documented, I created a quick overview to explain how works the attack to complement their blog post 👇 #threatintel #infosec

[Tijme Gommers @tijme]

My @OrangeCon_nl talk is live!

Elevate your knowledge: From COM Object Fundamentals To UAC Bypasses.

A 25-minute crash course covering Tokens, Privileges, UAC, COM, and ultimately bypassing UAC!

https://t.co/H1VZJdBzTZ

[Takahiro Haruyama @cci_forensics]

themida-unmutate - Static deobfuscator for Themida/WinLicense/Code Virtualizer's mutation-based obfuscation https://t.co/LVSesdU47J

[Andreas Sfakianakis / @[email protected] @asfakian]

FIRST CTI 2023 Video Recordings Playlist:
https://t.co/WDX0P7C0Hq via @YouTube . Enjoy!
#threatintel #cti #FOR578 #FIRSTCTI23 #FIRSTCTI

[Daniel López @0xDanielLopez]

🎉 #TweetFeed is back! 🎉

After some months, I could bring it back to life again!

Easily grab IOCs shared by the #infosec community at 𝕏 / Twitter:

• URLs
• Domains
• IPs
• SHA256 hashes
• MD5 hashes

All served in a FREE feed or via API.

➡️ https://t.co/ozGQxBtRwS

[csgaee @csgaee]

@fr0gger_ Happy to help
Just evade this by checking if quotes are present conv it to hex and add the real str as a comment for readability ... I feel that is a lazy solution 😂 but I always go the easy way

[csgaee @csgaee]

@0xJunkCod3 @stvemillertime 1+

[yed @frdfzi]

Remote Monitoring and Management (RMM) tools commonly abuse by Threat actors.

RMM_LOLBAS:
https://t.co/oc7etgaQ5b

[csgaee @csgaee]

@MichalKoczwara Would be great

[csgaee @csgaee]

@xbatmanTheReal @alien0x_ Corellium

[csgaee @csgaee]

@jxy__s @SystemInformer What about a button that holds info about terminated processes ... And shortcut to collapse child parent relationship

[Joe Słowik 🌻 @jfslowik]

#CTI #ThreatIntelligence #Infosec

[csgaee @csgaee]

@cyber_anubis low P & low R -> We don't care about hygiene standards 😂
high P & high R -> We care about hygiene to the end, and we do nothing other than that😂

[csgaee @csgaee]

@cyber_anubis let's call those param "P" & "R"
high P & low R -> My org needs to hunt this specific cluster as part of intel collection
low P & high R -> suppress coverage regarding X, Y, and Z variants of the family ... our analytics solution needs quantity coverage