Marius

[Joe Security @joe4security]

Really nice paper on defeating evasive malware - huge kudos to the authors 👏🔥

In a nutshell:

They use AI-generated instruction-skip YARA rules to automatically bypass evasions inside CAPE and expose hidden malware behavior 🤯

Also interesting: Joe Sandbox came out as the clear leader for malware family detection compared to the other sandbox platforms in their evaluation 🏆🦠

Great to see academic research using Joe Sandbox as a strong benchmark 💪

https://t.co/xCjhMMtJsI

[Joe Security @joe4security]

🧵 From a "harmless" DLL to a fully reconstructed multi-stage #CobaltStrike Beacon.

In our latest blog, we break down how we:
🔍 Uncovered a hidden multi-stage loader chain
🧠 Bypassed anti-sandbox domain checks
🛠️ Rebuilt dumped memory into runnable PE files
🌐 Reconstructed C2 comms & crypto
🎯 Extracted IOCs and linked the implant to known infrastructure

A deep dive into loader reconstruction, memory forensics, protocol analysis, and attribution.

Read it here: https://t.co/4PlAL20CK3 #MalwareAnalysis #ThreatIntel #DFIR #ReverseEngineering #InfoSec

[Joe Security @joe4security]

HWmonitor supply chain attack 🚨 (kudos to @OfficialPCMR 🙌) confirmed by Joe Reverser 🔍💻

https://t.co/OliZuw3WHr

Stay cautious when downloading updates ⚠️📦 and always verify sources 🔐✅

[Joe Security @joe4security]

Here is #VoidLink (kudos to @_CPResearch_ for the find) fully dissected by Joe Reverser:

Stage 0: https://t.co/xtpZ9pmzKy
Stage 1: https://t.co/MJvGaebd2R
Rootkit: https://t.co/0i5Xib5MFf

[Joe Security @joe4security]

🚨 New campaign: #Rhadamanthys #infostealer is being delivered by an in-browser fake Windows Update, abusing the Fullscreen API (on-click), and using #ClickFix-style lures to trick users:

https://t.co/cUYTHJUDQo

[Joe Security @joe4security]

🚀 Introducing what is likely the first MCP (Model Context Protocol) server to feature dynamic and static malware analysis!

🔍 Explore it here: https://t.co/yowcuOX9E1
🧠 Powered by Joe Sandbox

#CyberSecurity #MalwareAnalysis #AI #ModelContextProtocol #DFIR #ThreatIntel

[Joe Security @joe4security]

Great Joe Sandbox catch of #Quishing (QR Code #Phishing)! Submit various file formats like PNG, JPEG, GIF, PDF, EML, MSG, and more. Live Interaction extracts the URL and opens it in Chrome automatically.
https://t.co/rQZPMiUWXb

[Joe Security @joe4security]

#Emotet is back, this time big and fat!!! Check-out the file size of this Office doc and Dll!

https://t.co/HKXDcT3oax

[Joe Security @joe4security]

Level UP! With Joe Sandbox, you can now perform deep malware analysis on an Win10 Analyzer connected to a real DC (Server 2019, no crappy EMU)! Checkout the blog post for all the use-cases and info:

https://t.co/iJq0jz2a4F

#malware #sigma #dfir #infosec

[Joe Security @joe4security]

#CVE-2021-40444 (MS / IE Office ZeroDay, MSHTML, 4c80dc9fb7483214b1613957aae57e2a) -> hxxp[:]//hidusi[.]com/e8c76295a5f9acb7/ministry.cab -> #CobaltStrike: https://t.co/r9GOZNEj84 #malware #CVE #ZeroDay

[Joe Security @joe4security]

Here is one of the first #XLoader / #Formbook #malware (kudos to @_CPResearch_) containing #macOS support: https://t.co/biABFDVTRf

#Dfir #infosec #security

[Joe Security @joe4security]

#GuLoader (dropping #formbook, #nanocore, #remcos, #agenttesla etc.) has updated its hammering loop from 11M to 268M instructions and added a new time source! If you want to bypass #sandboxes it is definitely the loader of choice! https://t.co/FTHFsMTNQf https://t.co/UNmDQzJiKy

[Joe Security @joe4security]

Thanks to automated .NET decompliation Joe Sandbox detects the #SUNBURST backdoor in OrionImprovementBusinessLayer C# code! .NET decompliation is also applied to unpacked binaries: https://t.co/Huwf0NXRKo #malware #dfir #infosec

[Joe Security @joe4security]

[Feature] We have successfully added memory dumping capabilities to Joe Sandbox - #macOS dynamic analysis! This enables customer Yara rules for unpacked code! https://t.co/uqRcdhJVk8
#malware #dfir #infosec

[Joe Security @joe4security]

Recent #TrickBot is using some nice API hammering to evade #sandbox! Read more about how API hammering works in our latest blog post: https://t.co/zeNIhsSPF4
#malware #dfir #infosec #evasive

[Joe Security @joe4security]

Fully automated Joe Sandbox X analysis of #EvilQuest #ransomware on Mac bare metal! Kudos to @objective_see for the cool blog post!
https://t.co/s26bJcashJ #malware #DFIR #macOS

[Joe Security @joe4security]

#COVID19 is not only infecting your body but also your computer's #MBR 😈😈😈 - at least this #virus (ref https://t.co/pCB8Kol9Me). Guess what the "Remove virus" button is just fake 😂

https://t.co/TBa10Qh4vk

#malware #dfir #infosec

[Alain Berset @alain_berset]

Ensemble et solidaires. Et vous, que faites-vous? Racontez-le avec le hashtag #voicicommentnousprotéger et lancez le défi à trois autres personnes. Je défie @christarigozzi, @stressmusic et @rogerfederer. Et n’oubliez pas: restez le plus possible à la maison!

[John Lambert @JohnLaTwC]

Interested in LOLBins? Here is an example maldoc using cmstp.exe (Connection Manager)
🔗https://t.co/lvRAvCSHVv
🔬https://t.co/h1apbU0f3e
🎁@joe4security https://t.co/OniB7yZxK9

See the excellent research by @oddvarmoe
🧠https://t.co/FwG5Acp6UF
😆🗃️https://t.co/Y6RWUKNuZA

[Joe Security @joe4security]

You don't have a Malware Analysis Lab, but want one? Check-out Joe Lab - the Industry's first Cloud based Malware Analysis Lab built for CERTs, CIRTs, SOCs and malware analysts: https://t.co/TZnASj2M1D #dfir #infosec #LAB