Minhee Lee

#Malware

[Minhee Lee @darb0ng]

The ENGLISH version of the #TA505 profiling report has been updated!🔥

https://t.co/jyjDlaxcYs

#FSI #금융보안원 #APT #Intelligence

[Minhee Lee @darb0ng]

My team #Kimbabasaksaksak recently won 1st place at the Digital Forensics Challenge 2023.🏆

📍Here’s writeup -> https://t.co/OMUO3vnHQH

#Forensics #CTF #DFC

[Virus Bulletin @virusbtn]

AhnLab researchers analyse the Dalbit (Moonlight) threat actor's latest campaign in South Korea. https://t.co/qLBHX1D9Mz

[KingKimGim @KingKimGim1]

📌 Analysis of .NET Packers

Various #infostealers (#Nanocore #Remcos #AgentTesla #Formbook #Lokibot ..) are distributed packed by .NET packers.

👉 https://t.co/nS7GnuIdLb

#MajorCrypter #DarkTortilla #VariantCrypter #PureCrypter #GameLoader

[Minhee Lee @darb0ng]

#Masscan #Ransomware 🔒 Threat Analysis Report
(Operation MaRS) - FSI 2022 Cyber Intelligence Report
✔️ Store encryption(&decryption)-related information separately
✔️ Add ".masscan" to the file extension

👉 https://t.co/N1vIXME5v3

#FSI #Intelligence #MasscanRansomware

[Minhee Lee @darb0ng]

hope for his safe return 🙏 @VK_Intel

[U.S. Coast Guard Southeast @USCGSoutheast]

#SearchAndRescue @USCG crews are searching for 36-year-old Vitali Kremez, last seen wearing a black wetsuit and scuba tank while diving near #HollywoodBeach, Florida.

Anyone with information is asked to call Sector Miami at [phone].

[Minhee Lee @darb0ng]

HASH(MD5)
Type-F : 566c0616437be7bbd5ce6781981cf5e5
Type-R : ea6f19b477aef535dd52132e795b4b40
Type-G : 9760a6cbb9612ce56b7a2480ec999f7a

[Minhee Lee @darb0ng]

#MASSCAN #RANSOMWARE #MASSCANRANSOMWARE adds ".MASSCAN-{1 of "F", "R", "G"}-{first 8 characters of a GUID}" to the file extension.
There are slight differences between the three types(F, R, G).
Ransom note : "RECOVERY INFORMATION !!!"

[보안뉴스 @boannews]

국내 기업 20여곳 해킹 피해! FRP 오픈소스 도구로 웹 서버 장악 후 공격 https://t.co/SZir7NhU3z

[Minhee Lee @darb0ng]

@GroupIB Thanks for the good report! Do you have any plans to release it in English?

[lazarusholic @lazarusholic]

Do you know Lazarus? Find more details in https://t.co/6DewGBYZB6
#CTI, #OSINT, #Lazarus

[Minhee Lee @darb0ng]

@kienbigmummy Could you share the IDA python?

[Minhee Lee @darb0ng]

@kienbigmummy @h2jazi @0xGravity This is what I was looking for! Thanks!

[Minhee Lee @darb0ng]

@Deepesh349 I think this attack came from TA505. Their packing routines and recent similar attacks have used some tools TA505 used before.

[Minhee Lee @darb0ng]

#Symrise #Clop #Ransomware #TA505
Signed : Insite Software Inc.
(Signature Date : 2020-12-11)
MD5 : ed9b015082f1be50fcf08fecdb6f76d1
https://t.co/u4NEnZv3MY

[Minhee Lee @darb0ng]

@Deepesh349 As you can see in the last ransom note capture. Clop Ransomware writes a ransom note specifying the target company as "Dear ~". (ex. Software AG, NOVABIO, kmall) This could be one of the reasons. 😀

[Minhee Lee @darb0ng]

@ffforward @Supre31539665 @stoerchl @JAMESWT_MHT @malwrhunterteam @James_inthe_box @Kostastsale @Jan0fficial @tbarabosch There seems to be no element targeting Korea yet.

[Minhee Lee @darb0ng]

"Enable" Window Defender -> "Disable"

My mistake for the word💦

[Minhee Lee @darb0ng]

#TA505 #CLOP #ransomware 😈
✔️ Signed : Infoware Cloud Limited(this certificate first used in Oct 2019 by TA505)
✔️ MD5 : 4dfb145cec1456cf6cf145f32f01ceff

➕ Related Sample : 92d0ca02e6874926e5b5fe7cf7351d7b
- Same certificate with Clop
- Enable Window Defender

[Minhee Lee @darb0ng]

@rawtables Not sure of that.. 👻

[Minhee Lee @darb0ng]

#SNAKE #Ransomware
✔️ GetAddrInfo of "https://t.co/KUD9Zrt1fw"
✔️ block inbound and outbound traffic that does not meet the subsequent firewall rules
✔️ turn off Windows Firewall

MD5 : ed3c05bde9f0ea0f1321355b03ac42d0

#EKANS #HONDA