Jeremy Hedges

"Final boss of Threat Research"

[Jeremy Hedges @dcTavvy]

@Myrtus0x0 Assembly Thrunter

[Jeremy Hedges @dcTavvy]

@V4ltzz @naumovax @Bitdefender They do it by connecting using raw sockets (historically NTSockets) which establishes the connection first, then you can forge whatever you want because you don't rely on DNS. We blogged about the netcomm portion in

https://t.co/OnHa8aOlyF

[Jeremy Hedges @dcTavvy]

@ipurple Not sure what is so novel about this, diagram suggests timers in a remote process... Readme claims it doesn't use common injection APIs like CreateRemoteThread, but then the PoC proceeds to use CreateRemoteThread. This seems to just buy a slightly cleaner call stack?

[YungBinary @YungBinary]

Updated #Lumma stealer C2 extractor! See https://t.co/4aQECC62RO

[Jeremy Hedges @dcTavvy]

@Myrtus0x0 Smells like TransferLoader

[Jeremy Hedges @dcTavvy]

@banthisguy9349 @solostalking @proofpoint @sysopfb 2/2 as for finding samples, it was interesting mostly due to detection of HTTP requests without any network APIs in dynamic analysis (inspired by NTSockets)

While the IoCs shared that you are referencing are no doubt helpful, it was not used in the creation of the blog afaik.

[Jeremy Hedges @dcTavvy]

@banthisguy9349 @solostalking @proofpoint 1/2 Relative to OSINT, the samples I reversed were found in our data; we acknowledged the work done by @sysopfb as the shellcode correlation was something I was previously unaware of, which ironically was very likely the same campaign he blogged about.

[Jeremy Hedges @dcTavvy]

@greglesnewich @pivot_con

[Jeremy Hedges @dcTavvy]

@naumovax Ahh I see, the hash from the Triage links is different than the one from the initial tweet.

From your Triage, I see this as
QuasarRAT v1.5.1
C2 configured to
ilovecatgirlsowo-29235.portmap[.]io:29235;

[Jeremy Hedges @dcTavvy]

@naumovax But yeah for your other port (29235), seems it dropped some additional stealer; Did not get the same behavior in my analysis unfortunately. If you have the sample that did this specific netcomm feel free to DM me the hash/sample and I'd love to look!

[Jeremy Hedges @dcTavvy]

@naumovax Looks like Quasar RAT to me (Version: 1.4.1). In our sandbox I see the certificate it decodes for C2 which has default Quasar strings (image from process dump):

[Jeremy Hedges @dcTavvy]

Maybe there be slightly less malware hosted on Discord.

[Discord Previews @DiscordPreviews]

Discord is lowering the free upload limit back to 10MB, citing operational and financial concerns. The previous free upload limit was 25MB.

[Jeremy Hedges @dcTavvy]

@Myrtus0x0 Maybe you should try growing an LLM 🤔

[Jeremy Hedges @dcTavvy]

@greglesnewich @spiderspiders_

[Jeremy Hedges @dcTavvy]

@vxunderground POV: walking from hotel to any defcon village

[Jeremy Hedges @dcTavvy]

@RussianPanda9xx "Normal Windows telemetry"

[vx-underground @vxunderground]

Tavis Ormandy is the Silver Back Gorilla of nerds.

Seeing Tavis throw his hat into the ring on this is like watching Mike Tyson in his prime.

[Jeremy Hedges @dcTavvy]

@realcyberpanda A safe, natural way to dispose of old decomposing fiber cables in the ocean.

[Jeremy Hedges @dcTavvy]

@sherrod_im @redteamwrangler Lemme know when you decide to run Windows as your primary OS and turn it on :p

[Jeremy Hedges @dcTavvy]

@sherrod_im