Amy

Security Researcher

[Tim Blazytko @mr_phrazer]

The slides of our @reconmtl talk on the next generation of virtualization-based obfuscators are now available. @m_u00d8 & I show how to break current VMs and why these attacks will no longer work. We also discuss the next steps in deobfuscation research.

https://t.co/mFUp1Xz8Y0

[adam_cyber @Adam_Cyber]

@CrowdStrike Intelligence published a blog and code to decrypt files that may have been encrypted by ransomware called #partyticket in #ukraine

https://t.co/2kvu1QEWGb

[Pinaki ❄️ @0xInfection]

Just published the first blog of a many part series on WMI. The writeup is a pretty small one but hopefully enough to get started with the main series. So here you go. :)

"Offensive WMI: The Basics (Part 1)"

https://t.co/Cjjvw4iLvb

[hasherezade @hasherezade]

I wanted to play with this technique, and there was no PoC provided, so I made my own. If anyone needs, it is here: https://t.co/rFTVizAjpz // #ProcessGhosting

[Josh @passthehashbrwn]

New blog is up. Walks through bypassing the syscall detections that I wrote by finding a clean syscall instruction within NTDLL and patching a jmp to it. No more suspicious syscall instructions floating around in your code or memory.

https://t.co/Bb8imxO1P6

[Rolf Rolles @RolfRolles]

Short new blog entry: Hex-Rays, GetProcAddress, and Malware Analysis https://t.co/QjjQwqTshz

[Alfie Champion @ajpc500]

FWIW I’d imagine the FireEye DARKSIDE blog is the first time many defenders have heard of F-Secure’s C3. I thought it might be useful to resurface some material we’ve put out for detection opportunities/limitations (1/7)

[Jean @Jean_Maes_1994]

[BLOG]
some quick ramblings on code signing and binary attributes and their opsec implications if you have to drop to disk:
https://t.co/uUq9GKf9al

[Can Bölük @_can1357]

It's been a while since I wrote anything so I wrote an article on how to discover the entire x86-64 instruction set in seconds including any hidden instructions and learn their basic properties while on it. There were some pretty interesting results!

https://t.co/t7vMwYDYas

[Costin Raiu @craiu]

Interesting story, curious to see some IOCs and how it develops: https://t.co/3qzdFJ77tW

[hasherezade @hasherezade]

I started creating a free #MalwareAnalysis training: https://t.co/Glofblatut - what do you think?

[Amy @effilnuc_]

Very close battle in the end! Thanks for running it @xme, great week.

[Xavier Mertens @[email protected] 🇧🇪 @xme]

The best day... #FOR610 challenge running at full speed!

[Check Point Research @_CPResearch_]

A #WindowsSandbox deep dive.
Even though it mixes the widely documented #HyperV/#WindowsContainers technologies, we still lack the internals of its great features - dynamic base image, file linking and more.
Kudos @_alex_il_ for the great analysis. https://t.co/j1lObhb8fE

[TrendAI Zero Day Initiative @thezdi]

When reversing, do you use black box or white box techniques? Does it matter? @trendytofu looks at 2 different #NETGEAR bugs from different researchers using different approaches that ended up with similar results. https://t.co/5HP2rdlZA7

[Ramin Nafisi @MalwareRE]

Thread on #NOBELIUM's new malware families: #GoldMax (aka #SUNSHUTTLE), #GoldFinder, and #Sibot 👇

[Volexity @Volexity]

Volexity has identified multiple 0-day exploits in Microsoft Exchange resulting in authentication bypass and RCE. Actively exploited in the wild since at least January 2021. More here: https://t.co/nnCkaYRPRm
#threatintel #dfir #infosec

[Carsten @0xcsandker]

Just published Part 2 of my series:
Offensive Windows IPC Internals 2: RPC

Enjoy ❤️
https://t.co/QJSTNoPHwv

[Anton Cherepanov @cherepanov74]

Quite detailed analysis of Exaramel Linux backdoor and its versions deployed by Sandworm on Centreon servers: https://t.co/cglHYeS2Uj Thanks to @ANSSI_FR for publishing

[Adepts of 0xCC @AdeptsOf0xCC]

Today we’ll bring you another approach to play with MiniDump buffer before it touches disk by @Mari0Bartolome

Hooks On Hoot Off - Vitaminizing Minidump https://t.co/nIZu68oGvT

[Russ McRee @holisticinfosec]

Given Cobalt Strike’s prevalence as a “malware” platform, including the SolarWinds supply chain attack, this blog post summarizes what an analyst needs to know about Cobalt Strike to quickly identify and analyze it during incidents. #DFIR #BlueTeam #SOC https://t.co/GBSR4SHKdS