Kiran Raj

Security researcher @McAfee_Labs

[Kiran Raj @getHandleA]

creative usage of #forfiles by #ursnif #maldoc to execute #powershell w/o mentioning it.
cmd: start forfiles /p C:\Windows\System32\ /s /m po*l.e*e "" > hello.txt

final execution:
start 'powershell.exe "">hello.txt'

@Cryptolaemus1 @DissectMalware @Malwaredev @malware_traffic

[Kiran Raj @getHandleA]

22.2.22 22:22:22 IST

[McAfee Labs @McAfee_Labs]

In our recent blog, @getHandleA explores #Emotet’s Uncommon Approach of Masking IP Addresses.

Learn more ➤ https://t.co/yDzCEij4nU

[Kiran Raj @getHandleA]

Emotet (22-Jan-21) masks IP address in Hexadecimal and Octal formats.

https://t.co/XiBjjEc0dd

[Kiran Raj @getHandleA]

@BlrCityPolice @CPBlr @DcpComdCentre What is the duration of the contract?

[Kiran Raj @getHandleA]

@executemalware Technique used to drop file is interesting.

https://t.co/lV1TGombCu

[Kiran Raj @getHandleA]

'Selection.Copy' is a smart way to drop a file rather than 'FileSystemObject' in VBA.

%temp% is used to store the copied embedded object from doc.

#Hancitor #maldoc #cobaltstrike

[Kiran Raj @getHandleA]

'Selection.Copy' is a smart way to drop a file rather than 'FileSystemObject' in VBA.

%temp% is used to store the copied embedded object from doc.

#Hancitor #maldoc #cobaltstrike

[Kiran Raj @getHandleA]

@ankit_anubhav @DissectMalware Cybershef recipe for the same:
https://t.co/P3zi54SYFH

[Kiran Raj @getHandleA]

New #emotet urls can quickly be extracted from VBA using #cyberchef

@Cryptolaemus1 @executemalware @abuse_ch

[Kiran Raj @getHandleA]

New #emotet urls can quickly be extracted from VBA using #cyberchef

@Cryptolaemus1 @executemalware @abuse_ch

[McAfee Labs @McAfee_Labs]

McAfee Labs has observed a new online threat known as #Squirrelwaffle

Learn more about this emerging malware on our blog: https://t.co/SzW7UoqSkJ

[Hardik Shah @hardik05]

WinAFL Fuzzing Videos like, share and retweet:
1. Fuzzing a simple C program with WinAFL: https://t.co/GLS7O5zmbp
2. What is fuzzing function, how to check everything is working fine? : https://t.co/jCk0UpyweA

[Raj Samani @Raj_Samani]

Our latest @McAfee_ATR research does a deep dive into Babuk #ransomware - which "caused a lot of damage by operating with faulty ransomware" https://t.co/9vsSkltlai #malware #cybersecurity #infosec H/T @Glacius_ Noël Keijzer

[Microsoft Threat Intelligence @MsftSecIntel]

Attackers increasingly use HTML smuggling in phishing and other email campaigns to stealthily deliver threats, but Microsoft Defender Office 365’s detonation technology provides durable protection against this evasive delivery technique.

[Oz Gunal @oegunal]

Zloader With a New Infection Technique | McAfee Blogs #IAmMcAfee https://t.co/NKANESLtRU

[Inspired eLearning @InspiredeLearn]

Word and Excel documents are enlisted to disable Office macro warnings, so the Zloader banking malware can be downloaded onto systems without security tools flagging it. https://t.co/1yolTpsSZX

[Steve Hickey @SteveHMcAfee]

Zloader With a New Infection Technique | McAfee Blogs #IAmMcAfee https://t.co/l3EaOSk7yH

[Social-Engineer, LLC @SocEngineerInc]

New Zloader malware technique makes it harder to spot phishing emails
https://t.co/RWv5r4eCnn #phishing

[MRG Effitas @mrgeffitas]

Hackers are using a new trick to disable macro security warnings in malicious Office files containing the #ZLoader banking malware. 🛡

#antimalware #msofficesecurity https://t.co/HNpARMXOs7

[Diego Samuel @dsespitia]

Para los que tienen #Diario de @ElevenPaths en su #Outlook pueden detectar #Zloader la nueva amenaza que publico @McAfee_Labs donde usan los macros para desplegar #DLL Maliciosas

[Eyal Estrin ☁️ @eyalestrin]

Zloader With a New Infection Technique https://t.co/GZ3B4049Ev