#ImpHash - Twitter Hashtag

TomU | I'm still here... til the end 🕊️🇨🇭 @c_APT_ure

almost 5 years ago

@cyb3rops Thanks for sharing Florian @cyb3rops ! I wonder how many different IMPHASH there are? Just a few I found, probably not all (?) 14df4ec2932bcbb17c51721c56e43033 625d2e0c628a5146a7af834cb2160e49 d6612a3ed6fd33f95566d0cb5aae2cc7 e81cf925a4e52f22cc02bab8bc791b06 #imphash FTW!

1

4

2

0

Karsten Hahn @struppigel

over 5 years ago

New video: Imphash algorithm explained 🦔📹 #imphash #malwareanalysisforhedgehogs #importhash https://t.co/ixoOPSSjAR

4

68

25

7

0

Vicky Ray @0xVK

almost 6 years ago

Unique #imphash's of #Egregor #ransomware a425f4f6fe723a4ffe990e4611c62d08 7d85185561d1fe0b67a78d80ad1ac7db c54f8add3e398b478d6f2795fe9f1a7b c955f5ac65944c0d05fbfe8f8ef6e025 22f4473d904fbfcf76a4ce20e80cb077 5277523afccb7808dd56ef0684189949 34c86eba4788b3233103da88957a3a02

1

4

0

Karsten Hahn @struppigel

about 6 years ago

#TypeRefHash is an alternative to #ImpHash but for .NET TypeRef Table. Reason: ImpHash doesn't work well for .NET files. My colleagues @pkemkes and @_secana_ have written a tool and a blog post. 🔗📑https://t.co/ii81BQ600T https://t.co/71XLh2IDvg

0

14

3

0

Shahar Madar

@Sh4har

about 6 years ago

(3/3) Some extra resources on #imphash: 1. @cyb3rops' mass imphash generator - https://t.co/4RpOY27tpJ 2. @malcomvetter's how to defeat imphash https://t.co/JQ9HII8W38 3. Breaking imphash - https://t.co/ByGhi1LvSe

1

4

0

1

0

Shahar Madar

@Sh4har

about 6 years ago

(2/3) #1 #imphash is a hash (MD5) of all the imports of a PE. But did you know that @Mandiant invented it 6.5 years ago? They even submitted a PR to @erocarrera's pefile back in 2014. https://t.co/Rnw58trJMZ 1 week later(!) @zenitrame adds it to VT https://t.co/egMjdd0U3z

Sh4har's tweet photo. (2/3)
#1 #imphash is a hash (MD5) of all the imports of a PE. But did you know that @Mandiant invented it 6.5 years ago? They even submitted a PR to @erocarrera's pefile back in 2014. https://t.co/Rnw58trJMZ

1 week later(!) @zenitrame adds it to VT https://t.co/egMjdd0U3z https://t.co/iSMJaPT69T

2

0

TomU | I'm still here... til the end 🕊️🇨🇭 @c_APT_ure

over 6 years ago

#infosec #REM quiz of the day 😜 Why do these #Malware families have the same #IMPHASH as tons of legit software? (Packer?) f34d5f2d4577ed6d9ceec516c1f5a744 https://t.co/TjRX3lcpjk afcdf79be1557326c854b6e20cb900a7 https://t.co/JEHa6nbxCp

c_APT_ure's tweet photo. #infosec #REM quiz of the day 😜

Why do these #Malware families have the same #IMPHASH as tons of legit software?
(Packer?)

f34d5f2d4577ed6d9ceec516c1f5a744
https://t.co/TjRX3lcpjk

afcdf79be1557326c854b6e20cb900a7
https://t.co/JEHa6nbxCp https://t.co/SnNuUwV4FO

1

4

2

0

TomU | I'm still here... til the end 🕊️🇨🇭 @c_APT_ure

over 6 years ago

@cyb3rops @SwiftOnSecurity I always had Imphash enabled in Sysmon config and mentioned it in a talk 3 years ago. #Imphash FTW! https://t.co/dVgF34EfzE