Top Tweets for #Koadic
How to disable #Microsoft #Security Essentials and #Windows #Defender and its components, tasks, services, systray icon, context menu, logging and set exclusion paths.
Techniques used by #koctopus loader.
https://t.co/Zl6zSxpEZJ
#malware #Koadic #LazyScripter
remember when #koadic artifacts just kinda hung out in inetcache?
well... it doesn't anymore.
not really an evasion technique, more of a housecleaning item. but hey, if you clean a mess you made before mom gets home, did the mess really exist?
lemme know how it works out.
🛠 OST-ception 🙃
A #CobaltStrike loader that attempts to "blend in" by looking like *checks notes* ..... #Koadic 🥴:
https://t.co/zzGD7Vob6y
- Append "mshtml,RunHTMLApplication" to URI
- Fake TLS Host: googlechromeupdater.twilightparadox.\com
- Real C2: 91.241.19.10
#Malware
I observed this actor's attack in February. Then he dropped various RATs using #Koadic
https://t.co/uplUMp6P09
#Koadic
https://t.co/fTH9PLNXel
COVID-19 Themed Multistage Malware https://t.co/hk76BqU6Wt
Just got the confirmation, mandatory work from home is now in effect. If you have #Koadic ideas and suggestions for improvement, let me know! Should be able to work on it more the next few weeks 😁
![killamjr's tweet photo. #Malware using embedded object to launch payload
https://t.co/xUFumj7iYa
payload #koadic
hXXp://216.189.145.11/auto.cfg.bat
c2:
hXXp://googlechromeupdater.twilightparadox[.]com:448/html https://t.co/z25dEPlf3Q](https://pbs.twimg.com/media/ESYv4v4U8AAeplj.png)
@bit_dam @BitDamSecurity @malwrhunterteam @reecdeep @Cryptolaemus1 @ActorExpose @abuse_ch MALWARE [PTsecurity] JS.Obfuscation (Koadic) 37.72.175.188 #Koadic
1 https://t.co/6RsB3SmPMq
2 https://t.co/qsyvlGntSq
3 https://t.co/fym6wfzOAI
Hey @entynetproject, I've noticed that your Proton Framework has some... MARKED similarities to #Koadic. Especially in the commits where you did a bad job scrubbing your plagiarism.
Been a bit since I've posted #Koadic developments. Working on a 'createstager' command. Setting MODULE and then having to go to the module to set options is a bit tedious, so this shortcuts a bit. ONESHOTs and random endpoints by default, non-hidden options tab-completable.
Great blog by @DanielStepanic from his BSides DFW talk on the #Koadic post exploitation framework and leveraging @eventquerylang (#EQL) to build detections. Give it a read!
#Opensource attack frameworks and tools continue to be leveraged by criminal groups and nation state actors. Find new ways to build behavioral detections against post-exploitation frameworks such as #Koadic using Event Query Language (EQL) in this post → https://t.co/5iwHZ50fC1
Pushed out blog today on behavioral detections against #Koadic from recent presentation at @BSidesDFW. Shows off the power and flexibility of leveraging @eventquerylang in order to keep up with the latest attacker tradecraft
#Opensource attack frameworks and tools continue to be leveraged by criminal groups and nation state actors. Find new ways to build behavioral detections against post-exploitation frameworks such as #Koadic using Event Query Language (EQL) in this post → https://t.co/5iwHZ50fC1
#Opensource attack frameworks and tools continue to be leveraged by criminal groups and nation state actors. Find new ways to build behavioral detections against post-exploitation frameworks such as #Koadic using Event Query Language (EQL) in this post → https://t.co/5iwHZ50fC1
you can hunt for #Koadic comsvcs_lsass memdump module via sysmon 10 and trgt image eq "lsass.exe" and calltrace contains "comsvcs.dll" #detection
Think I'm going to create a python version of that powershell AES shellcode script. Would be great to have it compiled via pyinstaller in engagements (eg I just had to chain #TrevorC2, thanks @HackingDave, and #Koadic at a recent engagement using pyinstaller) Might go further.
Inspired by #Metasploit functionality, I've pushed using modules by their shortname (implant/gather/comsvcs_lsass -> comsvcs_lsass) to #Koadic. This also works for 'set MODULE' on stagers.
Last Seen Hashtags on Sotwe
momson() #xlii
Seen from France
hugecock
Seen from Turkey
wlw
Seen from Germany
Momson
Seen from Jordan
hijabtiktok
Seen from Turkey
monkeyappwinsFull
Seen from United States
teenager
Seen from United States
kiz fotoğraf
Seen from Turkey
หาคนช่วยเย็ดเมีย
Seen from Thailand
mannamspa
Seen from Vietnam
Most Popular Users
Elon Musk 
@elonmusk
241M followers
Barack Obama
@barackobama
119.2M followers
Cristiano Ronaldo
@cristiano
111.9M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.2M followers
KATY PERRY
@katyperry
88.4M followers
Taylor Swift
@taylorswift13
82.2M followers
Lady Gaga
@ladygaga
73.8M followers
Virat Kohli
@imvkohli
71M followers
Kim Kardashian
@kimkardashian
70.1M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64.3M followers
Neymar Jr
@neymarjr
63.9M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.8M followers
Selena Gomez
@selenagomez
61.4M followers
X
@x
60.8M followers