Top Tweets for #Obfuscated

about 1 month ago

#Python Code should not contain #obfuscated content, particularly code that uses base64 (and related encodings) for encoding or decoding data is always suspected. So check your code, use: https://t.co/vSLq9Q5MbG #appsec #pydata #infosec #pycon #mythos #secawards

JC Mckinley @JCMckinleyauth

8 months ago

#vss365 Wandering Rome late at night Quiet, alone Fallen marble columns & founts Under aqueduct & arena Reflect golden moonbeams In the shadows Emperors of old walk the ruins w/ me Their faces #obfuscated in architecture Engineers designed the empire to last Greed made it fall

124

Carmen Baca @carmen_author

8 months ago

#vss365 Stumbling, falling, crawling to get away. Whatever predator made me his prey hunted me through dark, empty halls. I hid, #obfuscated by his goal, his gall. Ready to fight, waited for him to arrive. I vowed only one of us would survive. #horror #horrorlovers

carmen_author's tweet photo. #vss365
Stumbling, falling, crawling to get away.
Whatever predator made me his prey
hunted me through dark, empty halls.
I hid, #obfuscated by his goal, his gall.
Ready to fight, waited for him to arrive.
I vowed only one of us would survive.
#horror #horrorlovers https://t.co/23xeLNdqMb

112

Peter James Martin @Brennan_and_Riz

8 months ago

"So, the fortune teller tried to tell me my future would become #obfuscated, unless I paid her money," I explained to Valarie. "Ohh, what did you do?" "I told her she was 25 years late with that news as I already met Riz." "Oi!" Riz yelled out. #vss365 #riztherogue

196

Author Lali A. Love ™️ 🌈

@laliaristo

8 months ago

#Obfuscated stars, veins bloom toward honeyed heat; union breathes us whole. #vss365

203

Eric Lahti @ericlahti1

8 months ago

Obscured. Occulted. #Obfuscated. #vss365

Eric Lahti @ericlahti1

8 months ago

"It's obsuf... obscufa.." "#Obfuscated?" "Yeah, that one." "Gotta love it. Even the word itself is obfuscated." #vss365

Stevie G @Word_Massager

8 months ago

The spotlight cuts through the dim into it the salesman swaggers in Another slick pitch to #obfuscated pigeons Not easy selling when no one is buying Dinosaurs had no clue they were dying So it goes for the salesman once great Extinction will be his inevitable fate #vss365

Word_Massager's tweet photo. The spotlight cuts through the dim
into it the salesman swaggers in

Another slick pitch
to #obfuscated pigeons

Not easy selling
when no one is buying

Dinosaurs had no clue they were dying

So it goes for the salesman once great

Extinction will be his inevitable fate

#vss365 https://t.co/X8Wr49kcB6

Matt @InPoetsShoes

8 months ago

All the letters on the floor Mixed up and hide who we really are I tried to begin again But found myself lost within this cell We only had our days But how they bled into the same These streets they had no name So #obfuscated from the world #vss365 #obfuscate

InPoetsShoes's tweet photo. All the letters on the floor
Mixed up and hide who we really are

I tried to begin again
But found myself lost within this cell

We only had our days
But how they bled into the same

These streets they had no name
So #obfuscated from the world

#vss365 #obfuscate https://t.co/Z1TFXDIdf2

277

Poetry by PS ☘️

@PoetryByPS

8 months ago

- you played that same etude each night before bed; it made my head split in two, each note stabbed my eyes, you’d summoned pain into the inner sanctum of our room, an #obfuscated mood, atonal to slumber, a cracked chord pressed flat by the pall that lay upon me. - #vss365

PoetryByPS's tweet photo. -
you played that same etude
each night before bed;

it made my head split in two,
each note stabbed my eyes,

you’d summoned pain
into the inner sanctum of our room,

an #obfuscated mood,
atonal to slumber,

a cracked chord pressed flat
by the pall that lay upon me.
-

#vss365 https://t.co/wqbvzWCrsx

436

blinkz

@BlinkzSec

11 months ago

#opendir #obfuscated bat files

ANY.RUN

@anyrun_app

over 1 year ago

🚨 #Obfuscated BAT file used to deliver NetSupport RAT At the time of the analysis, the sample had not yet been submitted to #VirusTotal ⚠️ 👨‍💻 See sandbox session: https://t.co/HCxbqoCgiV 🔗 Execution chain: cmd.exe (BAT) ➡️ #PowerShell ➡️ PowerShell ➡️ #client32.exe (NetSupport client) ➡️ reg.exe Key details: 🔹 Uses a 'client32' process to run #NetSupport #RAT and add it to autorun in registry via reg.exe 🔹 Creates an 'Options' folder in %APPDATA % if missing 🔹 NetSupport client downloads a task .zip file, extracts, and runs it from %APPDATA%\Application .zip 🔹 Deletes ZIP files after execution ❗️ BAT droppers remain a common choice in attacks as threat actors continue to find new methods to evade detection. Use #ANYRUN’s Interactive Sandbox to quickly trace the full execution chain and uncover #malware behavior for fast and informed response. #ExploreWithANYRUN

$anyrun_app's tweet photo. 🚨 #Obfuscated BAT file used to deliver NetSupport RAT At the time of the analysis, the sample had not yet been submitted to #VirusTotal ⚠️ 👨‍💻 See sandbox session: https://t.co/HCxbqoCgiV 🔗 Execution chain: cmd.exe (BAT) ➡️ #PowerShell ➡️ PowerShell ➡️ #client32.exe (NetSupport client) ➡️ reg.exe Key details: 🔹 Uses a 'client32' process to run #NetSupport #RAT and add it to autorun in registry via reg.exe 🔹 Creates an 'Options' folder in %APPDATA % if missing 🔹 NetSupport client downloads a task .zip file, extracts, and runs it from %APPDATA%\Application .zip 🔹 Deletes ZIP files after execution ❗️ BAT droppers remain a common choice in attacks as threat actors continue to find new methods to evade detection. Use #ANYRUN’s Interactive Sandbox to quickly trace the full execution chain and uncover #malware behavior for fast and informed response. #ExploreWithANYRUN$

Shanholo @ShanHolo

over 1 year ago

Interesting and fun #Payload shared by @skocherhan 👏👏 Long story short: #Obfuscated PowerShell ➡️#Stenography with MZ header and the final file dropped ➡️#Katz_Stealer_Loader It's turned out a great learning path!!

Shanholo @ShanHolo

over 1 year ago

@skocherhan Thx for tagging me! Interesting obfuscated payload ⤵️ User-Agent','Mozilla/5.0' C:\Users\Public\Downloads','antipoles','vbs', hxxp://107.175.246.45/xampp/vc/new_image.jpg hxxp://216.9.225.219/xampp/kbn/nicho-given-mbestsmptexperience.txt

$ShanHolo's tweet photo. @skocherhan Thx for tagging me! Interesting obfuscated payload ⤵️ User-Agent','Mozilla/5.0' C:\Users\Public\Downloads','antipoles','vbs', hxxp://107.175.246.45/xampp/vc/new_image.jpg hxxp://216.9.225.219/xampp/kbn/nicho-given-mbestsmptexperience.txt https://t.co/VDw3pcWSXd$

812

464

New Submissions to TMLR @TmlrSub

over 1 year ago

Privacy-Preserving Language Model Inference with Instance Obfuscation https://t.co/Fjr5N8xi5j #privacy #obfuscated #plaintext

251

VMRay

@vmray

over 1 year ago

🚨 #Alert: Heavily #obfuscated #batch file loads #XWorm hosted on #github 🔗 https://t.co/qwQhNR8tSQ 🔍VMRay Labs found a multi-stage obfuscated batch script with low detections on VirusTotal which downloads and executes XWorm from GitHub. The sample uses a UTF-16 Byte Order Marker and an open-source Batch obfuscator to hinder manual analysis. 🧵(1/4)

vmray's tweet photo. 🚨 #Alert: Heavily #obfuscated #batch file loads #XWorm hosted on #github

🔗 https://t.co/qwQhNR8tSQ

🔍VMRay Labs found a multi-stage obfuscated batch script with low detections on VirusTotal which downloads and executes XWorm from GitHub. The sample uses a UTF-16 Byte Order Marker and an open-source Batch obfuscator to hinder manual analysis.

🧵(1/4)

Fox_threatintel @banthisguy9349

almost 2 years ago

#obfuscated #elf found that by the looks of it is a variant of #mirai malware urls: hxxp://185.196.10.215:12234/mips.bin hxxp://185.196.10.215:12234/x86_64.bin They really tried to hide on port 12234 with .bin file extension 🤣 cc: @tolisec @500mk500 @abuse_ch

banthisguy9349's tweet photo. #obfuscated #elf found that by the looks of it is a variant of #mirai

malware urls:
hxxp://185.196.10.215:12234/mips.bin
hxxp://185.196.10.215:12234/x86_64.bin

They really tried to hide on port 12234 with .bin file extension 🤣

cc: @tolisec @500mk500 @abuse_ch https://t.co/t92C3Hy9Uc

Fox_threatintel @banthisguy9349

almost 2 years ago

hxxp://188.166.177.132/obfus.txt #obfuscated #fake #wordpress script?

ANY.RUN

@anyrun_app

about 2 years ago

⚠️ We've observed an extensive campaign spreading the #StrelaStealer at the moment – #ExploreWithANYRUN 🕵 An #obfuscated batch file starts the execution of a PowerShell script, which then initiates the net and rundll32 processes. The stealer uses net.exe to mount a C2 server containing a 'davwwwroot' folder and then collects a 64-bit DLL file from it by using #WebDAV. There were approximately one thousand DLL files with Strela stealer on hxxp://45.9.74[.]32:8888. 🔗 Execution chain of #Strela #stealer: #CMD ➡️ #PowerShell ➡️ receive C2 #payload via WebDAV ➡️ #Rundll32 🚫 Malware #exploits #WordPad during execution. The C2 server for Strela is on the same host as the payload 📌 Sample: https://t.co/OIPnb8KFvW 🔐 The BAT file can be easily #deobfuscated. The script itself consists of symbols that lie in separate variables. To assemble commands, you just need to change those variables back to the symbols assigned to them. Our team has shared this script on our public repository: https://t.co/dv1rxcYxuk 🔎 Find samples of this malware in #TI Lookup with this request: https://t.co/cf1rCZRKyG

anyrun_app's tweet photo. ⚠️ We've observed an extensive campaign spreading the #StrelaStealer at the moment – #ExploreWithANYRUN

🕵 An #obfuscated batch file starts the execution of a PowerShell script, which then initiates the net and rundll32 processes.
The stealer uses net.exe to mount a C2 server containing a 'davwwwroot' folder and then collects a 64-bit DLL file from it by using #WebDAV. There were approximately one thousand DLL files with Strela stealer on hxxp://45.9.74[.]32:8888.

🔗 Execution chain of #Strela #stealer:

#CMD ➡️ #PowerShell ➡️ receive C2 #payload via WebDAV ➡️ #Rundll32

🚫 Malware #exploits #WordPad during execution. The C2 server for Strela is on the same host as the payload

📌 Sample:

https://t.co/OIPnb8KFvW

🔐 The BAT file can be easily #deobfuscated. The script itself consists of symbols that lie in separate variables. To assemble commands, you just need to change those variables back to the symbols assigned to them.
Our team has shared this script on our public repository:

https://t.co/dv1rxcYxuk

🔎 Find samples of this malware in #TI Lookup with this request:

https://t.co/cf1rCZRKyG

Matthew

@embee_research

almost 3 years ago

[17/] Comments, Structures and Hashing After redefining the values shown above. The previously #obfuscated shellcode will be much easier easy to read and analyse.

496

Szabolcs Schmidt

@smica83

almost 3 years ago

An #obfuscated JS with low detection rate (0/0 on VT): https://t.co/aPpzKivd7x URL(https): /seviespil(.)com/sev/admin/js/ms.php There's some strange /admin panel too... @James_inthe_box

Top Tweets for #Obfuscated

Last Seen Hashtags on Sotwe

Trends for you

Most Popular Users