Top Tweets for #koadic
How to disable #Microsoft #Security Essentials and #Windows #Defender and its components, tasks, services, systray icon, context menu, logging and set exclusion paths.
Techniques used by #koctopus loader.
https://t.co/Zl6zSxpEZJ
#malware #Koadic #LazyScripter
remember when #koadic artifacts just kinda hung out in inetcache?
well... it doesn't anymore.
not really an evasion technique, more of a housecleaning item. but hey, if you clean a mess you made before mom gets home, did the mess really exist?
lemme know how it works out.
🛠 OST-ception 🙃
A #CobaltStrike loader that attempts to "blend in" by looking like *checks notes* ..... #Koadic 🥴:
https://t.co/zzGD7Vob6y
- Append "mshtml,RunHTMLApplication" to URI
- Fake TLS Host: googlechromeupdater.twilightparadox.\com
- Real C2: 91.241.19.10
#Malware
I observed this actor's attack in February. Then he dropped various RATs using #Koadic
https://t.co/uplUMp6P09
#Koadic
https://t.co/fTH9PLNXel
COVID-19 Themed Multistage Malware https://t.co/hk76BqU6Wt
Just got the confirmation, mandatory work from home is now in effect. If you have #Koadic ideas and suggestions for improvement, let me know! Should be able to work on it more the next few weeks 😁
![killamjr's tweet photo. #Malware using embedded object to launch payload
https://t.co/xUFumj7iYa
payload #koadic
hXXp://216.189.145.11/auto.cfg.bat
c2:
hXXp://googlechromeupdater.twilightparadox[.]com:448/html https://t.co/z25dEPlf3Q](https://pbs.twimg.com/media/ESYv4v4U8AAeplj.png)
@bit_dam @BitDamSecurity @malwrhunterteam @reecdeep @Cryptolaemus1 @ActorExpose @abuse_ch MALWARE [PTsecurity] JS.Obfuscation (Koadic) 37.72.175.188 #Koadic
1 https://t.co/6RsB3SmPMq
2 https://t.co/qsyvlGntSq
3 https://t.co/fym6wfzOAI
Hey @entynetproject, I've noticed that your Proton Framework has some... MARKED similarities to #Koadic. Especially in the commits where you did a bad job scrubbing your plagiarism.
Been a bit since I've posted #Koadic developments. Working on a 'createstager' command. Setting MODULE and then having to go to the module to set options is a bit tedious, so this shortcuts a bit. ONESHOTs and random endpoints by default, non-hidden options tab-completable.
Great blog by @DanielStepanic from his BSides DFW talk on the #Koadic post exploitation framework and leveraging @eventquerylang (#EQL) to build detections. Give it a read!
#Opensource attack frameworks and tools continue to be leveraged by criminal groups and nation state actors. Find new ways to build behavioral detections against post-exploitation frameworks such as #Koadic using Event Query Language (EQL) in this post → https://t.co/5iwHZ50fC1
Pushed out blog today on behavioral detections against #Koadic from recent presentation at @BSidesDFW. Shows off the power and flexibility of leveraging @eventquerylang in order to keep up with the latest attacker tradecraft
#Opensource attack frameworks and tools continue to be leveraged by criminal groups and nation state actors. Find new ways to build behavioral detections against post-exploitation frameworks such as #Koadic using Event Query Language (EQL) in this post → https://t.co/5iwHZ50fC1
#Opensource attack frameworks and tools continue to be leveraged by criminal groups and nation state actors. Find new ways to build behavioral detections against post-exploitation frameworks such as #Koadic using Event Query Language (EQL) in this post → https://t.co/5iwHZ50fC1
you can hunt for #Koadic comsvcs_lsass memdump module via sysmon 10 and trgt image eq "lsass.exe" and calltrace contains "comsvcs.dll" #detection
Think I'm going to create a python version of that powershell AES shellcode script. Would be great to have it compiled via pyinstaller in engagements (eg I just had to chain #TrevorC2, thanks @HackingDave, and #Koadic at a recent engagement using pyinstaller) Might go further.
Inspired by #Metasploit functionality, I've pushed using modules by their shortname (implant/gather/comsvcs_lsass -> comsvcs_lsass) to #Koadic. This also works for 'set MODULE' on stagers.
Last Seen Hashtags on Sotwe
nevsehirpasif
Seen from Turkey
Teenage nolimit _
Seen from Pakistan
TRE
Seen from Brazil
momson()*************** +filter:native_video
aydınmerkez
Seen from Turkey
تانجو_لايف
Seen from Oman
atlfreaks
Seen from Germany
实践
Seen from United States
moancewek mama
Seen from Malaysia
gaziantepesc
Seen from Turkey
Most Popular Users
Elon Musk 
@elonmusk
241M followers
Barack Obama
@barackobama
119.2M followers
Cristiano Ronaldo
@cristiano
111.8M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.2M followers
KATY PERRY
@katyperry
88.3M followers
Taylor Swift
@taylorswift13
82.2M followers
Lady Gaga
@ladygaga
73.7M followers
Virat Kohli
@imvkohli
70.9M followers
Kim Kardashian
@kimkardashian
70.1M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64.2M followers
Neymar Jr
@neymarjr
63.8M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.8M followers
Selena Gomez
@selenagomez
61.4M followers
X
@x
60.8M followers