int80

while(malware || re || exploit || attack || coding);

[int80 @int80]

my chilhood, while playing games like dave, prince of persia, pac-man, paratrooper .. then came DOOM - that completely changed how we saw what a PC could do ... how can we even forget this .. and after reading Masters of Doom, I kind of relived those days ...

cc: @romero

[int80 @int80]

Explored how LLMs can be silently backdoored using minimal data and compute. Here’s the full PoC write-up: https://t.co/7JHf1U94h3

#AI #AISecurity #RedTeam #LLMSecurity #CyberSecurity #OffensiveSecurity #VulnerabilityResearch

[int80 @int80]

much of my childhood spent on these .. and these and these ...
these games inspired me a lot to get into programming ... Turbo C, GWBASIC .. those days !!!
cc: @romero

[int80 @int80]

discord data. #MarsStealer #Malware

[int80 @int80]

#qbot #qakbot landed at EP on hollowed explorer . exe

[int80 @int80]

#qbot #qakbot explorer.exe hollowing happens twice. first time fails, second time success.

[int80 @int80]

#qbot #qakbot #fasm developed smallest and fastest PE enumerator. 10k bytes. against qbot.

[int80 @int80]

@AbsoZed @JRoosen explorer.exe gets hollowed. so far this is my understanding.

[int80 @int80]

#qbot #qakbot after section injection into explorer.exe

[int80 @int80]

#qbot #qakbot CreateSection, explorer.exe

SECTION_MAP_EXECUTE_READ_WRITE = E
PAGE_EXECUTE_READWRITE = 0x40

[int80 @int80]

#qbot #qakbot indicator of process manipulation

[int80 @int80]

#qbot #qakbot after explorer.exe CreateProcess, API string generation through xor

[int80 @int80]

#qbot #qakbot GetModuleHandle into rsrc

[int80 @int80]

union REGS regs;
regs.x.dl = 0;
int86(0x21, &regs, &regs);

[int80 @int80]

#qbot #qakbot overwrites itself through ShellExecute

[int80 @int80]

#qbot copies itself

[int80 @int80]

#qbot #qakbot snxhk_border_mywnd

[int80 @int80]

#qbot av filenames

[int80 @int80]

@malware_traffic Emotet MD5: 4b144015167e713fa10851ddbba1cedd drops Trickbot (f097ca21830acec50af81eca913cab33)

[int80 @int80]

#emotet #trickbot anyone seen emotet or trickbot using ROP to transfer control to different parts of the malware? cc
@VK_Intel