LIFARS TechDiary

#TechDiary is born. In this place we will publish information about our daily work and things we stumble upon while doing it. #cybersecurity #dfir

[Ladislav B @ladislav_b]

My technical analysis of #DearCry #ransomware is now online. I would like to demonstrate some techniques of #MalwareAnalysis, and especially #ReverseEngineering in #IDA freeware of malicious sample for educational purposes.

https://t.co/qXeXt2tPJC

[LIFARS, a SecurityScorecard Company @LIFARSLLC]

Official #PHP Git Repository Was #Compromised. Remember the #SolarWinds supply chain compromise in December 2020? It seems that a similar issue affects PHP, the server-side #programming language powering over 79% of the #websites on the #Internet. #cyber https://t.co/uWw5u1a78b

[LIFARS, a SecurityScorecard Company @LIFARSLLC]

#Microsoft Exchange–ProxyLogon Vulnerability Analysis. Goal of this case study: summarize technical details of the ProxyLogon vulnerability alongside other vulnerabilities that were used in chain to perform remote code execution in early 2021 Exchange hack https://t.co/i7PlqB2DES

[Ladislav B @ladislav_b]

Thank you very much. It is my pleasure to participate in @BlackHatEvents.

And of course, kudos also to my great team at @LIFARSLLC, including Viliam and Jaroslava for their work on our tools.

@LIFARSTechDiary #ThreatInteligence #ThreatHunting #DFIR #CyberSec #BlueTeam

[Black Hat @BlackHatEvents]

@ladislav_b demos LogChecker - a new Windows and Linux tool for scanning log files, developed by LIFARS at #BHASIA Arsenal. It extracts IP addresses, domain names, and hashes from the input file. Learn more here: https://t.co/kBLLHA01Yy

[MalwareLab @malwarelab_eu]

#MalwareLabDaily 0x4E
Video analysis and #reverseengineering of recent #DearCry #ransomware sample by @ladislav_b.

This ransomware targets Microsoft Exchange servers affected by #ProxyLogon

#IDAFreeware #capa

https://t.co/DafQeKNOLP

@LIFARSLLC @LIFARSTechDiary @HexRaysSA

[LIFARS TechDiary @LIFARSTechDiary]

How does #Clubhouse work? Feel free to join this talk in Slovak language.

[Ladislav B @ladislav_b]

Talk about #Clubhouse #technology and #security. Today at 20:15 CET.
Poor Connection issues, vulnerabilities, #privacy
---
Dnes o 20:15 miesnosť venovaná techonológiám a bezpečnosti Clubhouse. Sieťová komunikácia, firewall, zraniteľnosti, súkromie, ...

https://t.co/UVsSQDUL4A

[LIFARS TechDiary @LIFARSTechDiary]

Tech people from @LIFARS are also members of this club, and we have own room about #hackers and #attacks every Friday.
@joinClubhouse

[Ladislav B @ladislav_b]

Our #CyberSecurity in #Slovakia club on #Clubhouse has its own website.
---
Náš klub Kyberbezpečnosť v SR už má vlastnú webovú stránku. Novinky, plánované miestnosti, poznámky, ďalšie materiály.

https://t.co/iQF5vxjeTO

@joinClubhouse #infosec #education #cybersec #security

[LIFARS TechDiary @LIFARSTechDiary]

We took a look at #clubhouse authentication. Can you #bruteforce it? Will you find out if others get unauthorzied access to your account? Let's see in the first part of our series on #clubhousesecurity.
https://t.co/KZtk4jUUr3

[LIFARS TechDiary @LIFARSTechDiary]

@ladislav_b, director of research and development department at LIFARS, took a hard look at what is going on behind the curtains of the #Clubhouse #socialnetwork.
https://t.co/C99nKUfNtg
#vulnerability #responsibledisclosure #clubhousevulnerability #cybersecurity #cyber

[LIFARS TechDiary @LIFARSTechDiary]

Pridajte sa dnes k nám na diskusiu na #Clubhouse. Pilotná edícia bude o minulých, aktuálnych aj budúcich kybernetických útokoch, o ľudoch a skupinách za nimi a ich obetiach.
https://t.co/hx1KiqICTZ
#cybersecurity #security #infosec #ethicalhacking #cybercrime #Hacking

[LIFARS TechDiary @LIFARSTechDiary]

Discussion about #hackers, #attack, #incident, #breach and #leak with @LIFARSLLC analysts.

Tomorrow, 19 Feb at 6:00 PM CET on @joinclubhouse.

https://t.co/MvSIC9oMKg

[Ladislav B @ladislav_b]

“Hackerské útoky včera, dnes a zajtra”. #Clubhouse, 19 Feb 2021, 18:00 CET

I am discussing #hacking and #cybersec with @henrichslezak and Milan Kyselica.
Tomorrow, 19 Feb at 6:00 PM CET on @joinclubhouse. Join us! https://t.co/FHyNxbmeMA

[Ladislav B @ladislav_b]

We have developed #Logchecker, a new #tool for log analysis powered by #ThreatIntelligence. It uses #YETI as its backend and supports plaintext and EVTX files. I wrote a blog post about this tool and its usage.
@LIFARSLLC @LIFARSTechDiary @malwarelab_eu

https://t.co/F9KbvjHHId

[LIFARS, a SecurityScorecard Company @LIFARSLLC]

𝐈𝐧𝐭𝐫𝐨𝐝𝐮𝐜𝐢𝐧𝐠 𝐓𝐡𝐞 𝐍𝐞𝐰 𝐋𝐨𝐠𝐂𝐡𝐞𝐜𝐤𝐞𝐫 - Log Analysis Tool Powered by Threat Intelligence Developed By https://t.co/kozTJcX9Mj @LIFARSTechDiary https://t.co/6t9fkupMFL #Sourcecodes and pre-built binaries are available at #LIFARS #GitHub: https://t.co/kkCReUohUQ

[LIFARS TechDiary @LIFARSTechDiary]

#Logchecker by @LIFARSLLC - our new #opensource #tool for scanning log files. It extracts IP addresses, domains and hashes from logs and checks for them in #YETI #ThreatIntel database.

https://t.co/V1tStpNTi0

https://t.co/zjHIrbkdlj

#DFIR #blueteam

[LIFARS TechDiary @LIFARSTechDiary]

Reflective PE Loader from #Egregor #ransomware. Compare @HexRaysSA decompiler output with and without little help of analyst with adding proper structures to the #IDAPro disassembly

#reversing #malware

[LIFARS TechDiary @LIFARSTechDiary]

Are you bored of mangled C++ names in #IDAPro? Change it with this quick tip.

This one and much more have been covered during recent #IDATraining by @HexRaysSA. Thank you.

#reversing #malwareanalysis

[LIFARS TechDiary @LIFARSTechDiary]

The #vulnerable versions of #SolarWinds, 2019.4 HF 5 to 2020.2.1 HF 1, released between March and June 2020, include a file containing the #backdoor called #SUNBURST. We wrote a brief guidance on how to check if you have it and if it was already exploited. https://t.co/9FxYNZmY8W

[LIFARS TechDiary @LIFARSTechDiary]

https://t.co/13akkuIPRe

[LIFARS TechDiary @LIFARSTechDiary]

What is Your toolset for #memoryforensics? Everyone heard of #Volatility and #Rekall, but what about #MemProcFS? It allows You to browse memory objects as files on mounted drive. Processing is super-fast. Try yourself, it is definitely worth a few minutes! #DFIR #digitalforensics