Lorenzo Maffia

Malware for breakfast, Incidents for lunch, and Threat Hunting for dinner

[Lorenzo Maffia @Maff1t]

@AiBreakfast https://t.co/8C298yBcSQ

[Simone Aonzo @packm4d]

Today we (@antonio_ruggia, @_pox_, @dreamersball80, @_DarioNisi) disclose some vulnerabilities that we exploited to mount a novel phishing attack on @Android by abusing inotify.
Our research will be presented at @IEEEEUROSP 23

https://t.co/QAYowmxNco

Some comments below (1/n)

[Lorenzo Maffia @Maff1t]

New Anti-VM technique used inside #raspberryrobin malicious DLL.

By simply using EnumDisplayDevicesA you can easily detect VMware virtual displays.

[Lorenzo Maffia @Maff1t]

@packm4d I mean > 500MB usually (my experience). Agree on entropy 😉👍

[Lorenzo Maffia @Maff1t]

I'm seeing a lot of malware with a HUGE file size!
They do this by attaching a large random resource to the binary itself.

The resource consists of a few bytes repeated multiple times➡️When inserted inside an archive or MSI installer it becomes a few MBs !!

⬇️Why?

[Lorenzo Maffia @Maff1t]

@JAMESWT_MHT @reecdeep @VirITeXplorer @AgidCert @guelfoweb @1ZRR4H @0xToxin @ffforward @fr0s7_ @StopMalvertisin @pr0xylife I wrongly supposed that the file was malicious. In this case, libcurl.dll seems legit, so the correlation is most probably wrong.

[Lorenzo Maffia @Maff1t]

@JAMESWT_MHT @reecdeep @VirITeXplorer @AgidCert @guelfoweb @1ZRR4H @0xToxin @ffforward @fr0s7_ @StopMalvertisin @pr0xylife It seems that they are using the same Side loading as Mustang Panda (GUP.exe, libcurl.dll..... )🤔⁉️
https://t.co/XPXjCC92QR

[Lorenzo Maffia @Maff1t]

You can easily remove the large resource using CFFExplorer

➡️ Then calculating the hash you can discover the real payload!

#malware #malwareanalysis #reversing

[Lorenzo Maffia @Maff1t]

Why?

Here are some of the possible reasons:
1. EDR evasion: no hash calculation, no ML/Sandbox analysis
2. AV evasion: easily change hash and modify the overall features of the binary (e.g. entropy)
3. Amcache hash not calculated correctly
4. ... other ⁉️

⬇️Bonus Advice

[Malwarebytes @Malwarebytes]

#Malwarebytes scored 100% on Windows protection in @MITREattack's 2022 testing. @MITREengenuity

Dive into the results on our blog and see why we're in the top 10: https://t.co/PbrMuD47ni

[Lorenzo Maffia @Maff1t]

A Process Injection technique that:
- doesn't read/write remote process memory
- doesn't execute a remote thread.

I took the amazing idea of @x86matthew to re-use ntdll code, and I moved the execution to a remote process.

https://t.co/W8sgFjFqjo

[Objective-See Foundation @objective_see]

⚠️ In macOS 12 (beta 6), Apple patched an intriguing flaw. Discovered by Gordon Long (@ethicalhax), CVE-2021-30853 allowed attackers to bypass:

▫️Gatekeeper
▫️Notarization
▫️File Quarantine

Interested in exactly how?

Read: "Where's the Interpreter!?"
https://t.co/N3aZhkSW0L

[Gaspare Ferraro @GaspareFerraro]

💻 Fantastic experience for the @ZenHackTeam 🇮🇹 invited in Abu Dhabi 🇦🇪 to participate in the @hackinthebox #ProCTF 🚩with the top #CTF teams!

Many thanks to @l33tdawg and the #HITB team for the great organization of the #CyberWeek 2021!

#CyberSecurity #AbuDhabi #HITBCyberWeek

[Gaspare Ferraro @GaspareFerraro]

💻 @ZenHackTeam ready to capture flags 🚩 to the @hackinthebox #CyberWeek #ProCTF 🦾

From Italy 🇮🇹 with friends @mhackeroni & @pwnthem0le 🤌

#CTF #HITBCyberWeek #CyberSecurity

[Gaspare Ferraro @GaspareFerraro]

💻 @ZenHackTeam 🇮🇹 on the way to #AbuDhabi ready to partecipate in the @hackinthebox #HITBCyberweek #ProCTF! 🦾🚩

#CyberSecurity #HackInTheBox #HITB #CyberWeek
@UniGenova @InfUNIGE

[Lorenzo Maffia @Maff1t]

Here you can see a use-case, analyzing CobaltStrike's beacon, in its two forms of injection.
One for post-exploitation (using ResumeThread) and the second for migration (using CreateRemoteThread).
The dumped PE is automatically unmapped from memory to be easily analyzed later.

[Lorenzo Maffia @Maff1t]

InjectionTracer v0.1 is OUT!
A tool that aims to help you to ��𝐝𝐞𝐧𝐭𝐢𝐟𝐲, 𝐝𝐞𝐛𝐮𝐠 𝐚𝐧𝐝 𝐝𝐮𝐦𝐩 the injected code.
It supports most of the known process injection techniques.
https://t.co/ykuq6R2LK8

[Lorenzo Maffia @Maff1t]

@LiveOverflow "Shoutout to the polish and indian video creators. I do not understand a single word, but you all seem very active". Finally someone has publicly said what everyone thinks 😂😂😂

[dfirfpi @dfirfpi]

McAFuse, an open source way to handle McAfee FDE. Master thesis by Andrea Canepa, cc @zxgio. Blog: https://t.co/3gnuUV3zru. Code: https://t.co/up0vvdn7fI. #DFIR