MalwareLab.pl

Malware Research. Threat Inteligence. Trainings - [email protected]

[MalwareLab.pl @malwarelabpl]

Last month, for @AmnestyTech, we analyzed OSX sample of #FinFisher and provide other insights we gather along the way including some scripts aiding further analysis. If you need any help with any #malware related problems, don't hesitate to drop us an email, we are happy to help!

[Amnesty Tech @AmnestyTech]

German-made FinSpy spyware found in Egypt, and Mac and Linux versions revealed
https://t.co/6D6ypYvvQs

[/ˈziːf-kɒn/ @x33fcon]

@maciekkotowicz is getting us some details on Fishing Elephant tools and tactics

#x33fcon #APT

[MalwareLab.pl @malwarelabpl]

Jeżeli chcecie zobaczyc jakas konkretna kampanie - czekamy na propozycje do 14.07, jak nie to cos sobie znajdziemy ;]

[Sekurak @Sekurak]

Chcecie zobaczyć na żywo analizę kampanii malware?
Zapraszamy na remote sekurak hacking party. Prezentował będzie @maciekkotowicz:

https://t.co/zSK2z0M3Gy

[CSIS Security Group @csis_cyber]

@maciekkotowicz is our next speaker at #CCCC2020. He worked before as Senior Security Researcher in Kaspersky GReAT or Principal Botnet owner at https://t.co/y8EZS2YXFW. He'll talk about #Fishing Elephant, or How to Build a Cloud-Based #APT.
https://t.co/LauaGWGhDn #Conference

[MalwareLab.pl @malwarelabpl]

This time we write about #Skidware - https://t.co/mM4vK7eSmW | We found new #hackforums grade rat based on #Quasar - its hilarious, check it out #Malware //cc @JAMESWT_MHT @James_inthe_box @Casperinous

[MalwareLab.pl @malwarelabpl]

document (https://t.co/Te2i34Wkk5 - Bubar Parlimen.docx) dropping #DADSTACHE, download urls: hxxps://armybar.hopto[.]org/{RemoteLoad.dotm,LogiMailApp.exe,LogiMail.dll,Encrypted} c2: tomema.myddns[.]me #Leviathan/#APT40 cc: @Mao_Ware

[MalwareLab.pl @malwarelabpl]

bunch of #TA505 docs with name: Human Resources Annual Report.docx (list: https://t.co/lMnFAxr9hE) mimics real vba code, will drop a dll with typical packer and #get2 with c2: shr-links[.]com probable lure email: https://t.co/BlyWMhe7Z8 #ThreatIntel #Malware #APT #ThreatHunting

[MalwareLab.pl @malwarelabpl]

Interesting clue about operation timeline of #Higaisa based on samples from @Malwarebytes's article - before jumping to shellcode loader checks if current year is in [2018,2021] time frame (it also makes quite a good #yara ) #APT #Malware #ThreatHunting #threatintel

[MalwareLab.pl @malwarelabpl]

#APT #Konni 6973fa7aed812980f0539302d64e618f
Name: North Korea-South Korea Relations.doc Downloads: hxxp://footballs.sportsontheweb.net/{2,3}.dat c2:hxxp://footballs.sportsontheweb.net custom alphabet for base64 used to conceal strings

[MalwareLab.pl @malwarelabpl]

We write up our analysis of a validator dropped by documents used by #Lazarus, this validator was used in a campaing described by telsy as well as the ones recenty conducted against LockheedMartin, BAESystemsplc, Boeing. https://t.co/Jd35Pc2ek2 cc: @Manu_De_Lucia @Arkbird_SOLG

[MalwareLab.pl @malwarelabpl]

@dms1899 @LockheedMartin @BAESystemsplc @Boeing @JAMESWT_MHT i don't have any victims telemetry, but based on decoys and additional info from https://t.co/PNynudn5d7 - it quite safe to assume that military contractors working for South Korea especially the one present in decoys

[MalwareLab.pl @malwarelabpl]

Couple of #Lazarus #APT samples, with decoy documents referencing @LockheedMartin, @BAESystemsplc, @Boeing. Downloads remote templates and drops double-base64 encoded patched sqlite3 dlls, iocs: https://t.co/NSJb8BBEjq patched/added exports: sqlite3_stmt_all,sqlite3_stepsW

[MalwareLab.pl @malwarelabpl]

Second part (and last;) of our #Nazar's #APT tool is live. https://t.co/cWIajppuPj . With some experimental #snort/#suricata rule for you amusement #Malware #ThreatIntel #sig37 /cc @juanandres_gs

[MalwareLab.pl @malwarelabpl]

Quick update on #Nazar #APT capabilities (https://t.co/17CaGZ0A1h) | Tomorrow will post analysis of c2 protocol

[MalwareLab.pl @malwarelabpl]

We put some hours into covering blanks about tool used by #Nazar #APT /cc: @juanandres_gs https://t.co/17CaGZ0A1h

[MalwareLab.pl @malwarelabpl]

New #aggah campaign, #GuLoader added to chain
Doc: 7418b898c989e3fb0d13b5db2c9773478e23150c590acad5832ccc3c14b80a26
remote payloads: hxxp://office-updates-index[.]com/{Report.rtf,Attack.jpg,File.vbs, track.jpg,max.bin}
#AgentTesla c2: fxp://ftp.centredebeautenellycettier[.]fr/

[MalwareLab.pl @malwarelabpl]

We put some effort into analyzing #RoyalRoad (aka 8t) rtf weaponizer. Take a look
https://t.co/LSAETSRW2U /cc @nao_sec #APT #malware #ThreatIntel

[/ˈziːf-kɒn/ @x33fcon]

@maciekkotowicz at #x33fcon 2020!
Fishing Elephant, or How To Build Cloud Based APT

https://t.co/xf1bVBzXfd

Register: https://t.co/uquFhC1Ow0

[MalwareLab.pl @malwarelabpl]

Our first public analysis, new campaing from #Aggah analyzed with a lot of #bashfu https://t.co/eirVijNSKr