Last month, for @AmnestyTech, we analyzed OSX sample of #FinFisher and provide other insights we gather along the way including some scripts aiding further analysis. If you need any help with any #malware related problems, don't hesitate to drop us an email, we are happy to help!
Chcecie zobaczyć na żywo analizę kampanii malware?
Zapraszamy na remote sekurak hacking party. Prezentował będzie @maciekkotowicz:
https://t.co/zSK2z0M3Gy
@maciekkotowicz is our next speaker at #CCCC2020. He worked before as Senior Security Researcher in Kaspersky GReAT or Principal Botnet owner at https://t.co/y8EZS2YXFW. He'll talk about #Fishing Elephant, or How to Build a Cloud-Based #APT.
https://t.co/LauaGWGhDn #Conference
bunch of #TA505 docs with name: Human Resources Annual Report.docx (list: https://t.co/lMnFAxr9hE) mimics real vba code, will drop a dll with typical packer and #get2 with c2: shr-links[.]com probable lure email: https://t.co/BlyWMhe7Z8 #ThreatIntel#Malware#APT#ThreatHunting
Interesting clue about operation timeline of #Higaisa based on samples from @Malwarebytes's article - before jumping to shellcode loader checks if current year is in [2018,2021] time frame (it also makes quite a good #yara ) #APT#Malware#ThreatHunting#threatintel
#APT#Konni 6973fa7aed812980f0539302d64e618f
Name: North Korea-South Korea Relations.doc Downloads: hxxp://footballs.sportsontheweb.net/{2,3}.dat c2:hxxp://footballs.sportsontheweb.net custom alphabet for base64 used to conceal strings
We write up our analysis of a validator dropped by documents used by #Lazarus, this validator was used in a campaing described by telsy as well as the ones recenty conducted against LockheedMartin, BAESystemsplc, Boeing. https://t.co/Jd35Pc2ek2 cc: @Manu_De_Lucia@Arkbird_SOLG
@dms1899@LockheedMartin@BAESystemsplc@Boeing@JAMESWT_MHT i don't have any victims telemetry, but based on decoys and additional info from https://t.co/PNynudn5d7 - it quite safe to assume that military contractors working for South Korea especially the one present in decoys