Adam

IDA pro enthusiast, malware reverser, addicted to Rocket League.
@PwC_uk Threat Intelligence.
All views my own.

[Virus Bulletin @virusbtn]

Google's Nino Isakovic analyses the ScatterBrain obfuscator, used on POISONPLUG variants. ScatterBrain appears to be a substantial evolution of ScatterBee, an obfuscating compiler previously analysed by PWC. https://t.co/E9FU3eokgl

[Mandiant (part of Google Cloud) @Mandiant]

Ever wonder how attackers use advanced tools to evade detection?

Mandiant analyzes #ScatterBrain, an obfuscator in the POISONPLUG.SHADOW backdoor, which is used by China-nexus actors.

Learn how we’re unmasking these sophisticated threats.

Read more: https://t.co/5vwYoEBwjz

[Adam @malworms]

For anyone using Binary Ninja and wanting to use Mandiant's ShellcodeHashes IDA plugin-I ported a basic version of the IDA plugin to Binary Ninja:
https://t.co/4CIM7QwfbP
Known limitations - No GUI, no support for searching memory constants - but it works well for most use cases

[Allison Wikoff @SaltyWikoff]

We've got TWO roles open in Australia! Looking for both tech and strat threat intel analysts. Come work with all the awesome folks on the #pwc TI team. Bonus: Witness firsthand the epic banter between me and @pewpew_lazors.

https://t.co/pHIhEkwPog

https://t.co/M211FbxPdm

[Ivan Kwiatkowski @JusticeRage]

Step 1: open a binary in IDA and press F5
Step 2: paste the decompiled code into OpenAI's chatbot

Someone's job just got way easier.

[nickharbour @nickharbour]

#flareon9 Pre-registration is now live! https://t.co/b0uJiVMBMi

[Adam @malworms]

@c3rb3ru5d3d53c Looks very much like the technique lockbit is currently using to me 🧐

[Adam @malworms]

@fr0gger_ Alt+F7 feels like a bit of an omission. Used way more by me than most on this list...

[Rob @ipsosCustodes]

@cyberoverdrive @PwC @MITREattack @rfackroyd @eral4m We're hiring for our #detectionengineering team. If you would like to join the team that helped produce this annex, the main report, and does so much more, then visit https://t.co/lwuvtHiLjm

[NinjaJobs @TheNinjaJobs]

PwC is seeking a Cyber - Global Threat Intelligence - Technical Analyst - Sr Associate based in the Remote area. For more details, visit the listing. #ninjajobs #hiring #cybersecurity https://t.co/OIjnF3FiGb

[Mark @_marklech_]

This is cure to so much pain.

[David Cannings @edeca]

Recently uploaded ShadowPad #malware (6e99974b8d421f8923fc132487d7da0d22c5e0fa1940494f312f9c9389c3f4ca) uses C2 login[.]onesigh[.]com. The Root module is from November 2020. Working on ShadowPad? DMs are open for collaboration #threatintel

[NinjaJobs @TheNinjaJobs]

PwC is seeking a Threat intelligence / malware analyst based in the US / NL / DE area. For more details, visit the listing. #ninjajobs #hiring #cybersecurity https://t.co/jMN0KjiZD0

[GuidedHacking @GuidedHacking]

I never knew I needed this article until now
https://t.co/NehYwJoGA6

[French @notareverser]

What the heck is Shikata ga nai?

Nothing can be done but spit out a thread

[Adam @malworms]

@zcracga Thanks a lot!

[Adam @malworms]

For anyone interested in some #ShadowPad research- https://t.co/lQ4nlBFBXK
https://t.co/PuUIlH4mht
Takes a deep dive into the #ScatterBee (aka #ShadowShredder, #PoppingBee) packing mechanism used by some ShadowPad variants and has scripts to enable static analysis of the payloads

[Adam @malworms]

@LloydLabs Thanks mate, was a fun one to work through.

[Adam @malworms]

extra - IDA determines if a binary is Golang or not only by the presence of the Go build string. The build string does not need to be correctly formed, just finding space in the .text section with enough CC alignment and pasting that string in lets IDA work properly @HexRaysSA

[Jiří Vinopal @vinopaljiri]

If you are reversing latest #Hive #Ransomware (written in GO) be careful about intentionally missing "Go build ID" string in compiled binary - latest IDA 7.6 will not treat it as GO compiled binary and no func will be recognized (Patch it -> Load it -> Patch it back).🙏😉

[Hex-Rays SA @HexRaysSA]

In case you missed it, we recently released Season 1 of “Igor’s tip of the week” blog posts in PDF format (All 52 of them!). We hope you find it useful!

Check it out : https://t.co/cPy0hT07YV

#HexRays #Igorstipoftheweek #IDA #ReverseEngineering