Michal Malík

Senior Detection Engineer at @ESETResearch

[Michal Malík @michalmalik]

We analyzed a new miner for macOS and Windows that uses QEMU and VirtualBox to mine inside a virtual machine and comes bundled with pirated copies of VST software https://t.co/7USMhexk9d

[Michal Malík @michalmalik]

@malwrhunterteam looks like Vshell

[Michal Malík @michalmalik]

@vxunderground Someone should try it on SteamOS :-)

[Michal Malík @michalmalik]

@malwrhunterteam @patrickwardle @cyb3rops well yeah, because it doesn't work

[WeLiveSecurity @welivesecurity]

#Breaking: ESET researchers discover a #0day exploit for #Telegram that targets a vulnerability they named #EvilVideo and allows for sending malicious files that are disguised as videos. Learn more on WeLiveSecurity: https://t.co/wdRmYV8jiy

[Michal Malík @michalmalik]

@jsuchal Nie Windows. CrowdStrike.

[Michal Malík @michalmalik]

@malwrhunterteam @JaromirHorejsi What ESET FP?

[Michal Malík @michalmalik]

@malwrhunterteam yes

[Michal Malík @michalmalik]

@malwrhunterteam @patrickwardle cobaltstrike indeed :) copied to /Applications/BSutils (unsigned binary)

[Michal Malík @michalmalik]

no

[Michal Malík @michalmalik]

@TuringAlex Nice find. Well... we'll see. For motivated actors it's pretty easy to make something that static engines will not detect, no need to be even close to this level of fancy. And this sticks out like a sore thumb. ;) And this is ammunition for the behavioral engines too, isn't it?

[Virus Bulletin @virusbtn]

ESET researchers discovered two previously unknown backdoors, LunarWeb and LunarMail, compromising a European ministry of foreign affairs and its diplomatic missions. They attribute the Lunar toolset with medium confidence to Russia-aligned group Turla. https://t.co/gVPwfofQJA

[ESET Research @ESETresearch]

We can also confirm https://t.co/3E8yAAimf0, hosting the Linux kernel source code repository, was a victim of Ebury between 2009 and 2011. During that timeframe, half of the kernel developers’ SSH passwords were stolen by the Ebury gang. 5/8

[ESET Research @ESETresearch]

#ESETresearch has discovered the Lunar toolset, two previously unknown backdoors (which we named #LunarWeb and #LunarMail) possibly linked to Turla, compromising a European MFA and its diplomatic missions abroad. https://t.co/VnCsGTidwr 1/6

[Jean-Ian Boutin @jiboutin]

Our new APT activity report is available now, with updates from #ESET researchers on the various threat actors we track. Check it out! https://t.co/6Uco930Eiz

[ESET Research @ESETresearch]

#Breaking #ESETresearch releases a paper about Ebury, among the most advanced server-side Linux malware, which was deployed to 400,000 servers over the course of 15 years, primarily for financial gain. @marc_etienne_ https://t.co/R5yFdlTjqS 1/8

[Michal Malík @michalmalik]

@adorais 👀

[Michal Malík @michalmalik]

@malwrhunterteam yes, it's a stealer in Go, dropped by another bin :)

[Michal Malík @michalmalik]

@DuchyRE @malwrhunterteam obfuscated Go + name + 15MB size = Sliver high confidence :)

[Michal Malík @michalmalik]

@malwrhunterteam :-)