nubbie

I like Rust RE and CTI | Posting sometimes

[UwU Underground @uwu_underground]

"MyThOs iS a SuPer wEaPoN."

Anyway! Here's access for "trusted" orgs still vulnerable to CVEs with birthdays, run by execs who won't fund shit unless Gartner puts it in a quadrant, all while their Fortinet boxes are operating as nation-state APT Airbnbs.

[UwU Underground @uwu_underground]

Somewhere, a hiring manager is choosing between your resume and a nation-state AI waifu posting thirst trap slop music videos about APTs on LinkedIn

No wonder North Korean hackers are winning

[nubbie @nubbieeee]

@ReimuNotMoe rendering text is hard give it some compliments and it'll be happier

[nubbie @nubbieeee]

@cryptoupdate_io also just realized this is a damn clanker why is it here

[nubbie @nubbieeee]

Analyzing jitterdropper (https://t.co/k6XjK7ZHec) over the past 2 days and have some IOCS to share. Attribution is unknown atm

[nubbie @nubbieeee]

@cryptoupdate_io the IP is down atm and i couldn't find anything about it on AbuseIPDB, greynoise, or Censys :/

[nubbie @nubbieeee]

The first binary is signatured as ResolverRAT/PureRAT as it performs many GetProcAddress calls to resolve functions over importing them. No real signature is given to the second binary from what I understand/recall.

[nubbie @nubbieeee]

.NET Reactor binary dropped by shellcode: 79ef823caca0dd6c416d430e327c014c704375dd27ae0e023be66aa5fd0c7a63
Second .NET Reactor binary (now a DLL) dropped by the first .NET Reactor binary: 55463772e3eb3d6b9fb2e1e14308ebf542742eecb0b33b71f2a3ca9da39e3158

[nubbie @nubbieeee]

Comms over ports:
- 56001, 56002, 56003
- 58754, 58469

[nubbie @nubbieeee]

C2 IP (also suspected crypto mining pool) contacted by the final .NET Reactor binary: hxxp://91.84.118.17

[nubbie @nubbieeee]

Note that the second binary was embedded in the first as a tripleDES-encrypted + gzipped file.

[nubbie @nubbieeee]

Rust Loader: 812d2d8436985fc8531315970b2af6bcdd697f9033bc12841ce467e6fda94408
Donut shellcode exec'd by loader: 70c7c06a4781c9c0c00f55e21995940814b3fc39a85b75d5c26544045032e504

[vx-underground @vxunderground]

🍞BAKING🍞

ANTHROPIC CLAIMS MYTHOS IS SUPER SCARY AND BADASS, THE NSA SAID "WEW" AND COMPUTERE EXPLODED AND STUFF "BOOM!!!"

ANTHROPIC IS TOTALLY CEREAL YOU GUYS. ITS SUPER SCARY. THEY CANT SHOW YOU, BUT TRUST ITS REEL.

GIVE THEM ALL YOUR MONEY

[nyara @nyaraVT]

> started a war for Israel
> pretended it was because of nukes
> lost the war
> pays $300 billion to Iran
> Iran now has ballistic missiles
> oil prices are higher
> world economy destabilised
> embarrassed the US
> pretends it’s a win

[nubbie @nubbieeee]

@herrcore elite agentic red teaming @hunterinosec

[Jvnior @Jvnior]

🚨🇱🇧 LIVE FOOTAGE: Israel murders a news reporter covering the destruction in Lebanon

This is the most SHOCKING footage I ever saw.

[nubbie @nubbieeee]

@t0asts elite toasts wisdom

[The Palestine News Network @PaliNewsNetwork]

YouTube just deleted PNN channel … we had over 40,000 new subscribers since March

[vx-underground @vxunderground]

Excellent move, Meta.

Bribe the voters in rural communities by paying your taxes. Make people think this is good. Give people the money. Let people support your massive server farms.

Then when it's built, have the laws changed and stop paying taxes.

[Waozi @waozixyz]

80 days to go