Sascha Curylo

Malware Analyst @ G DATA

[Sascha Curylo @sculabs]

@andrew_jrt @gopalfreak

[Andrewjrt @andrew_jrt]

OVERWATCH 2 GIVEAWAY
Saitama - Doomfist Legendary Bundle

How To Enter:
👊Follow @andrew_jrt
👊Like & Retweet
👊Tag your BFF

(Codes provided by Blizzard)

[Sascha Curylo @sculabs]

@andrew_jrt @gopalfreak

[Andrewjrt @andrew_jrt]

OVERWATCH 2 GIVEAWAY
Terrible Tornado - Kiriko Legendary Bundle

How To Enter:
👊Follow @andrew_jrt
👊Like & Retweet
👊Tag your BFF

(Codes provided by Blizzard)

[Sascha Curylo @sculabs]

@andrew_jrt @gopalfreak

[Andrewjrt @andrew_jrt]

OVERWATCH 2 GIVEAWAY
Genos - Genji Legendary Bundle

How To Enter:
👊Follow @andrew_jrt
👊Like & Retweet
👊Tag your BFF

(Codes provided by Blizzard)

[MG @_MG_]

New details on the 2nd LastPass incident are fun:
- got into Sr DevOp's home via vuln media software
- installed keylogger
- got master pass to corp vault (seemingly because it was being accessed from home computer)

Cool to see that LastPass is sharing this level of detail. Most companies are vulnerable to an attack like this.

Main post:
https://t.co/Qcyxpoh8xj

Incident 1 details:
https://t.co/LZYUJJ1Dhc

Incident 2 details:
https://t.co/GIuRP8RftR

[Sascha Curylo @sculabs]

@rove4ever @annliger Nice to meet you!

[Thomas Roccia 🤘 @fr0gger_]

I briefly analyzed #HermeticWiper to give an overview of its capabilities. I have deliberately omitted some details for better understanding. I'll update the graphic as my analysis progresses! Hope this will help you understand better the attack! #infosec #malware #cybersecurity

[Samir @SBousseaden]

interesting maldoc (winword -> outlook -> powershell -> slack) https://t.co/v7xsWCoiiT

cf6faf7d7065f2f9ac9b946e563b2891

[jasi @jasiwardas]

😂👍

[Hex-Rays SA @HexRaysSA]

IDA 7.7 is now available!
Check out all the details about its latest features and enhancements: https://t.co/u7V109P1pT

#IDAPro #NewRelease #HexRays

[int eighty (of Dual Core) @int0x80]

Damn, that iMessage exploit is wild.

[Jiří Vinopal @vinopaljiri]

Wanna unpack SmartAssembly 8+ ??
#1 dumbassembly 0.5.8
#2 Clean with ilspy+reflexil (search obfuscator - deobf)
#3 Use SAE - Browse for assembly - deobf (String + flow + Delegate Calls)
#4 De4dot - cleaning + string decryption --strtyp delegate --strtok X
#5 optional repeat #3
👍

[Greg Linares (Laughing Mantis) @Laughing_Mantis]

This was the last pillar preventing wide spread exploitation in #log4j

In the words of good ol Samuel L. Jackson

"Hold on to your butts."

[an0n @an0n_r0]

from @BlackHatEvents USA 2016:

A Journey From #JNDI/LDAP Manipulation to Remote Code Execution Dream Land by @pwntester and @olekmirosh

https://t.co/LbI7BTodtE

now the exploit vector presented in 2016 is the #log4jRCE.

attached slide #11 from the presentation below. :)

[Didier Stevens @DidierStevens]

I made a small PoC. cs-mitm. py is a mitmproxy script that intercepts Cobalt Strike traffic, decrypts it and injects its own commands. In this video, a malicious beacon is terminated by sending it an exit command. The beacon uses one of the leaked private keys.

[Karsten Hahn @struppigel]

We created a vaccine for STOP/DJVU ransomware💉
#vaccine #ransomware #stopransomware
https://t.co/RMJXa9ie8V

[hasherezade @hasherezade]

Recently I started working on a driver for mal_unpack ( a tool from #PEsieve family) - if anyone curious, I open-sourced the code: https://t.co/j6fD2eEjZE - please share what do you think

[Florian Roth ⚡️ @cyb3rops]

Lovely
#MicrosoftDefender