roubachof

[roubachof @sdkddk]

Interesting fresh #Qakbot sample with lots of log messages. Version 404.447, campaign BB12, timestamp 2023-02-02 08:21:43.

https://t.co/GTkZQJuw4N

[Thomas Roccia 🤘 @fr0gger_]

🤓During the #100DaysOfYara, if you are not sure how to contribute, you can always contribute to the #UnprotectProject! cc: @DarkCoderSc

[Ajax @commial]

https://t.co/xsI8cFmVWx Little experiment about reusing Windows Defender built-in unpackers, mostly for fun (based on the very useful @taviso's loadlibrary)

[CERT Polska @CERT_Polska_en]

We had a blast at #botconf last week! During the lightning talks session we gave a brief presentation about malware config extraction using malduck🦆. As an additional treat, we've also open-sourced a few of our internal modules: https://t.co/AlhmIbCV6T.

[Thomas Roccia 🤘 @fr0gger_]

I tried to make sense of the backdoor mechanism this time and summarized it in a one-page overview. 😵‍💫

There's obviously more technical detail to uncover, but you'll get a general understanding of the complexity and the stealthy mechanisms used to remain undetected. 🧐

Thanks to @AndresFreundTec for his insight into this and a shoutout to these researchers if you want to learn more about the backdoor 🙏👇

- https://t.co/bLp4S0wpgC by SMX
- https://t.co/KC4ivTonF8 by @FiloSottile
- https://t.co/0byezgfiGJ by @amlweems
- https://t.co/9JjwBtVLlP by Karchem
- https://t.co/LWyx8f1eH1 by Russ Cox
- https://t.co/Q6vou6AfQD by 0xlane

And of course, all the others previously mentioned and those who contributed to the analysis. #xz #infosec

[Ninhack @_Ninhack]

☠ HijackLoader Mejora sus Técnicas en Evasión de Defensas

#HijackLoader #TecnicasEvasion #CrowdStrike

https://t.co/SW4KSTnRBP

[Thomas Roccia 🤘 @fr0gger_]

📢Big announcement: After months of work, with my partner in crime @Cyb3rWard0g, we created a masterclass that will teach you how to build your threat intelligence arsenal with Python and Generative AI 🚀

✨Our goal was to create something unique, innovative, and super practical! Through this training, we want to share our way of working, our mindset, and our experience working in the field for more than 10 years!

🤩Our training has been selected at @BlackHatEvents, and we will be teaching it this summer! We have limited seats! But stay tuned for future date announcement!

👉More info: https://t.co/u0gefxzRLl

[Check Point Research @_CPResearch_]

.NET Hooking - Harmonizing Managed Territory CP<r> provides a walk through the .NET hooking using the #Harmony library

🛠️ Common Examples of Implementation
💪 Defeating the #ConfuserEx2 string obfuscation
⚠️ Harmony hooking from the #dnSpyEx context
https://t.co/kRPvZDYyRW

[Christian Blichmann 🇺🇦 (on bksy and Mastodon) @AdmVonSchneider]

In the spirit of "this talk could've been a tweet", I just pushed a button:

#BinDiff is now open source.

- Snapshot release, no major new functionality
- Release binaries later today or tomorrow
- This is my 20% and I won't we able to act on PRs until end of Q4 (OOO traveling)

[Max 'Libra' Kersten @Libranalysis]

Just released a major update for DotDumper for @TrellixARC at @BlackHatEvents at the @ToolsWatch Arsenal! Unmanaged hooks are now supported, as well as a graphical user interface to create and search through DotDumper's JSON logs. Read all about it here: https://t.co/LBwNrKLhEw

[Daniel Lunghi @thehellu]

The slides https://t.co/c77SpAoCDO and video https://t.co/8WpHENc1Og of my #Botconf talk about #IronTiger TTPs are online. I discuss recent infection vectors (supply chain attack), the evolution of their malware toolkit and targeting, and our attribution methodology #APT #APT27

[Thomas Roccia 🤘 @fr0gger_]

🤗I've written a book! Let me introduce you "Visual Threat Intelligence"

You can register now to stay updated on its release and learn more about it in the link below. I really hope you'll like it! 🥹 #VisualThreatIntelligence #infosec #threatintel

👉https://t.co/REm5TuDRLu

[Kyle Cucci @d4rksystem]

Want to learn how #malware evades defenses and analysis tools? You can pre-order my new book "Evasive Malware" at Barnes & Noble for 25%-off (through 28 April)🥳

Use promo code "PREORDER25" when ordering.

https://t.co/G1GDaKNFyo

[Sebastien Larinier @Sebdraven]

After a year to work on this version, with @tomchop_ we are proud to annonce a new version of Yeti 🤩🤩🤩

the changes are explained here: https://t.co/y3k2ptgUqo

and to test this new version it's here !

https://t.co/kwYSoVNo9F

#CTI #python #threatintel

[roubachof @sdkddk]

#Botconf 2023 is over. Great talks, great people and great organization as usual ! See you next year in Nice.

Thanks @botconf for your awesome work.

[xThaz @0xThaz]

Mon exploit pour la RCE non-authentifiée sur Covenant a enfin été publié par Exploit-DB (lien en bas du blog 🐦)

Il s'inscrit dans la suite de challenge que j'ai réalisé pour la DG'hAck. Le détail de l'exploitation et le WU de mon challenge sont dispo :
https://t.co/IHKVXku6IA

[Hillai Ben-Sasson @hillai]

I hacked into a @Bing CMS that allowed me to alter search results and take over millions of @Office365 accounts.
How did I do it? Well, it all started with a simple click in @Azure… 👀
This is the story of #BingBang 🧵⬇️

[roubachof @sdkddk]

@Cyb3rMonk However, there are things that are still not obsolete, even after 37 year !!!

https://t.co/uMjzgWwx7X

[Thomas Roccia 🤘 @fr0gger_]

🧐Two new anti-debugging techniques have been added by Alex Schwarz including code snippets! Find out more on the #UnprotectProject pages! 👇 cf: @DarkCoderSc #infosec #malware

1⃣https://t.co/dlpFxy6JgM

2⃣https://t.co/HLejAkr95V

[Volexity @Volexity]

.@Volexity details how to use #memoryanalysis to detect EDR-nullifying malware. This latest blog post uses the #AVBurner malware, first documented by @TrendMicro, as an example. Read more here: https://t.co/fai8oJihOJ

#dfir #threatintel

[k1nd0ne @k1nd0ne]

I am happy to release a new malware analysis tool.
VISION-Process.

A fast and cross platform Procmon visualization application written in Rust & TS.

https://t.co/M3GBy3Udb7

An demo with QBOT :
https://t.co/MruSaVYG2H

Happy Hunting !
@pr0xylife #DFIR