Shaul Holtzman

Senior Sales Engineer @intezerLabs

[RG9N @DegrootDominik]

Great integration of CAPA by @FireEye into @IntezerLabs e.g. https://t.co/JTmGSpzdJN #Formbook

[Shaul Holtzman @shaulhol]

@lowk3y @IntezerLabs We analyze the code at all levels (os, docker, k8s). Did you run any containers on your system?

[Shaul Holtzman @shaulhol]

@lowk3y @IntezerLabs https://t.co/JohhC34wbN

[Shaul Holtzman @shaulhol]

@lowk3y @IntezerLabs No yet, but you can just run the installation again to update

[Shaul Holtzman @shaulhol]

@BushidoToken @Arkbird_SOLG @XOR_Hex Intezer can unpack PlugX if you send it to dynamic unpacking: https://t.co/Y0s02xEATY

[Shaul Holtzman @shaulhol]

@danusminimus @James_inthe_box @malwrhunterteam @ffforward @JAMESWT_MHT @lazyactivist192 7b48a9c4df9d8ec5bcf1fb5f45e30852 drops 70e6bb7d26707d4bde8d8da6870ee3f8

Dropped file analysis: https://t.co/j3xaz4nM74

[Intezer @IntezerLabs]

Operation #ElectroRAT

Already thousands of crypto wallets stolen. Extensive campaign includes written from scratch RAT hidden in trojanized applications.

Windows, Linux and macOS samples undetected in VirusTotal
https://t.co/KyBqPhZ0jW

[Intezer @IntezerLabs]

Early bird catches the Golang worm.

New #Golang worm drops #XMRigMiner on Windows and Linux servers. Targets public facing services: MySQL, Tomcat, Jenkins and WebLogic.

Undetected in VirusTotal
https://t.co/jzO2IBtH1I

[Ari Eitan @arieitan]

[1/4] Few people asked me about the #SUNBURST attack from @IntezerLabs POV - so here is a #Solarwinds thread - but this time from the binary code side -

This is an infected Solarwinds file analysis in Analyze
~ 87% of the code - Known Trusted by Solarwinds
~10% - Unique
->>

[Ari Eitan @arieitan]

Our research team discovered new COVID-19 phishing lures that were used to deliver the Go version of #Zebrocy (APT28 🇷🇺)
The lures consisted of documents about Sinopharm International Corporation 🇨🇳

Full analysis here -
https://t.co/ZD9SDpd6lA

@IntezerLabs @joakimkennedy

[Shaul Holtzman @shaulhol]

Join the #Intezer Protect community now! You can monitor your Linux machines or any cloud workloads and get full visibility into the code they run

#ProtectTheCloud

[Intezer @IntezerLabs]

Free Cloud Workload Protection.

Proven Linux threat detection, no manual policies or overhead, and no slowdown in performance.

Intezer Protect community edition now available. #ProtectTheCloud
https://t.co/50ml7KiEdu

[Intezer @IntezerLabs]

CVE-2020-16995: New vulnerability in Microsoft @Azure VM extensions. Read more https://t.co/LgEllk2joD

[Intezer @IntezerLabs]

The multitalented @shaulhol put on his attacker hat to exploit a vulnerable version of Apache Struts 🦹‍♂️ https://t.co/JwuEiQavhI

Preview how Intezer Protect terminates XMRig Miner on an #Ubuntu server following a successful infection

[UNPACME @unpacme]

Our integration with @IntezerLabs is live! Scan your unpacked samples and classify malware directly from https://t.co/tHMUCiFNxx!

[Shaul Holtzman @shaulhol]

@r3dbU7z @IntezerLabs https://t.co/BvoSoFuKm2

[Shaul Holtzman @shaulhol]

@Kangxiaopao @Amigo_A_ Thank you! The file was indexed as Crylock: https://t.co/X9RZRx3wux

[Intezer @IntezerLabs]

🆕 Search by hash just got more convenient! Quickly analyze your SHA256, MD5 or SHA1 with a simple click from any Chrome webpage. Get the Chrome extension for Intezer Analyze https://t.co/jJUJx5M3kG

[Shaul Holtzman @shaulhol]

@struppigel https://t.co/MgvyRZIgzD
Updated result with Agent Tesla payload

[Shaul Holtzman @shaulhol]

@Ledtech3 @IntezerLabs Thank you for letting us know, David!