Silv0123

Malware Analyst
#ThreatIntel #BlueTeam #DFIR #CTI

[Silv0123 @silv0123]

#ThreatIntel
dce41d9d1da0084e7e44847b1b2b9fe0
Tied to @elastic reporting
https://t.co/m9hbgX4lkF
Mimicking @CrowdStrike Installer
Repo peakyblinders-team
This could be attributed to a cluster related to #APT34

[Greg Lesnewich @greglesnewich]

#100DaysofYARA day 2 - one cluster in my portfolio, TA427 really likes to use password-protected ZIP files with an MSC file as the only embedded file (used to use .VBS files)

lets look for ZIPs that match those features!

https://t.co/QB7BIY0qzR

[Silv0123 @silv0123]

@stvemillertime Would make IPv6 start from 256.x.x.x 😂 where IPv4 ended

More secure application layer protocols implementation (BGP is still broken)

ICAP newer alternative for content inspection (we now got QUIC for god's sake)

[Silv0123 @silv0123]

#100DaysOfYARA #dailyyara
Always wanted to keep writing regex for perfect detections but would sacrifice performance

3 recommended things to enhance performance

- file header
- file size
- regex position

https://t.co/GJvHKWFFPe

I Hope @cyb3rops won't come after me for this.

[Silv0123 @silv0123]

@malmoeb #100DaysOfYARA #dailyyara
Interesting take on Cloudflared, this will get downloaded and bypass most ICAP configs, never seen APT3[3459] using it but gotta get ready for them kittens who are still hiding in MENA gov Exchange servers!
https://t.co/55tLqllabR

[Silv0123 @silv0123]

#dailyyara #100DaysofYARA
Back to Yara greatness, totally appreciate all the contributions

the following shows number of occurrences per matching string from a rule file

yara -ws rule.yar sample.exe | tail -n +2 | cut -d : -f 3- | sort | uniq -c | sort -rn

[Silv0123 @silv0123]

#SideWinder #ThreatIntelligence #ThreatIntel Interesting Maldoc
c87eb71ff038df7b517644fa5c097eac

[Silv0123 @silv0123]

@ali_alwashali Hi Ali, always wanted to say thanks for the videos you posted on your YT channel

As for the terminal history, add this to /etc/bash.bashrc

export HISTCONTROL=ignoredups:ignorespace

source /etc/bash.bashrc

[Silv0123 @silv0123]

@greglesnewich Already regretting not joining the Yara ride.. been combating against the cyber kittens and I already died multiple times during DFIR!

[Silv0123 @silv0123]

#ThreatIntel
The moment you access old sample on VTI and notice someone is rescanning

[Silv0123 @silv0123]

#dailyyara
Getting back to Yara greatness, found nice CryptoJS obfuscation with reverse base64
45445df447cb076ab99ef94dbf9f8942

$ = "ycq1yb0BXeyN2LzJWas9CehpWYv02bj5SZyFGbmRWdvx2YuMnauR2Yv8iOzBHd0hmI9MmczBCdwlmcjNHP" // CF
$ = "strrev" fullword
$ = "reverse().join" fullword

[Steve YARA Synapse Miller @stvemillertime]

RonnieColemanYARAParser is a bulk analysis script that helps you use YARA/modules to build on-demand, customized views of file features from dozens or hundreds of files at once.

Updates to show match path, output to CSV etc

https://t.co/V1ZZSVuby9

#dailyyara #100DaysOfYARA2

[Silv0123 @silv0123]

#ThreatIntel
Fresh #Emotet DLL detected by @kaspersky
bc729f7827290a0899c0b811f91a8f09
www[.]nexxdecor[.]vn

[Silv0123 @silv0123]

#APT34 #OilRig #ThreatIntel #Trashtics

relatively recent compiled post exploitation tool
2022-03-08T03:58:55Z
c4bdc6759a8e979966b86ddfdeb358d6

[Silv0123 @silv0123]

Hey @ET_Labs
I would suggest editing sid 2035653 pcre to
/^[A-Za-z0-9\/_-+]{171}=$/

[Silv0123 @silv0123]

#ThreatIntel #Wiper

Related sample to the new wiper from Ukraine

84ba0197920fd3e2b7dfa719fee09d2f

[Silv0123 @silv0123]

#100DaysofYARA #dailyyara

Ransom path
$ = /[A-Za-z]:[\x2F\x5C][\x00-\x7F]{0,300}[Rr][Aa][Nn][Ss][Oo][Mm][\x00-\x7F]{0,300}\.(pdb|go)/ ascii

6bc2a7555122ccaddd5ae0497f3a3419

@stvemillertime it would be awesome if you'll create new Go paths ruleset just like the pdb ones!

[Silv0123 @silv0123]

Thanks @cyb3rops

I would suggest editing APT_HKTL_Wiper_WhisperGate_Stage3_Jan22

keepc $xc1 but remove $s1 and change filesize limit to at least 5MB to detect

b6563e61cdc02b6379efc51eb8792a43

[Silv0123 @silv0123]

#100DaysOfYARA #dailyyara
taking obfuscation detection to next level with yara

Ex: Ap0pD0at0a

{ 41 70 3? 70 44 3? 61 74 3? 61 }

Always use 3? for 0-9 range for numbers in ascii form

[Silv0123 @silv0123]

@stvemillertime found 52KB malicious ISO 17452f1b2b01fdf580c25c156b4a9732

[Silv0123 @silv0123]

#100DaysOfYARA
I'm late to the party here,

I haven't seen good performing rules for ISO file detection, created the following to be the first match in condition:

condition: filesize > 60000 and uint32(0x8001) == 0x30304443 and uint8(0x8005) == 0x31