Thinkronicity ™

thinker . seeker . greeter . love . science . equality № 1 . all aspects - audio . IT . Eng . AI . Arts . Poe & Blk beard . fait accompli . fire's my eye
ᙬꝂ

[Thinkronicity ™ @the360five]

This is how a true grateful human speaks. Simply and clearly. Being good hearted makes is easy to be great.
Wicked is wound in words of wild worry and wormy whispers, wouldn’t you know. It’s the way to the lowest of the low one can say, and will go, of woe.
🕉️Namaste🕉️

[Thinkronicity ™ @the360five]

@JackRhysider I am in it a lot.
Not sure what bright mode is anymore.
Not sure it would be better if I did.

[Thinkronicity ™ @the360five]

@ToshCooey @_iamblakeley Thanks.
I was missing those part of his lyrics.
I think it was because he is a whiny little bitch. And a coward.

[B L A K E L E Y™℠©® LLC @_iamblakeley]

Sir, you’re not a victim.

[Thinkronicity ™ @the360five]

@jengerson But hey. What can one expect.
They are fucking Americans.

[Thinkronicity ™ @the360five]

@jengerson Wow, they didn't chump-clip you
The WHOLE clip of #ChrystiaFreeland, Fmr. Deputy Pm of #Canada 🇨🇦 , on #MSNOW who chump clipped it. #RealTalk by a Real American, #LargeManAbroad.
POS cut out this
“You guys are the place where #Democracy is on life support”
https://t.co/8Zz5yyXcT6

[ICE T @FINALLEVEL]

I’ve had a very long and public career… In this world of people talking shit. You’ve NEVER heard ANYONE who actually Knows me or has ever met me say Anything negative about me or say I’m fake. Ever. My character is the most important thing to me. 💎

[B L A K E L E Y™℠©® LLC @_iamblakeley]

I thought this was about liberating the Iranian people? Oh, that was a lie and it was always about Israel? Thanks for confirming!

[ICE T @FINALLEVEL]

ICE COLD FACT 💎 Ya wanna lower your Stress… STOP competing and comparing your life to strangers… Especially the Illusion of Social Media #MostlyFake

[vx-underground @vxunderground]

Chat, we're cooked.

Today I decided to review the malware collection. How much malware have I collected over the past 7.5 years? I've collected 42.13 TB

WHAT AM I DOING WITH ALL THIS GOOP

[ICE T @FINALLEVEL]

More HEAT 🔥 From CRIMINAL MIGRAINE Featuring Brooklyn’s Own @SMOOTHEHUSTLER Produced by @RealCharlemagne ‘The Hate Is Real’ Only at https://t.co/iOEttmTZpU Art by @tommytheanimatr Comment and Share 👊🏽

[ICE T @FINALLEVEL]

Why do people keep saying this has to be MY dog???

[Chris Webby @ChrisWebby]

What a WILD weekend that was !!

Whoop whoop 🫡🕸

FULL RECAP : https://t.co/W91Dqa1iCb

[vx-underground @vxunderground]

Department of Homeland Security been REALLLLLLL quiet ever since they took down that anime streaming website.

What are you hiding?

[Thinkronicity ™ @the360five]

@_iamblakeley Hey Israel.
You should pay me to say some bullshit about your shitty genociding government and how much you susk ass.
Good video you did B.

[Thinkronicity ™ @the360five]

@FINALLEVEL Oh behave on the stage
A lotta red and deadly.
Outta a stewarded rage.
Notta zeitgeist Nickelback Ice Ice Baby
and not justa a bitta sage.
Self espect first, maybe
made the coursge.

Congrats on the moment on finish line for you both, for what it isalong the way.

many more

[ICE T @FINALLEVEL]

I’ve been posting tracks from my new CRIMINAL MIGRAINE album. Everyone is asking about Features.. Here’s one with the UNFUCKWITHABLE @bumpyknuckles77 Sign up at https://t.co/LES8m8MJsR The album will ONLY be released there in August. 💥💥💥💥 Share

[Jack Rhysider 🏴‍☠️ @JackRhysider]

If you're building a privacy tool, I wanna be your friend.

[Low Level @LowLevelTweets]

"ZOMG GPT-69 ESCAPED THE LAB"
meanwhile, in embedded security

[vx-underground @vxunderground]

I've praised a few malwares for various reasons. However, this particular malware is very interesting.

- Initially masquerading malware, designed to target very specific audience

- Written in multiple programming languages. However, the first stage is written in an uncommon programming language (Delphi) and compiled using an uncommon compiler (Embarcadero), specifically Delphi GUI TForm from Embarcadero (Vcl?)

- Obfuscated, in a very natural way. The binary at first glance appears semi-legitimate, it hides itself well

- The first stage (stager, or packer) contains multiple layers of decoy data. It makes reverse engineering challenging, not due to difficulty but time exhaustion

- Secondary stage (where I'm currently at) is loaded into memory discretely, it flows naturally with the GUI application. When decompiled, the stager has over 15,000 functions. It makes finding the in-memory loaded secondary stage tricky

- The secondary stage has some form of interprocess communication, it relies on the first stage to load it. If the first stage is not present, it does not work.

- The second stage works (in a currently unknown capacity) to load a third stage payload. However, the secondary stage with the first stage work (in a currently unknown way) to decrypt the third (and potentially final) stage a/k/a the actual payload

- The second stage uses deterministic probability to alert the first stage if the machine executing the first stage is a virtual machine and/or anti malware environment.

- The second stage has multiple integrity checks, it ensures it has not been tampered with to force the binary to pull the third and final stage.

This malware is pretty tricky. It definitely hasn't been written by a noob. This is definitely a very skilled Threat Actor who is using AI to supercharge their code base. Based on my conversations with my colleague, and information he can share, this code base has been rapidly evolving over the past couple of months in a uncharacteristic manner. While this Threat Actor has always shown evolution and improvement, it is now much faster, precise, and flexible.

Overall, based on what I've seen so far, they've put in a lot of work to make this as painful as possible. In order to successfully reverse engineer this binary, it require outside the box thinking and/or building a custom solution to successfully trick the secondary stager to give up the goop (the third stage)... or a custom extractor to pull the third stage statically.

No solution is ideal. This is good malware. If it's not state-sponsored, it's someone who has been doing this a long time and knows ball.