Today, I'm releasing the first version of a small web ๐: https://t.co/WZMsLWpGEK
It provides IOCs and YARA rules collected semi-automatically from public blog posts and reports of almost 200 cybersecurity sites.
I hope it proves useful to some of you ... ๐โจ #ThreatIntel
According to @GovCERT_CH , an unknown threat actor has sent out postal letters (yes, *postal* letters โ๏ธ) to recipients in Switzerland that pretend to originate from @meteoschweiz, luring the recipient into downloading and installing a rogue App ๐ฅ๐ต๏ธโโ๏ธ
The QR code in the letter leads to a malicious App that impersonating the "AlertSwiss" App of the federal administration. However, the App in fact is a version of Coper (aka Octo2) #malware, infecting mobile phones running Android ๐ฑ๐ค
Payload delivery URL:
๐ https://t.co/vzAGBkVnLw
Malware sample:
๐ https://t.co/lE9k6fcMbR
Coper botnet C2:
๐ฅ https://t.co/91aVy0Lj9X
โก https://t.co/df528E4EVm
I wrote a blog post about MalpediaFLOSSed, a collection of ~4 million strings extracted from 1800+ malware families and upgrading its GUI plugin to work with IDA, Ghidra, and Binary Ninja at once!
Kudos to @hyun____22 for Hyara, which pioneered such cross-tool compatibility!
@Artilllerie@malwrhunterteam@JAMESWT_MHT Nice catch! There is indeed a DGA behind the .life domain names, but for now they use a time-independent seed. https://t.co/uDcLWdb9KX
@joyofcodedev Very nice! @Rich_Harris also created an emoji matching game for his excellent "Svelte Fundamentals" course on @FrontendMasters. His course is paywalled, but you find the game on Vercel / GitHub.
๐ฎ: https://t.co/DGA1DG0RqJ
๐บ: https://t.co/fGCzDyqk4H
๐: https://t.co/H5gYxXhLxs
@_mostwanted002_ This is the #khalesi info stealer. The DGA picks 10 random alphanumeric characters with a common Mersenne Twister implementation. Unfortunately, the seed is just the current tick count, so unpredictable for both the attackers and analysts.
#BinaryRefinery 0.5.10 can deobfuscate this sample with little effort. Only had to add one new unit for StrReverse constant folding. Not a silver bullet, obviously, but why write those regular expressions yourself when you can make me do it for you?
๐ ๏ธ .NET malware decompiling challenges: Obfuscations of strings/constants can be tedious. Automate w/ IDA Pro's Python ๐ interface for MSIL binary patching, even for simple cases: https://t.co/CDLfXbfmg8
#CyberSecurity#MalwareAnalysis#IDAPro#DotNET
New video on the Domain Generation Algorithm of the file infector m0yv. We've sinkholed multiple domains & show how infections dramatically increased in the last 400+ days ๐. #m0yv#DGA
https://t.co/OW3P0tk05s
Just updated the "malwarebazaar" Python module to include a Python and CLI client for @abuse_ch#YARAify and added a "richer" output. You can find it on Github (https://t.co/xOj5B6JkmD) and on PyPI (via "malwarebazaar").
#threatintel#malware