Johannes Bader

Reverse engineer / malware analyst. On the hunt for domain generation algorithms. Current side project:

[Johannes Bader @viql]

@abuse_ch @andretavare5 Why not 429 (too many requests)?

[Johannes Bader @viql]

@500mk500 👍 Thanks for the suggestion, I just added the blog

[Johannes Bader @viql]

Today, I'm releasing the first version of a small web 🚀: https://t.co/WZMsLWpGEK

It provides IOCs and YARA rules collected semi-automatically from public blog posts and reports of almost 200 cybersecurity sites.

I hope it proves useful to some of you ... 🙏✨ #ThreatIntel

[Johannes Bader @viql]

@Cthulhu_Answers 🤣 No def not, Sorry! Should be fixed now.

[abuse.ch @abuse_ch]

According to @GovCERT_CH , an unknown threat actor has sent out postal letters (yes, *postal* letters ✉️) to recipients in Switzerland that pretend to originate from @meteoschweiz, luring the recipient into downloading and installing a rogue App 🔥🕵️‍♂️

The QR code in the letter leads to a malicious App that impersonating the "AlertSwiss" App of the federal administration. However, the App in fact is a version of Coper (aka Octo2) #malware, infecting mobile phones running Android 📱🤖

Payload delivery URL:
🌐 https://t.co/vzAGBkVnLw

Malware sample:
📄 https://t.co/lE9k6fcMbR

Coper botnet C2:
🔥 https://t.co/91aVy0Lj9X

➡ https://t.co/df528E4EVm

[Jesko Hüttenhain @huettenhain]

What's happening? #FlareOn11 is happening! Time to update #BinaryRefinery and snag some flags!
✨ https://t.co/E20pgo1E4d
✨ https://t.co/EnGsAnDvEm

[ThreatCat.ch @threatcat_ch]

We're proud to be a @Quad9DNS partner, helping make the Internet a safer place!

[Johannes Bader @viql]

@BlakeDarche @Cloudflare Great, thank you very much.

[Johannes Bader @viql]

Could you please share your IOCs in any format that is NOT low screenshots @Cloudflare 🙏?

https://t.co/sZvC8jecBn

[abuse.ch @abuse_ch]

Nice #MooBot botnet caught by @banthisguy9349 😂

Botnet C2 domain:
🔥 putin.zelenskyj .ru

Pointing to:
45.88.90.30:43957 (AS203168 Constant MOULIN 🇧🇪)

DNS resolution provided by Cloudflare 🔎

Payload URLs:
🌐 https://t.co/ToX5LhAIwp

Payload:
📄 https://t.co/SilCChmsW4

[Daniel Plohmann @push_pnx]

I wrote a blog post about MalpediaFLOSSed, a collection of ~4 million strings extracted from 1800+ malware families and upgrading its GUI plugin to work with IDA, Ghidra, and Binary Ninja at once!

Kudos to @hyun____22 for Hyara, which pioneered such cross-tool compatibility!

[Johannes Bader @viql]

@Artilllerie @malwrhunterteam @JAMESWT_MHT Nice catch! There is indeed a DGA behind the .life domain names, but for now they use a time-independent seed. https://t.co/uDcLWdb9KX

[Johannes Bader @viql]

@joyofcodedev Very nice! @Rich_Harris also created an emoji matching game for his excellent "Svelte Fundamentals" course on @FrontendMasters. His course is paywalled, but you find the game on Vercel / GitHub.

🎮: https://t.co/DGA1DG0RqJ
📺: https://t.co/fGCzDyqk4H
📄: https://t.co/H5gYxXhLxs

[ThreatCat.ch @threatcat_ch]

New blog post: https://t.co/xI4rW74gfq #nuclei

[Daniel Plohmann @push_pnx]

I wrote a short blog post on MCRIT, the one-to-many code similarity analysis framework that we released as open source recently at @Botconf.

[Johannes Bader @viql]

@_mostwanted002_ This is the #khalesi info stealer. The DGA picks 10 random alphanumeric characters with a common Mersenne Twister implementation. Unfortunately, the seed is just the current tick count, so unpredictable for both the attackers and analysts.

[Jesko Hüttenhain @huettenhain]

#BinaryRefinery 0.5.10 can deobfuscate this sample with little effort. Only had to add one new unit for StrReverse constant folding. Not a silver bullet, obviously, but why write those regular expressions yourself when you can make me do it for you?

[ThreatCat.ch @threatcat_ch]

🛠️ .NET malware decompiling challenges: Obfuscations of strings/constants can be tedious. Automate w/ IDA Pro's Python 🐍 interface for MSIL binary patching, even for simple cases: https://t.co/CDLfXbfmg8
#CyberSecurity #MalwareAnalysis #IDAPro #DotNET

[ThreatCat.ch @threatcat_ch]

New video on the Domain Generation Algorithm of the file infector m0yv. We've sinkholed multiple domains & show how infections dramatically increased in the last 400+ days 📈. #m0yv #DGA

https://t.co/OW3P0tk05s

[Nils Kuhnert @0x3c7]

Just updated the "malwarebazaar" Python module to include a Python and CLI client for @abuse_ch #YARAify and added a "richer" output. You can find it on Github (https://t.co/xOj5B6JkmD) and on PyPI (via "malwarebazaar").
#threatintel #malware