void m4p()

Holistic Malware Analyst. Opinions here are my own. Follow me on [email protected]

[void m4p() @voidm4p]

Just released an old python script that I made to extract #Formbook C2 url using @radareorg. Based on work from @netsecurity1 and @tildedennis. https://t.co/oxJL3TNizx

[void m4p() @voidm4p]

Hey @CapeSandbox can you activate my account? Same user as here :)

[void m4p() @voidm4p]

@naumovax This is actually a downloader, the real Grandoreiro payload are those fake XML which are compressed files ciphered with a rc4 mod version

[Centro Criptológico Nacional @CCNCERT]

Continuamos en la Sala Rooted con la ponencia "From Brazil With Love: Grandoreiro al microscopio" a cargo de Mariano Palomo Villafranca (@voidm4p) de @InnotecSecurity, Part of Accenture #STICPANAMÁ

[void m4p() @voidm4p]

@1ZRR4H El ZIP devuelto por la URL de Azure va cambiando. El C2 que trae el EXE que del ZIP que yo obtuve es health.health-carereform[.]com que resuelve a 18.230.211[.]48 por lo que el puerto es 4318. Si se le manda la petición GET correspondiente devuelve el payload final (cifrado RC4)

[void m4p() @voidm4p]

@1ZRR4H @CFEmx @CFE_Contigo @malwrhunterteam @JAMESWT_MHT @pr0xylife ¿Alguna forma de compartir info sobre las URL de descarga de ZIP que dirigen a Dropbox?

La muestra lleva como C2 el dominio camerahousebusiness.dvrcam[.]info aunque como ya no resuelve IP, no es posible obtener el puerto de conexión ni la URL de descarga del payload final.

[void m4p() @voidm4p]

@P4nch019 El comando “file” dice que es WinHKI pero para ser más precisos es un formato propio creado mediante la librería FlexCompress de Delphi. Si se abre con la utilidad “FlexCompress Archiver” y la pass embebida (cifrada) en el downloader, se puede extraer el payload

[EuskalHack @EuskalHack]

¡Comienza la charla patrocinada de Entelgy @InnotecSecurity sobre “Reversing vs desarrollo de malware: ¿Ratón o gato?”, presentada por Mariano Palomo! Las técnicas de ofuscación y evasión en el malware actual desde dos perspectivas: analista de malware y desarrollo de código.

[void m4p() @voidm4p]

@malwrhunterteam @JAMESWT_MHT @demonslay335 Ohh sorry, I get it now! Unfortunately looks like TrendMicro keep it for themself... Yep, I noticed it that one was Babuk, maybe it's the same for the Windows variant too. Thanks for sharing the Linux hash btw :)

[void m4p() @voidm4p]

Does anyone have a sample of "White Rabbit" ransomware used by RansomHouse that can share with me? I only found a hash on a TrendMicro analysis but it's not even published on VT so I can't download it. @malwrhunterteam @JAMESWT_MHT @demonslay335

[void m4p() @voidm4p]

@malwrhunterteam @JAMESWT_MHT @demonslay335 In this link of a TrendMicro analysis you can check there's actually a Windows version. Ransom note is quite similar to the Linux one with the same "Knock, knock" message. https://t.co/5F74ISzWr3

[void m4p() @voidm4p]

@malwrhunterteam @JAMESWT_MHT @demonslay335 Thank you! Looks like this is the Linux "Mario ESXi" ransom version right? I was searching for the "White Rabbit" for Windows which is also linked to FIN8 https://t.co/5F74ISzWr3

[RedPacket Security @RedPacketSec]

If anyone gets hold of #LockBit 3.0 samples or hashes please let me know

[void m4p() @voidm4p]

@angelmartin_nc Con qué programa creas los subtítulos?

[void m4p() @voidm4p]

Analizando el troyano bancario brasileño #Numando y ampliando la información compartida por @ESET @ESET_ES https://t.co/0MbLGT5l1O #reversing #IDAPro @InnotecSecurity

[void m4p() @voidm4p]

@310hkc41b Yo hago eso mismo pero desde el propio Host y con la VM de Android Studio. Con este parámetro le dices que te dirija el tráfico al puerto donde tengas BURP y ya solo tienes que instalar el certificado para que pueda acceder a HTTPS también

[void m4p() @voidm4p]

@apkdetect @malwrhunterteam @0xabc0 @alberto__segura @sS55752750 @B0rys_Grishenko Hi! Is there any way to access to your platform? I sent you an email a few days ago about it

[void m4p() @voidm4p]

Hey @LloydLabs! Check DM 🙏🏻

[void m4p() @voidm4p]

@AGertani I think it’s more than an anti-analysis technique. With this trick they trigger an exception and they have a custom handler function which they use to call to the “Call API By Hash” resolved API

[void m4p() @voidm4p]

@CapeSandbox Thanks guys! Still waiting to get it activated. Username is: voidm4p 🙏

[void m4p() @voidm4p]

@CapeSandbox Hi, is it possible to activate my username so I can access? (Same handle I'm using here)