x3ph

Hack and Hack again..

Won Top 3 in the HackTheBox ValentinesDay Tournament.
Won Top 100 in the HacktheBox Cyber Apocalypse event.

[x3ph @x3ph1]

@vxunderground Solid points and I agree.

[x3ph @x3ph1]

@vxunderground Indeed

[x3ph @x3ph1]

@vxunderground @nikhil_mitt @struppigel I am not picky, and hello

[x3ph @x3ph1]

@vxunderground An meowvil act indeed. How on earth are we supposed to defend against such a high-skill cattack? Our furwalls clearly aren’t enough. 😔

[Jord @0xLegacyy]

gdbw v0.1.0 is released! 🥳

Currently working on the wiki to get everything documented, go try it out!
https://t.co/JHbp6OJuJN

[Jord @0xLegacyy]

gdbw v0.1.0 releasing tomorrow! 🐸

Still a lot to add but hoping to get it into user's hands sooner so that we can figure out pain points etc.

[Jord @0xLegacyy]

Excited to be teaching ARTOC @defcon this year!

Focused on modern tradecraft, tooling development, and building real skills from preparation to execution of real-world adversary emulation engagements.
#DEFCON #redteam

[Jord @0xLegacyy]

BOF is out now, enjoy! 🐸
https://t.co/qbukYjAe9S

[Jord @0xLegacyy]

Blog post is out, BOF coming tomorrow 🐸

https://t.co/NjPqs5NdyU

[x3ph @x3ph1]

@Gi7w0rm @CISAgov @CISAJen Awesome work as always 👌

[x3ph @x3ph1]

@luke92881 @SquiblydooBlog @JAMESWT_MHT @SebastianWalla @AnFam17 @osipov_ar I've seen this before and I had issues retrieving the script prior due to AV, but thank you for the sample. I got the the remaining pieces to the puzzle now. If you need the decryption method, its there for you.
https://t.co/Hg00ie6bGz

[x3ph @x3ph1]

@nosecurething Observed four hits so far, but different dir path. In the process of retrieving the file atm. Hashes were all the same.

profile\AppData\Local\Installinipsk\avolkov.exe
d75680a5fcfd6839d40e5b4e379726ec0c01278709265ace4f1ba7327886b41c

[x3ph @x3ph1]

@th3_protoCOL Any sandbox of the initial delivery mechanism that created this scheduled task? I am the threat actor may have taken a similar approach as to using an ISO to deliver the executable. Upon investigation, I did not see any signs of mounting of ISO or executable as of yet. 1/2

[x3ph @x3ph1]

@Kostastsale @th3_protoCOL @cbecks_2 I've been downloading this big ol pw stealer for the past 15 minutes 🤣

[x3ph @x3ph1]

@DrStache_ @pr0xylife @ankit_anubhav @Max_Mal_ @1ZRR4H @Ledtech3 thank you for sharing this🙏

[x3ph @x3ph1]

@LetsDefendIO awesome ty for sharing 🙏

[x3ph @x3ph1]

@ankit_anubhav @pr0xylife @Max_Mal_ @1ZRR4H @Ledtech3 Ah, I miss-read that, great thank you.

[x3ph @x3ph1]

@infosec_au @Hacker0x01 Great job @infosec_au! Your hard work paid off🏆

[x3ph @x3ph1]

@JAMESWT_MHT @malwrhunterteam @ffforward @pr0xylife @guelfoweb @FBussoletti @VK_Intel @Cryptolaemus1 @sugimu_sec @lazyactivist192 @fr0s7_ @struppigel Thank you for sharing this information