Malware News

2022-02-26 14:20:14 I was honored to present on Program Analysis with Ghidra for @sergeybratus's @DartmouthCS course, "Basics of Reverse Engineering" yesterday -

Basic program analysis concepts, Ghidra API tour, demo code, SLEIGH, and opinionated takes on RE -

Slides:



https://github.com/sergeybratus/RE-basics-W22/blob/main/GHIDRA-For-Dartmouth.pdf
0xAlexei


@malwr Open / Comment

2022-02-26 13:29:29 #HermeticWiper is a #malware targeting #Ukraine by wiping every machine disk on its path. Here the @zlab_team dissection and analysis
https://yoroi.company/research/diskkill-hermeticwiper-a-disruptive-cyber-weapon-targeting-ukraines-critical-infrastructures/
Marco_Ramilli


@malwr Open / Comment

2022-02-25 20:03:20 If you're looking at #Golang binaries in IDA @SentinelOne's is by far one of the most useful tools. (cc: @LabsSentinel, @juanandres_gs @JusticeRage )
https://github.com/SentineLabs/AlphaGolang
silascutler


@malwr Open / Comment

2022-02-25 20:00:01 A Detailed Analysis of the LockBit Ransomware : https://lifars.com/wp-content/uploads/2022/02/LockBitRansomware_Whitepaper.pdf (pdf)
binitamshah


@malwr Open / Comment

2022-02-25 19:58:54 The Bvp47 - a Top-tier Backdoor of US NSA Equation Group : https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf (pdf)
binitamshah


@malwr Open / Comment

2022-02-25 19:54:43 @Namecheap pls revoke the deceptive #phishing domain targeting Iranian Supreme Court and spreading malicious apk

/edu-center.eu/مشاهده_ابلاغیه.apk

#malware
illegalFawn


@malwr Open / Comment

2022-02-25 19:47:41 #Emotet 2022-02-23 The Top 30 domains statistic
On the Top 30 there are a lot of generic domains (like gmail etc), but also corporate domains. In the Real Sender there are russian domains...

@58_158_177_102 @sugimu_sec @ValeryMarchive @guelfoweb @bomccss
VirITeXplorer


@malwr Open / Comment

2022-02-25 19:33:02 #Emotet strikes with new TTPs

Project X elevated to Project Y

#DFIR analysis report covers the new infection flow:

Initial Access
Execution
Privilege Escalation
Persistence
Defense Evasion
https://www.cynet.com/attack-techniques-hands-on/new-wave-of-emotet-when-project-x-turns-into-y/
Max_Mal_


@malwr Open / Comment

2022-02-25 18:59:51 Threat updates – A new IcedID GZipLoader variant

https://threatray.com/blog/a-new-icedid-gziploader-variant/

Sent from one of our channel members


@malwr Open / Comment

2022-02-25 17:47:28 Make a USB Rubber Ducky with less than $3

'The best thing is, USB Rubber Ducky is not detected as a flash drive, but as a keyboard.'

#infosec #redteam #pentest

https://infosecwriteups.com/make-usb-rubber-ducky-with-less-than-3-fa72dac9e4de
CyberWarship


@malwr Open / Comment