@Lexsek_

Reverse Engineer | Malware Research | Forensics

Joined June 2017
  • Tweets307
  • Following243
  • Followers390
5Media
New variant of #Emmenhtal loader actively distributed since early December and leading to #Lumma #DarkGate and/or #SectopRAT. 🚩#Emmenhtalv2 adopts new obfuscation features and is currently not well detected by AV solutions. Initial access: fake CAPTCHA, #ClickFix, phishing.
2
8
14
2,248
Our CTI analysts @Mar_Pich and @Lexsek_ just released their investigation into #Emmenhtal 🪼🧀, a loader which has been distributing +10 different infostealers since early 2024. This research is based on real-life incidents from our #CyberSOC. 🔗tinyurl.com/2kxua23r
1
12
21
2,836
Lexsek retweeted
Jl_N_@Jl_N_17 Jul 2024
Nous recrutons dans notre équipe. Si vous avez des compétences en RE, souhaitez travailler au profit de la Gendarmerie en tant qu'expert judiciaire et manager une équipe de passionnés : ministereinterieur-career.ta… (rt apprécié)
10
5
1,409
Understanding Windows x64 Assembly sonictk.github.io/asm_tutori…
2
85
284
20,531
Look what I just received 😊. Thanks a lot @DarkCoderSc @fr0gger_ for the kind message and this beautiful coin, really appreciate the gesture. Does the Ronflex Pokemon's card mean I need to take some rest and sleep more ? 😅
1
3
815
Let's explore the link between #Rhadamanthys stealer and #HiddenBee coin miner! In our latest blog, @hasherezade walks you through the custom executable formats, evolution, and features of this interesting, multilayer malware toolkit. research.checkpoint.com/2023…

From Hidden Bee to Rhadamanthys - The Evolution of Custom Executable Formats - Check Point Research

Research by: hasherezade Highlights Introduction Rhadamanthys is a relatively new stealer that continues to evolve and gain in popularity. The earliest mention was in a black market advertisement in...

research.checkpoint.com
4
75
3
171
120,568
The slides botconf.eu/wp-content/upload… and video youtube.com/watch?v=713CsmcN… of my #Botconf talk about #IronTiger TTPs are online. I discuss recent infection vectors (supply chain attack), the evolution of their malware toolkit and targeting, and our attribution methodology #APT #APT27
2
48
3
102
16,138
So far I've written 559 pages to help the security community: 1. exploitreversing.com/2021/12… 2. exploitreversing.com/2022/02… 3. exploitreversing.com/2022/05… 4. exploitreversing.com/2022/05… 5. exploitreversing.com/2022/09… 6. exploitreversing.com/2022/11… 7. exploitreversing.com/2023/01… 8. exploitreversing.com/2023/04…

Malware Analysis Series (MAS) – Article 1

The first article of MAS (Malware Analysis Series) is available for reading from: (link): Soon I have enough time, so I’ll publish an HTML version of it. Have an excellent day. Alexandre Borg…

exploitreversing.com
34
388
6
1,235
100,692
We are at @Botconf ! Our teammates Jeremie and @Lexsek_ present this morning an incident response case related to RansomCartel 🙌 #ransomware #raas #botconf23
4
1
16
2,123
New release: #TinyTracer v2.3 : github.com/hasherezade/tiny_… - with improved syscalls tracing support - now syscalls are automatically mapped to corresponding functions names
7
155
2
482
74,005
🧵Thread: 10 underestimated resources about malware techniques. This is a list of various resources to learn more about malware techniques, how to analyse them and how to improve your detection! 🤓 #infosec #malware #threatintel #malwareanalysis #cybersecurity
8
115
4
307
For a reverse engineer, the ability to directly call a function from the analyzed binary can be a shortcut that bypasses a lot of grief. In this article, we explore and compare 3 ways of invoking functions: IDA Appcall, Dumpulator, and Unicorn Engine. research.checkpoint.com/2022…

Native function and Assembly Code Invocation - Check Point Research

Introduction For a reverse engineer, the ability to directly call a function from the analyzed binary can be a shortcut that bypasses a lot of grief. While in some cases it is just possible to...

research.checkpoint.com
120
3
319
At the crossroads between pentest and incident response, we wondered what traces attackers really leave when they lateralize. Our latest blogpost tries to answer the question on Windows systems. synacktiv.com/publications/t… #DFIR

Traces of Windows remote command execution

Traces of Windows remote command execution

synacktiv.com
30
53
New blog post about an UEFI firmware bootkit! securelist.com/cosmicstrand-… Research was led by our dearly missed @_marklech_

CosmicStrand: the discovery of a sophisticated UEFI firmware rootkit

In this report, we present a UEFI firmware rootkit that we called CosmicStrand and attribute to an unknown Chinese-speaking threat actor.

securelist.com
1
118
7
252
After a few months of work, we are pleased to announce the new version of Unprotect: your catalog of malware evasion techniques!🤩🧵👇 #unprotectproject #infosec #malware #cybersecurity @DarkCoderSc unprotect.it
8
107
2
218
New technique added into #UnprotectProject by @Lexsek_ "FLIRT Signatures Evasion", interesting technique to hide malicious code inside function that would be recognised as a legitimate library!🤩 #infosec #malware #threathunting cf:@DarkCoderSc unprotect.it/technique/flirt…
2
17
39
Here are 11 reasons why we should use #HyperDbg, the differences between HyperDbg and #WinDbg, and how HyperDbg will change our debugging/reversing journey. A thread (24 tweets) 🧵:
13
98
4
323
Time Travel Debugging for #IDA !!! github.com/airbus-cert/ttddb… #SSTIC. Thanks @commial !!!

GitHub - airbus-cert/ttddbg: Time Travel Debugging IDA plugin

Time Travel Debugging IDA plugin. Contribute to airbus-cert/ttddbg development by creating an account on GitHub.

github.com
2
100
3
236
The third article in the Malware Analysis Series (MAS) is available for reading on: exploitreversing.com/2022/05… Next week I'll release the fourth article. Have an excellent day. #malwareanalysis #reverseengineering #reversing #programming
5
193
3
494
If you analyze HermeticWiper ( 61b25d11392172e587d8da3045812a66c3385451) and you are a beginner to malware RE, be careful to your sample name. Sometimes, it breaks or modifies the behavior of the malware. #HermeticWiper #malware
2
33
2
131
Load more