Just published a deep dive into APT27 (Emissary Panda/Iron Tiger/Lucky Mouse), a Chinese state-sponsored cyber-espionage group active since 2010, known for spear-phishing, watering-hole attacks and exploitation of internet-facing applications. dexpose.io/threat-actor-prof…

Open directory spotted: 20.243.255[.]185 Hosting multiple suspicious files, including: shell_le: Metasploit ELF payload - recently submitted to VirusTotal. true.png: PNG file with embedded VBScript (1/61 on VT) - recently submitted to VirusTotal main_mips: ELF binary flagged by THOR APT Scanner related to github.com/Enelg52/KittyStag… (0/64 on VT) CVE-2021-3156. zip: weaponized Sudo exploit @500mk500 @ViriBack @JAMESWT_WT @skocherhan @1ZRR4H #opendir #CTI

#clickfix #booking #fakecaptcha bokparthub[.]click → (Under Construction) apartmenr-di16[.]click → PowerShell (files.catbox.moe/09fd7c[.]tx…) → LightYellow4.zip → LightYellow4.pfx Hex-based ZIP reconstructed → payload cleaned → executed via regsvr32.exe abuse (LOLBins)

38[.]54[.]50[.]57 --> 1/94 156[.]244[.]19[.]218 --> 1/94

95[.]196[.]78[.]150 --> 0/94 206[.]72[.]192[.]71 --> 0/94 91[.]195[.]240[.]123 --> 9/94

just hunted down fresh undetected & low detected APT43 (kimsuky) infra by pivoting using HTTP header analysis and SSL JARM fingerprinting 162[.]220[.]11[.]84 --> 0/94 194[.]63[.]129[.]86 --> 0/94 3[.]89[.]115[.]251 --> 0/94 110[.]142[.]212[.]109 --> 1/94 More IOCs in replies

FExcited to share that ANY.RUN now supports Android OS inside its interactive sandbox! You can analyze APK behavior in real time, right in the cloud. 🔥 Available for ALL plans (yes, even free!). 📷 Let’s check it out together! app.any.run/?utm_source=x_co…

#ANYRUN just released Safebrowsing — a new service that lets you quickly explore URLs in an isolated virtual browser 🔥 📷 It notifies you about threats and has a friendly interface Give it a try, it's free 📷👉 app.any.run/?utm_source=ally…

My birthday gift arrived today! Thank you so much, @binaryz0ne, for this amazing gift ❤️❤️ I absolutely love the design, @hasherezade!

A year has passed, and it has been an exceptionally wonderful one. Thank you to everyone who has helped me; I am truly grateful.

For Android/iOS malware analysts👾 If you are using a Windows host machine and want to use Medusa (a tool for unpacking and other tasks), you will face problems because Medusa does not support Windows. You can install WSL (Windows Subsystem for Linux) and then run Medusa easily.

I recently wrote a tutorial for setting up an ARM Android virtual machine on an x86 host machine. m4lcode.github.io/tutorials/…

I've recently written a blog post analyzing malicious macros in Office documents. The threat actors used social engineering techniques to persuade the victim to enable the macros of the document. blog.cyber5w.com/analyzing-m…

Recently, I have written a detailed analysis of Gafgyt backdoor. Through this analysis, I uncovered the multifaceted functionalities of Gafgyt, shedding light on its modus operandi and potential cybersecurity threats. blog.cyber5w.com/gafgyt-back… 1/2

I recently conducted an in-depth analysis where I deobfuscated three JavaScript malwares, each employing distinct obfuscation technique commonly encountered in the wild. blog.cyber5w.com/javascript-…

الحمد لله malpedia added my report to their collection🥳

I have solved "Obfuscated" challenge from Cyber Defenders Category: malware analysis I also wrote a write-up in my techincal blog m4lcode.github.io/malware%20…

Hi folks, This is my first technical analysis report.👾 It's about Vidar stealer with IOCs I hope you find it enjoyable, and I'm eager to hear your thoughts on it.❤️ m4lcode.github.io/malware%20…