Malware reverse engineer, Cryptolaemus member Mastodon: @FirehaK@infosec.exchange
Joined May 2012
- Tweets659
- Following389
- Followers304
- Likes2.1K
Stephan (@[email protected]) retweeted
We've preserved (yet another) lot of eleven test cartridges for the Nintendo DS, DSi, and 3DS! Included are some never-before-seen pieces of test software, as well as new versions of previously discovered ones! Thanks to those who contributed: March42, Kc57, Haifisch, and XX_75.
Stephan (@[email protected]) retweeted
Check out my latest blog post about Cova loader and Nosu stealer. These two went unnoticed... but only until now :) bitsight.com/blog/cova-and-n…
Stephan (@[email protected]) retweeted
Everyone: Signs in every day to watch Elon slowly running Twitter into the ground.
Elon:
Stephan (@[email protected]) retweeted
I've joined the cool kids club @[email protected]
Leave your handle below 👇
#mastodonmigration #Mastodon
Stephan (@[email protected]) retweeted
We are also hunting mealybugs(emotet) and other crimeware actors on Mastodon. Come say hello and give us more things to eat. infosec.exchange/@cryptolaem…
Stephan (@[email protected]) retweeted
Main concern w/ the new Twitter Blue offering is the verified logo has been a marker of trust I.e., “we’ve confirmed the person is who they say they are.” Now it’s “we’re taking their $ & their word for it.” On the cusp of election where source of info is critical, a major risk.
To think that simple payment verifying will pose any sort of meaningful barrier to sophisticated actors on the platform is just not anchored in reality. Agree w/ @ianbremmer
Stephan (@[email protected]) retweeted
To think that simple payment verifying will pose any sort of meaningful barrier to sophisticated actors on the platform is just not anchored in reality. Agree w/ @ianbremmer
Stephan (@[email protected]) retweeted
You can self-host a Mastodon server
Stephan (@[email protected]) retweeted
Reminder: We are constantly pushing new C2s/Distro URLs/Payload URL/samples to the abuse.ch ecosystem. Please see our submissions at
bazaar.abuse.ch/
feodotracker.abuse.ch/
threatfox.abuse.ch/
urlhaus.abuse.ch/
for more details and info.
Stephan (@[email protected]) retweeted
We have been busy and improved MalwareBazaar's archive parsing 🆕⬇️
The password of PW protected archives is now guessed from the tag list provided 🔐 E.g.:
👉 bazaar.abuse.ch/sample/ddfde…
We have also implemented a feature to de-pump pumped files 📄 E.g.:
👉 bazaar.abuse.ch/sample/0819f…
ALT MalwareBazaar's password guessing for PW protected archives in action
ALT MalwareBazaar's de-pumping functionality in action, de-pumping unnecessary large files
Stephan (@[email protected]) retweeted
Okay, so a few people have asked how you spot the where your Trust Thermocline is, and how to avoid hitting it. I'll give you the same answer I give senior execs:
I don't know.
But the people working on the ground level in the customer-facing sections of your company do. /1
Stephan (@[email protected]) retweeted
One of the things I occasionally get paid to do by companies/execs is to tell them why everything seemed to SUDDENLY go wrong, and subs/readers dropped like a stone.
So, with everything going on at Twitter rn, time for a thread about the Trust Thermocline /1
Stephan (@[email protected]) retweeted
I know what I'm doing, but I also have no idea what I'm doing.
Stephan (@[email protected]) retweeted
Rest in peace, Vitali. Our thoughts and prayers are with your family and friends.
Thanks for all you did for the cybersecurity community.
Stephan (@[email protected]) retweeted
Binary Ninja 3.2 is live! binary.ninja/2022/10/28/3.2-…
Biggest list of fixes and features yet. Check out windows improvements, decompiler improvements, memory map, ObjC support and many many others.
Stephan (@[email protected]) retweeted
In case you missed it, gave a talk on #smokeloader! Went over my process for extracting configuration, general reverse engineering and protocol emulation youtube.com/watch?v=O69eMQ7N…
Stephan (@[email protected]) retweeted
The use of new & Emotet here is not justified. The samples & emails were from May-June. Despite the subject, in the article Trustwave was only claiming that these were LIKE Emotet's distribution of password protected ZIPs & not FROM Emotet's botnet. trustwave.com/en-us/resource…
#Emotet botnet has been linked to a new wave of malspam campaigns that exploit self-unlocking password-protected archive files to drop CoinMiner and Quasar RAT on compromised systems.
Read: thehackernews.com/2022/10/em…
#infosec #cybersecurity #hacking
Stephan (@[email protected]) retweeted
Take a look at this message I received – because of student loan forgiveness, Americans will be able to crawl out from under unsustainable debt and finally start thinking about saving for their first home.
ALT Text: Thank you Mr. President. At 51 years old, my husband and I can finally start saving for our first home. ❤️
Stephan (@[email protected]) retweeted
Congresswoman Marjorie Taylor Greene had $183,504 in PPP loans forgiven.
teapawt.net/Acyn/status/1562530929…
