Threat Intel as a reverse-engineer in Crimeware domain. Dubbed "Malware Mangler" by TheRegister. [email protected]
Joined August 2016
- Tweets959
- Following760
- Followers4.3K
- Likes732
sysopfb retweeted
Shodan Membership sale is live until 2026-08-09 00:00 UTC (~48 hours from now): account.shodan.io/billing/me…
sysopfb retweeted
So, let's talk about MetaStealer and make sure I'm not delusional.
The actual MetaStealer is a .NET stealer I blogged about a while back: russianpanda.com/MetaStealer…. Its seller, "META", stopped updating it around 2022 and pretty much disappeared.
The malware AVs have been flagging as "MetaStealer" is NOT that MetaStealer: virustotal.com/gui/file/0583…
What we're actually seeing is ongoing updates (since 2023) to the loader I named Potemkin: huntress.com/blog/potemkin-l…
Turns out it was documented earlier under the MetaStealer name, kudos to @banthisguy9349 for surfacing these:
medium.com/walmartglobaltech…
blog.defentive.com/the-phant…
sysopfb retweeted
Cool find from @sysopfb here is a couple of Images from the Panel, This specific panel was delivering a MacOS stealer notnullOSX
http.html:"notnullOSX " - Shodan Search
http://111.90.]143.163:8080/install
Nice writeup rmceoin.github.io/malware-an… Of note is a panel: hxxp://65.38.120.]80:8080 they left some tidbits behind in the login page: <<label>Пул доменов (по одному на строку)</label>"oeannon.]com heethcote.]com windlrr.]com"
sysopfb retweeted
A GitHub repo containing victim data, product manuals and more of IT security company i-Soon claims the company targeted Southeast and East Asian governments. Given this uncommon perspective into Chinese hackers, we detail our key takeaways. bit.ly/4bRiSu4
ALT A pictorial representation of i-Soon's data leaks. A world map with location markers. Around it are icon of types of attacks: bugs, hacking, and other indicators of tools such as graph
sysopfb retweeted
hi e-friends, i'm looking for a new role. most of my background is in threat research/hunting/intelligence, with a focus on RE and detections. i enjoy building systems to automate this work and especially enjoy being able to share that work and give a bit back to the community.
sysopfb retweeted
@0verfl0w_ was kind enough to share it on our channel, if you like this video, checkout his malware analysis course Zero2Auto.
Get 10% with our coupon code: GUIDEDHACKING
Use this link and it will be applied automatically: courses.zero2auto.com/?coupo…
sysopfb retweeted
About 5 years ago I started wondering if a malware C2 channel existed that embedded messages and data payloads inside the x509 cert used for the TLS handshake. I searched but never found this in the wild so this year I decided to write it myself.
github.com/jconwell/secret_h…
sysopfb retweeted
Additionaly you can also use @shodanhq for Hunting Sliver C2 Infrastructure
ssl:multiplayer ssl:operators
shodan.io/search/facet?query…
ssl:multiplayer ssl:operators ssl.jarm:"00000000000000000043d43d00043de2a97eabb398317329f027c66e4c1b01"
shodan.io/search?query=ssl%3…
sysopfb retweeted
#SearchAndRescue @USCG crews are searching for 36-year-old Vitali Kremez, last seen wearing a black wetsuit and scuba tank while diving near #HollywoodBeach, Florida.
Anyone with information is asked to call Sector Miami at (305) 535-4472.
sysopfb retweeted
🚨 Takedown of SMS-based FluBot spyware 🚨
🔹 International law enforcement operation involving 11 countries 🌍🚔
🔹 Fastest-spreading mobile malware to date ⏩📱
🔹 The Android malware has now been rendered inactive ✋🛑
More ➡️ europol.europa.eu/media-pres…
sysopfb retweeted
We actually released a decryptor for Diavol last month, with help from @sysopfb and the threat intel team @walmart. 2/2
teapawt.net/emsisoft/status/150488…
.
We've released a decryptor for #Diavol #ransomware, which is believed to be associated with the Russia-based #Trickbot Group. Big thanks to @sysopfb and the threat intel team @walmart. #NoMoreRansom 1/3
emsisoft.com/ransomware-decr…
sysopfb retweeted
The Week in Ransomware - March 18th 2022 - Targeting the auto industry - @LawrenceAbrams
bleepingcomputer.com/news/se…
sysopfb retweeted
We've released a decryptor for #Diavol #ransomware, which is believed to be associated with the Russia-based #Trickbot Group. Big thanks to @sysopfb and the threat intel team @walmart. #NoMoreRansom 1/3
emsisoft.com/ransomware-decr…
sysopfb retweeted
Sad that I got beat to posting about this publicly after looking at it on and off since October, but there are a lot of great details in here about a previously unknown botnet written in Go! Here are some screenshots (including the operator's desktop) I had as well!
Following up on @Intel471Inc recentl report on PrivateLoader we also found another loader being leveraged - Calls itself "Anubis" Loader and is written in GoLang medium.com/walmartglobaltech…
sysopfb retweeted
📚Let's Learn:
⚡️Our Favorite Course "Zero2Automated" delving deeper into malware analysis/RE mastery is available for using the code BLACKFRIDAYSALE⏳
📌eg
TrickBot: Hacking Domain Network
Active Directory Enumeration & Harvesting
courses.zero2auto.com/?coupo…
@0verfl0w_ @sysopfb
sysopfb retweeted
It's that time of year again! For a limited time you can grab all variants of Zero2Auto for 20% off using the code BLACKFRIDAYSALE 🎉 just click the link down below to auto-apply it! Discount is valid until 23:59 GMT on CyberMonday!
courses.zero2auto.com/?coupo…
cc @VK_Intel @sysopfb
sysopfb retweeted
A report that I co-authored with @0xtornado is out. It was an interesting case. Aside, the usual exploratory commands, you can see how Threat Actors search the domain for data to exfiltrate and how they persist inside the network.
Plenty of detections and hunting opportunities!
IcedID to XingLocker Ransomware in 24 hours
➡️Initial Access: IcedID
➡️Persistance: Scheduled Tasks
➡️Discovery: net, wmic, AdFind, BloodHound, PowerView, etc.
➡️C2: #CobaltStrike
➡️Defense Evasion: Process Hollowing & Disabling Security Tools
thedfirreport.com/2021/10/18…
1/5
