A Python script to download PDB files associated with a Portable Executable (PE)
https://github.com/p0dalirius/pdbdownload
https://github.com/p0dalirius/pdbdownload
GitHub
GitHub - p0dalirius/pdbdownload: An utility to download PDB files associated with a Portable Executable (PE).
An utility to download PDB files associated with a Portable Executable (PE). - GitHub - p0dalirius/pdbdownload: An utility to download PDB files associated with a Portable Executable (PE).
targetted towards people who are interested or do advocate and believe for the human rights of Belarusian people and their citizenship in Lithuania
https://xelemental.github.io/Analyzing-Malicious-Macro-Targetting-Lithuania/
https://xelemental.github.io/Analyzing-Malicious-Macro-Targetting-Lithuania/
xelemental.github.io
Analyzing Malicious Document Targeting Lithuania. | Dev | Disassemble | Debug
видишь кириллицу? это малварь!
https://github.com/rapid7/Rapid7-Labs/blob/main/Yara/100DaysOfYara_2024/Hunt_RussianStringsinPE.yar
https://github.com/rapid7/Rapid7-Labs/blob/main/Yara/100DaysOfYara_2024/Hunt_RussianStringsinPE.yar
GitHub
Rapid7-Labs/Yara/100DaysOfYara_2024/Hunt_RussianStringsinPE.yar at main · rapid7/Rapid7-Labs
Rapid7 Labs operates as the division of Rapid7 focused on threat research. It is renowned for providing comprehensive threat intelligence, research and analytics. - rapid7/Rapid7-Labs
This repository contains the result of the FLARE floss tool applied to all unpacked and dumped samples in Malpedia, pre-processed for further use.
https://github.com/malpedia/malpedia-flossed
https://github.com/malpedia/malpedia-flossed
GitHub
GitHub - malpedia/malpedia-flossed: FLARE floss applied to all unpacked+dumped samples in Malpedia, pre-processed for further use.
FLARE floss applied to all unpacked+dumped samples in Malpedia, pre-processed for further use. - malpedia/malpedia-flossed
The RAD Debugger is a native, user-mode, multi-process, graphical debugger. It currently only supports local-machine Windows x64 debugging with PDBs, with plans to expand and port in the future.
https://github.com/EpicGames/raddebugger
https://github.com/EpicGames/raddebugger
GitHub
GitHub - EpicGamesExt/raddebugger: A native, user-mode, multi-process, graphical debugger.
A native, user-mode, multi-process, graphical debugger. - EpicGamesExt/raddebugger
This media is not supported in your browser
VIEW IN TELEGRAM
Когда после работы хочется жрать
Bigpanzi botnet exploits Android OS TVs and set-top boxes, turning them into a network for illegal activities. This 8 years' operation notably includes setting up a Content Delivery Network (CDN) using infected devices
https://blog.xlab.qianxin.com/bigpanzi-exposed-hidden-cyber-threat-behind-your-stb/
https://blog.xlab.qianxin.com/bigpanzi-exposed-hidden-cyber-threat-behind-your-stb/
奇安信 X 实验室
Bigpanzi Exposed: The Hidden Cyber Threat Behind Your Set-Top Box
Background
Some time ago, we intercepted a dubious ELF sample exhibiting zero detection on VirusTotal. This sample, named pandoraspear and employing a modified UPX shell, has an MD5 signature of 9a1a6d484297a4e5d6249253f216ed69. Our analysis revealed that…
Some time ago, we intercepted a dubious ELF sample exhibiting zero detection on VirusTotal. This sample, named pandoraspear and employing a modified UPX shell, has an MD5 signature of 9a1a6d484297a4e5d6249253f216ed69. Our analysis revealed that…
Atomic Stealer is known to be the first stealer for MacOS devices, it first appeared on Russian hacking in March, 2023.
https://russianpanda.com/2024/01/15/Atomic-Stealer-AMOS/
https://russianpanda.com/2024/01/15/Atomic-Stealer-AMOS/
Order of Six Angles
Коротко о моей ленте твиттера: 99% коты, 1% иб
блять они уже стали сами подписываться 😳
PixieFail: Nine vulnerabilities in Tianocore's EDK II IPv6 network stack.
https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html
Quarkslab
PixieFail: Nine vulnerabilities in Tianocore's EDK II IPv6 network stack. - Quarkslab's blog
This blog post provides details about nine vulnerabilities affecting the IPv6 network protocol stack of EDK II, TianoCore's open source reference implementation of UEFI.
Debug Case Study: Analyzing AppCrash of Cobalt Strike Beacon
https://github.com/DebugPrivilege/InsightEngineering/tree/main/Debugging%20Case%20Studies/Debug%20Case%20Study%3A%20Analyzing%20AppCrash%20of%20Cobalt%20Strike%20Beacon
https://github.com/DebugPrivilege/InsightEngineering/tree/main/Debugging%20Case%20Studies/Debug%20Case%20Study%3A%20Analyzing%20AppCrash%20of%20Cobalt%20Strike%20Beacon
GitHub
InsightEngineering/Debugging Case Studies/Debug Case Study: Analyzing AppCrash of Cobalt Strike Beacon at main · DebugPrivileg…
Hardcore Debugging. Contribute to DebugPrivilege/InsightEngineering development by creating an account on GitHub.
Использование dotnetfile для расшифровки строк C# малвари
https://medium.com/@crovax/ducktail-multi-stage-analysis-39c2a7d9675d
https://medium.com/@crovax/ducktail-multi-stage-analysis-39c2a7d9675d
plugin for Ida Pro to perform the parsing of the MAP file (generated by the IDR) and in this way rescue all the Delphi symbols
https://github.com/Xienim/Delphi-Kawaii
https://github.com/Xienim/Delphi-Kawaii
GitHub
GitHub - Xienim/Delphi-Kawaii: Delphi-Kawaii is a plugin for Ida Pro.
Delphi-Kawaii is a plugin for Ida Pro. Contribute to Xienim/Delphi-Kawaii development by creating an account on GitHub.
Reverse Engineering Terminator aka Zemana AntiMalware/AntiLogger Driver
https://voidsec.com/reverse-engineering-terminator-aka-zemana-antimalware-antilogger-driver/
https://voidsec.com/reverse-engineering-terminator-aka-zemana-antimalware-antilogger-driver/
VoidSec
Reverse Engineering Terminator aka Zemana AntiMalware/AntiLogger Driver - VoidSec
Reverse engineering Spybot's Terminator tool (Zemana Antimalware driver) to achieve LPE as SYSTEM and unrestricted raw SCSI disk read/write.
Malware Analysis and Deobfuscation With Procmon - Smokeloader Example
https://embee-research.ghost.io/smokeloader-analysis-with-procmon/
https://embee-research.ghost.io/smokeloader-analysis-with-procmon/
Embee Research
Malware Analysis and Deobfuscation With Procmon - Smokeloader Example
Decoding malware loaders using Procmon and Cyberchef. Utilising Powershell to retrieve additional payloads and free online tooling to identify the malware family.
how to brute-force almost any fingerprint-protected Android smartphone
https://arxiv.org/pdf/2305.10791.pdf
https://arxiv.org/pdf/2305.10791.pdf