> see someone discussing position independent code
> "no need to walk peb"
> look inside
> invokes VirtualQuery
> ???

My goofy ass website gets 142,000+- unique visitors a month. Dawg, I have GOT to find a way to monetize this without dropping to my knees and begging like a dirty scoundrel on the internet.

I've worked on this gunkie slermie everyday for 7 years. I gotta do something

Ah ha! I've got an idea! I cover every inch of the website with big dick pill advertisements.

I've got a backstreet boys song stuck in my head I haven't heard since 1999

Meta is still having some minor security problems. Instagram is currently exposing phone numbers and email addresses associated with accounts when trying to perform a password reset

This is cool and badass because everyone is sharing Mark Zuckerbergs phone number right now

I considered sharing the screenshot, but from what I've seen and heard, Instagram are severing the heads of people who post Marks phone number. I've seen a few X accounts get suspended

Silly shenanigans indeed

> be Zuckerberg
> needs AI everywhere (apparently)
> lays off a bunch of employees
> replaces with AI
> fast forward
> AI is dog shit
> AI tricked into stealing accounts
> try to fix
> fail like 5 times
> product now leaking CEOs PII

AI truly is the future, wow

I don't know the whole lore, but nine crypto drainers and/or sim swappers have been apprehended in the UAE.

According to Threat Actors, cryptocurrency nerds (including ZachXBT), the people in the UAE are being tortured.

The full extent is currently unknown, however it's been reported the UAE government has broken their fingers, pulled their teeth out with pliers, and beating them in detention cells. They're still locked away.

These nine individuals have been in Dubai flexing expensive watches, partying with models, showing off expensive cars, etc. None are citizens of the UAE.

I don't know what they did to make the UAE so angry, but they're extremely angry. I also don't know if prisoners have the same rights in the UAE as you would countries like the UK or USA.

Anti-malware companies vs me doing malware analysis

Through a series of shenanigan events, I will be participating in the Continuum Con keynote

I saw people discussing it. I joked if I could join. I was suddenly invited. I have no idea what I'm doing.

tl;dr shitposted my way into giving a keynote, scared and confused

i have absolutely no idea what to do but i was assured ill do great and its easy

Literally the worst cable management I've ever seen in my life

I've been asked a bunch about AI and malware.

As many others have stated many times, and I will happily regurgitate, AI acts as an augmentation device to skilled Threat Actors and a kiddy booster to non-skilled Threat Actors.

AI has yet to produce truly sophisticated malware, presumably because non-skilled Threat Actors don't know the correct nomenclature or what exists and what doesn't.

Skilled Threat Actors know what is, and what isn't, possible and AI enhances their skill set and allows RAD (Rapid Application Development) for languages people may be less skilled in.

Conversely, my malware library must adjust appropriately for the future and include malware targeting AI agents. AI focused malware is a new and evolving threat. Is it paramount information like this be archived. Unfortunately, I myself am not an AI expert, I only have an elementary understanding on the programmatic implementation of AI models, hence I am incapable of assessing what is a good malware paper on AI agents, and what isn't.

We'll figure it out.

Cheers

There is some bizarre thought that AI can just wish hyper sophisticated, never seen before, malware into existence. The reality of the matter is that truly sophisticated malware requires quite a bit of creativity combined with objectives and targets. It is not malware aimlessly blasted into the wild.

Holy cow

Unlimited AI usage!!!!

Just run GPT_Claude_Free.exe as admin

Someone showed me this on Telegram. It is very silly. It is clearly masquerading as "Free GPT and Claude". Anyone with half a brain knows this is malicious, but people will still fall for it.

People asked what it is. I have some free time. I poked it with a stick,

People discussing it said it is XMRig. That is not entirely accurate. This is not XMRig. This is flagged as XMRig from Triage and VirusTotal because it does indeed drop XMRig, but it is much more than that. This is a (maybe new) information stealer packaged with XMRig as a double whammy.

This malware is interesting because of a few things:

1. It is position independent, they care enough to be evasive and strip out a majority of dependencies. This is usually indicative of more serious malware.

2. They .zip it delivers from the "Free GPT and Claude" is intentionally bloated (payload inflation). It is 97MB, which may evade a majority of anti-malware product (initially) due to it's large size. It packages itself with FFMpeg and various other audio codecs.

3. It accesses Microsoft Outlook e-mails, accesses Chrome stuff using the COM IElevationService, looks for any SFTP credentials

It (currently) does not have any matching YARA rules from AV vendors. The closest approximation is LummaStealer. My knowledge base on the Information Stealer scene is out-of-date (it changes a lot). However, on first initial glance this appears like a new information stealer. Again, this should be taken with a grain of salt.

It's also worth noting the domain it exfiltrates to does not appear in any malware reports. The domain is unique, and the payload does not match any existing YARA rules (it's behavioral characteristics do, but not a specific malware family), so this is actually a pretty interesting sample.

A lookup though shows this is an emerging malware campaign. It first appeared around the end of May. This is (probably) a known Threat Actor who has switched it up a bit (or it's MaaS, whatever though).

The malware appears online masquerading as various products.
- ecore-sourceproject
- LogiDA
- GPT_Claude_Free
- CortexSystems.v3.4.2.Stable
- TikTokBot-v2.2
- CortexLauncher

Funny enough, this malware would have been much, much, much, MUCH more evasive if they didn't package it with XMRig. VirusTotal and Triage immediately flagged it because after it establishes persistence, and steals any credentials on the machine, it pulls XMRig to turn into a cryptocurrency miner.

If they did not pull the XMRig binary this stealer would be much more quiet. I have no idea why they decided to burn their OPSEC with XMRig.

C2: dfwioeiofwr-dot-info
Payload (and associated families from the C2)
027d576c6b5512d661081aaeeeb8e611f95a469ccf5ba35e0a390e8814334d05

5dcc599cf48227e65ea49d2708d08704fd1cb7e3b89736718d0d8e557857c49c

5e8b40b0b7512e1a1355374fb0cf34bfdf1260ebdb80a353c8f9da2490beeed3

6a0c332296b017220fc2b522da653fce36a8a3c5c79de0200d61c5fc31eb89ce

a2f8ebf65d54a4d9c8b720d01da77ad796683f1a5b8bd3d08738d7df4365f8a

9d4aaa9842c947756b7c128c432292732098fb71d247ef0bce60368563572da3

c4caca93e2291c018e701c217b7d232c534e4dd142042a59aa4d32754ef3022a