#malware_analysis
#malware_campaing
#malware_spreading
@ZwLowLevel
https://www.group-ib.com/blog/turning-apps-into-gold/
Please open Telegram to view this post
VIEW IN TELEGRAM
Group-IB
Hook for Gold: Inside GoldFactory's Сampaign That Turns Apps Into Goldmines
A deep dive into GoldFactory’s evolving mobile fraud campaigns across APAC, including modified banking apps, new malware variants such as Gigaflower, shared criminal infrastructure, and insights from the Group-IB Fraud Matrix, with recommendations for organizations…
BRICKSTORM is a custom Executable and Linkable Format (ELF) Go-based backdoor. The analyzed
samples differ in function, but all enable cyber actors to maintain stealthy access and provide capabilities
for initiation, persistence, and secure command and control (C2). Even though the analyzed samples were
for VMware vSphere environments, there is reporting about Windows versions.
#malware_analysis
@ZwLowLevel
Please open Telegram to view this post
VIEW IN TELEGRAM
#reverse_engineering
#reversing
@ZwLowLevel
https://research.eye.security/consent-and-compromise/
Please open Telegram to view this post
VIEW IN TELEGRAM
Eye Research
Consent & Compromise: Abusing Entra OAuth for Fun and Access to Internal Microsoft Applications
The Eye Security Research team has uncovered a new critical misconfiguration that exposed sensitive data at internal Microsoft applications.
"VX-API", el cual tiene fragmentos de técnicas que se utilizan en MalwareDev.#malware_development #maldev
#malwaredev
@ZwLowLevel
https://vx-api.gitbook.io/vx-api/code-base/markdown
Please open Telegram to view this post
VIEW IN TELEGRAM
vx-api.gitbook.io
CRT Recreation | vx-api
ShellCode
Advanced Windows shellcode development framework with position-independent code generation, dynamic API resolution, and cross-architecture support for security research and penetration testing.
Advanced Windows shellcode development framework with position-independent code generation, dynamic API resolution, and cross-architecture support for security research and penetration testing.
#malware_development
#maldev
#malwaredev
@ZwLowLevel
GitHub
GitHub - Ylxmy/Windows-Shellcode-Generator-Loader: Advanced Windows shellcode development framework with position-independent code…
Advanced Windows shellcode development framework with position-independent code generation, dynamic API resolution, and cross-architecture support for security research and penetration testing. - Y...
elfpeek
Minimal ELF inspector with interactive REPL for quick binary analysis
Minimal ELF inspector with interactive REPL for quick binary analysis
#malware_analysis
@ZwLowLevel
https://github.com/Oblivionsage/elfpeek
GitHub
GitHub - Oblivionsage/elfpeek: Minimal ELF inspector written in C for quick binary layout inspection
Minimal ELF inspector written in C for quick binary layout inspection - Oblivionsage/elfpeek
SAMDump
Extract SAM and SYSTEM using Volume Shadow Copy (VSS) API. With multiple exfiltration options and XOR obfuscation
Extract SAM and SYSTEM using Volume Shadow Copy (VSS) API. With multiple exfiltration options and XOR obfuscation
#malwaredev
#malware_development
#maldev
@ZwLowLevel
https://github.com/ricardojoserf/SAMDump
GitHub
GitHub - ricardojoserf/SAMDump: Extract SAM and SYSTEM using Volume Shadow Copy (VSS) API. With multiple exfiltration options and…
Extract SAM and SYSTEM using Volume Shadow Copy (VSS) API. With multiple exfiltration options and XOR obfuscation - ricardojoserf/SAMDump
Sanctioned but Still Spying: Intellexa’s Prolific Zero-Day Exploits Continue
#malware_analysis
@ZwLowLevel
https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue
Google Cloud Blog
Intellexa’s Prolific Zero-Day Exploits Continue | Google Cloud Blog
Commercial surveillance vendor Intellexa continues to thrive and exploit mobile zero-day vulnerabilities.
Cooolis-ms
Cooolis-ms is a tool that incorporates the Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection.
Cooolis-ms is a tool that incorporates the Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection.
#malware_development
#maldev
#malwaredev
@ZwLowLevel
https://github.com/otuhsgcasg/Cooolis-ms-C2-Loader-Metasploit
The stack circuitry of the Intel 8087 floating point chip, reverse-engineered
#reverse_engineering
#reversing
@ZwLowLevel
Righto
The stack circuitry of the Intel 8087 floating point chip, reverse-engineered
Early microprocessors were very slow when operating with floating-point numbers. But in 1980, Intel introduced the 8087 floating-point copro...
New BYOVD loader behind DeadLock ransomware attack
#windows_kernel
#windows_driver
#windows_internals
@ZwLowLevel
Cisco Talos Blog
New BYOVD loader behind DeadLock ransomware attack
Cisco Talos has uncovered a new DeadLock ransomware campaign using a previously unknown BYOVD loader to exploit a Baidu Antivirus driver vulnerability, letting threat actors disable EDR defenses and escalate attacks.
Malware Development
A collection of blogs about Malware Development and Analysis from talented researchers.
A collection of blogs about Malware Development and Analysis from talented researchers.
#malware_development
#malwaredev
#maldev
@ZwLowLevel
https://github.com/t1Sh1n4/mlwr_blogs
GitHub
GitHub - t1Sh1n4/mlwr_blogs: collection of blogs about malware development and analysis
collection of blogs about malware development and analysis - t1Sh1n4/mlwr_blogs
svc-hook: System Call Hook for ARM64
svc-hook is a system call hook mechanism for ARM64. It is designed to be low performance overhead, independent of the target source code, without relying on kernel features.
svc-hook is a system call hook mechanism for ARM64. It is designed to be low performance overhead, independent of the target source code, without relying on kernel features.
#arm64
#arm64_internals
#syscall
#system_call
@ZwLowLevel
https://github.com/retrage/svc-hook
GitHub
GitHub - retrage/svc-hook: System Call Hook for ARM64
System Call Hook for ARM64. Contribute to retrage/svc-hook development by creating an account on GitHub.