MuddyWater APT 🇮🇷 targeting telecoms orgs in North and East Africa with custom tools.
credit : @1ZRR4H

Tracking #MuddyC2Go servers with:
- Shodan: LINK
- Censys: LINK

Active C&C servers:
http://94.131.98[.]14:443/
http://95.164.38[.]99:443/
http://94.131.109[.]65:443/
http://45.67.230[.]91:443/
http://45.150.64[.]39:443/

[+] MuddyC2Go PowerShell launcher: LINK
REF: LINK

IDA Plugin Writing Tutorial

credit : http://www.openrce.org/

#old_but_gold

Windows exploit development resources

Link


#windows
@islemolecule_source

Internals of compilers, linkers, JITs and assemblers with focus on software security hardening)

Low-Level Software Security for Compiler Developers:
https://llsoftsec.github.io/llsoftsecbook/

#internals , #linker
———
@islemolecule_source

IPv6 Security & Capability Testing series
credit : @enno_insinuator

[ 1 ] : https://theinternetprotocolblog.wordpress.com/2020/05/24/ipv6-security-capability-testing-part-1/
[ 2 ] : https://theinternetprotocolblog.wordpress.com/2020/05/26/ipv6-security-capability-testing-part-2/

———
@islemolecule_source

IPv6 Security on the Stack Level
credit : @enno_insinuator

https://theinternetprotocolblog.wordpress.com/2020/08/02/ipv6-security-on-the-stack-level/

———
@islemolecule_source

Remember #stuxnet ? It was Dutch Erik van Sabben who planted the bug in Iran. I've seen it in Dutch news channels, will pop up internationally any minute I guess.

https://nos.nl/artikel/2504114-nederlander-saboteerde-atoomcomplex-in-iran-den-haag-wist-niets

#tweet
credit : @CisoDiagonal

Concealed code execution: Techniques and detection
(Process Tampering)
Link

#malware_dev
@islemolecule_source

Good cheat sheet and article

Link

#cheat_sheet
@islemolecule_source

Red team cheat sheet
Link

#cheat_sheet
@islemolecule_source

ConfuserEx2 - Full Deobfuscation Guide

Link

#reverse
@islemolecule_source

A detailed analysis of the Menorah malware used by APT34

Link


#malware_analysis
@islemolecule_source

Octo Banking Botnet [ Source Code ] Leaked

Link

Note: ONLY DEBIAN 11 6 gb RAM / 100 GB / 3 cores, Server Internet speed 100 megabytes


❌open in VM

#leaked
@islemolecule_source

NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers

https://ntdoc.m417z.com/

#windows
#win_api
@islemolecule_source

#malware #reversing

Показано как с помощью параметра SectionAlignment создать исполняемый файл с пустым PE-заголовком.

https://secret.club/2023/06/05/spoof-pe-sections.html

The Evolution of Protected Processes – Part 1
link

The Evolution of Protected Processes – Part 2
link

#windows
#threat_hunting
@islemolecule_source