Malware research community repo

https://github.com/Malware-Research/Resources


#malware_analysis
____
@islemolecule_source

[ 1 ] From a Windows driver to a fully functionnal driver.
In this blogpost we'll go through the history of EDR's, how they used to work, how they work now and how we can build a fully functionnal one. Last step is a chall, bypass MyDumbEDR.

https://sensepost.com/blog/2024/sensecon-23-from-windows-drivers-to-an-almost-fully-working-edr/



[ 2 ] internal mecanisms of EDR's :

https://www.youtube.com/watch?v=yacpjV6kWpM&t=387s


[ 3 ] MyDumbEDR ( written in C )

https://github.com/sensepost/mydumbedr


———
@islemolecule_source

The comprehensive HyperDbg training course published on YouTube. It is definitely much better to register on OpenSecurityTrainings website and follow the course there because there are a series of labs and additional instructions on their website:

https://ost2.fyi/Dbg3301

Here is the YouTube playlist link:
https://www.youtube.com/watch?v=RDlp0PCFgxI&list=PLUFkSN0XLZ-kF1f143wlw8ujlH2A45nZY

Slides link:
https://gitlab.com/opensecuritytraining/dbg3301_hyperdbg_slides_and_files

If you have any feedback, I will be happy to share it with you. 🙏

(sina ✍)

tl;dr archived stuff, see link below

Earlier today a GitHub noscriptd "I-S00N" leaked supposedly sensitive Chinese government data - specifically related to offensive cyber security.

The initial discovery, and documentation of the documents, derive from AzakaSekai_. We have archived his research and notes on the material.

It should be noted that they *probably have not covered the material in totality and more information can be expected to be released in the following days from either Azaka, or other Cyber Threat Intelligence experts familiar with Chinese state-sponsored activity.

Furthermore, the materials are written in Mandarin. We have made no attempt to translate the material to English and we do not speak Mandarin, hence we cannot provide any opinion or speculation on the material. We will leave that painstaking task to individuals who speak Mandarin, or people who feel like trying to translate the documents accurately.

What an exciting start to the week:)

You can view the archived materials here: https://vx-underground.org/APTs/2024/2024.02.18%20-%20Summary%20of%20I-S00N%20leaks

Malware development in c

https://0x12darkdev.net/courses/introduction-malware-development

Comparing Anti-Cheat Bypass and EDR Bypass

https://whiteknightlabs.com/2024/02/09/a-technical-deep-dive-comparing-anti-cheat-bypass-and-edr-bypass

JTAG debug of Windows Hyper-V / Secure Kernel with WinDbg and EXDI: Part 1


https://www.asset-intertech.com/resources/blog/2024/01/jtag-debug-of-windows-hyper-v-secure-kernel-with-windbg-and-exdi-part-1/



#window_internals , #hyper_v
---------
@islemolecule_source

C developers show-off their skills:

Windows Security Internals: A Deep Dive into Windows Authentication, Authorization, and Auditing by James Forshaw, 2024 (Early Access 2023)


#books
---------
@islemolecule_source

Mastering the Art of Bypassing Windows UAC.

Link

#malware_dev
#offensive

---------
@islemolecule_source

According to New Iran GOV data leakage now phishing is upgrading to new level 😐



Translate :


Let me tell you how deep the  catastrophe  is:

Today in a group chat of
fishingers we were having conference if we can extract
the phone numbers,so we can
send Eblagh message directly
to them.(Eblagh: a message
that police sends you to
summon you in some station
or to anser some questions in
a website).

These datas that has been leaked contains full
information of people including their address, identity, phone number and etc. We a group of 10 people are working on creating a large database and a fake Eblagh site.

It is not like prior times since we have more data of targets they would trust fake site.
I promise in next week we will hit dozens of targets and for each 1000 folks , 900 will fall into trap and their credit card will be empty in a twinkle an eye...


Thanks "Gypsy Boy" for translation 🙌

We've updated the vx-underground Windows malware paper collection

- 2024-01-24 - How to perform a Complete Process Hollowing
- 2024-02-02 - Bypassing EDRs With EDR-Preloading
- 2024-02-16 - Beyond Process and Object Callbacks - An Unconventional Method

Writing and Compiling Shellcode in C
Link


#malware_dev
#offensive

---------
@islemolecule_source

Themida Company License (Release: 3.1.8.0)

#protector

---------
@islemolecule_source

The Enigma 7.40 x86 & x64

#protector

---------
@islemolecule_source

VMProtect Ultimate v3.8.4_1754 Licensed & VMProtect Ultimate v3.8.6 Unlicensed

#protector

---------
@islemolecule_source

📹 Getting Started with Detect-It-Easy (DIE): Investigating a Stealer
👤 Dr Josh Stroschein - The Cyber Yeti

https://youtu.be/FB_e1mIhykk?si=okqrcuN9HplyBA86

#malware_analysis

---------
@islemolecule_source

Building-c2-implants-in-cpp-a-primer
Link


#c2
#malware_dev
--------
@islemolecule_source

Lessons from the iSOON Leaks



https://blog.bushidotoken.net/2024/02/lessons-from-isoon-leaks.html?m=1