Malware AV/VM evasion - part 14: encrypt/decrypt payload via A5/1. Bypass Kaspersky AV. Simple C++ example.

This post is the result of research on try to evasion AV engines via encrypting payload with another function: GSM A5/1 algorithm:

— https://cocomelonc.github.io/malware/2023/03/24/malware-av-evasion-14.html

Malwoverview

… threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, InQuest:

— https://github.com/alexandreborges/malwoverview

Efficient SIEM and Detection Engineering in 10 steps

— https://maciejszymczyk.medium.com/efficient-siem-and-detection-engineering-in-10-steps-c82402a70dbd

Container Security Checklist: From the image to the workload

— https://github.com/krol3/container-security-checklist

A cross-platform, collaborative, Command & Control framework written in C#, designed for red teaming and ease of use

— https://github.com/DragoQCC/HardHatC2

Dissecting AlienFox | The Cloud Spammer’s Swiss Army Knife

https://www.sentinelone.com/labs/dissecting-alienfox-the-cloud-spammers-swiss-army-knife/

OSCE³ Study Guide

— https://github.com/CyberSecurityUP/OSCE-Complete-Guide

Solidity audits and secure development material

This repo contains most of the practical examples and exercises that I use during my lectures about Solidity security and auditing:

— https://github.com/jcsec-security/solidity-security-teaching-resources/

MacStealer: Wi-Fi Client Isolation Bypass

https://github.com/vanhoefm/macstealer

ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access

— https://www.mandiant.com/resources/blog/alphv-ransomware-backup

Malware indicators of compromise (IOCs)

— https://github.com/prodaft/malware-ioc

Microsoft Azure AD Assessment

PoweShell module noscript:

— https://github.com/AzureAD/AzureADAssessment

PoC CVE-2023-27532 (Veeam Backup & Replication)

Proof of Concept code to exploit CVE-2023-27532 and either leak plaintext credentials or perform remote command execution:

— https://github.com/sfewer-r7/CVE-2023-27532

C2Matix

— Google Calc Table

Visual Studio Code and GitHub Copilot

https://code.visualstudio.com/blogs/2023/03/30/vscode-copilot

I built a Zero Day with undetectable exfiltration using only ChatGPT prompts

https://www.forcepoint.com/blog/x-labs/zero-day-exfiltration-using-chatgpt-prompts

Writing an Interpreter in Go

BurpGPT

A Burp Suite extension that integrates OpenAI's GPT to perform an additional passive scan for discovering highly bespoke vulnerabilities, and enables running traffic-based analysis of any type:

— https://github.com/aress31/burpgpt