babe wake up mandiant just released artwork for sandworm aka apt44 (officially)
❤101🤓20🔥16🤣13👍3👏2😱2🫡2🤔1
13-year-old Marco Liberale has created a proof-of-concept PasteBin C2 botnet in Go. Is it fully cross platform working on Windows, Linux, and Mac.
We are very happy to see such a young person contributing to this research space.
Check it out here: https://github.com/marco-liberale/PasteBomb
We are very happy to see such a young person contributing to this research space.
Check it out here: https://github.com/marco-liberale/PasteBomb
GitHub
GitHub - marco-liberale/PasteBomb: PasteBomb C2-less RAT
PasteBomb C2-less RAT. Contribute to marco-liberale/PasteBomb development by creating an account on GitHub.
❤110🤓39🔥11🫡11👏10👍9😇4🤣3❤🔥2🤯1🤝1
vx-underground
13-year-old Marco Liberale has created a proof-of-concept PasteBin C2 botnet in Go. Is it fully cross platform working on Windows, Linux, and Mac. We are very happy to see such a young person contributing to this research space. Check it out here: https…
Half of the vx-underground roster were still not fully potty trained at 13, so we find this profoundly impressive.
🤣108❤18🤯7👍4🤔4💯4😢2🤝1
This media is not supported in your browser
VIEW IN TELEGRAM
feege_ spotted a billboard advertisement on the i-95 in Philadelphia, near the Wells Fargo Center, that says:
"Hackers Suck"
"Protect your business. Cover your assets."
"Hackers Suck"
"Protect your business. Cover your assets."
🤣113🤓16👍6😁4😢3❤1🤔1
vx-underground
feege_ spotted a billboard advertisement on the i-95 in Philadelphia, near the Wells Fargo Center, that says: "Hackers Suck" "Protect your business. Cover your assets."
tl;dr you're all going to prison forever (and ever)
😱53🤣17😢8👍5😁5
Hello, how are you? We've updated the vx-underground malware collection. We've added 68,000 new malware samples.
Download the malware.
- Virussign.2024.04.09
- Virussign.2024.04.10
- Virussign.2024.04.11
- Virussign.2024.04.12
- Virussign.2024.04.13
- Virussign.2024.04.14
- Virussign.2024.04.15
- Virussign.2024.04.16
- Virussign.2024.04.17
- InTheWild.0118
- InTheWild.0119
Check it out here: https://vx-underground.org/Samples
Download the malware.
- Virussign.2024.04.09
- Virussign.2024.04.10
- Virussign.2024.04.11
- Virussign.2024.04.12
- Virussign.2024.04.13
- Virussign.2024.04.14
- Virussign.2024.04.15
- Virussign.2024.04.16
- Virussign.2024.04.17
- InTheWild.0118
- InTheWild.0119
Check it out here: https://vx-underground.org/Samples
❤20🔥7💯2👍1
Nerds are reporting the new Team Fortress 2 64bit version is being flagged as malware from AV engines.
🤣75😁9🫡8👍1
Malware review:
2024-03-26 - Malware Disguised as Installer from Korean Public Institution (Kimsuky Group)
- Masquerades as installer (0 points)
- Masqueraded installer is not functional (-1 points)
- Dropper is signed (+1 points)
- Drops src.rar (-1 points)
- Password protected with "1q2w3e4r" (-1 points)
- Execution begins with command "installer" (0 points)
- Copies to %USERPROFILE% (0 points)
- Payload masquerades as svchost.exe (0 points)
- Registers itself in Task Scheduler (0 points)
- Masquerades in Task Scheduler as "Windows Backups" (0 points)
- Developed in Go (+1 points)
- Recycled code from previous malware campaign (-1 points)
- Used same signed certificate from previous malware campaign (-1 points)
- Has generic RAT functionality (0 points)
- TA pushed Mimikatz to infected machine (-2 points)
- Mimikatz masqueraded as cache.exe (0 points)
- TA used free Ngrok domain for C2 (-1 points)
We give Kimsuky Group's recent APT campaign an F.
Unoriginal, generic code, some code dependent on external applications (Winrar) which may not be present on victim machines. Password is hardcoded in payload and easily identifiable. Recycled code and recycled certificate is poor design and lazy. Masqueraded installer not working is lazy. Pushing Mimikatz is also a poor decision, this tool is heavily flagged and is a big red flag.
2024-03-26 - Malware Disguised as Installer from Korean Public Institution (Kimsuky Group)
- Masquerades as installer (0 points)
- Masqueraded installer is not functional (-1 points)
- Dropper is signed (+1 points)
- Drops src.rar (-1 points)
- Password protected with "1q2w3e4r" (-1 points)
- Execution begins with command "installer" (0 points)
- Copies to %USERPROFILE% (0 points)
- Payload masquerades as svchost.exe (0 points)
- Registers itself in Task Scheduler (0 points)
- Masquerades in Task Scheduler as "Windows Backups" (0 points)
- Developed in Go (+1 points)
- Recycled code from previous malware campaign (-1 points)
- Used same signed certificate from previous malware campaign (-1 points)
- Has generic RAT functionality (0 points)
- TA pushed Mimikatz to infected machine (-2 points)
- Mimikatz masqueraded as cache.exe (0 points)
- TA used free Ngrok domain for C2 (-1 points)
We give Kimsuky Group's recent APT campaign an F.
Unoriginal, generic code, some code dependent on external applications (Winrar) which may not be present on victim machines. Password is hardcoded in payload and easily identifiable. Recycled code and recycled certificate is poor design and lazy. Masqueraded installer not working is lazy. Pushing Mimikatz is also a poor decision, this tool is heavily flagged and is a big red flag.
🤣81👏11👍7❤2😢1💯1🫡1
vx-underground
Following the return of HelloKitty ransomware group (now HelloGookie), the individuals behind HelloKitty ransomware group released more files from CD Projekt Red – the game studio behind The Witcher and Cyberpunk 2077. Using the leaks nerds have compiled…
Note: some binaries were already compiled from the previous leak*
👍40😁10🥰4
Malware review:
2024-02-27- European diplomats targeted by SPIKEDWIRE with WINELOADER
Notes:
*Zscaler on release of this article did not attribute it to any state-sponsored Threat Actor
*Mandiant later attributed this payload to APT29 March, 22nd 2024 in an article noscriptd: "APT29 Uses WINELOADER to Target German Political Parties"
- Targets specific European diplomats via malicious PDF (0 points)
- Targets carefully enumerated, low volume of malicious PDFs sent (+1 points)
- Malicious PDF masquerading as letter from Ambassador of India for wine tasting event (0 points)
- PDF requires registration to event, links to compromised website (+1 points)
- 'Invitation site' requires guest to download .zip file (-1 point)
- .zip file contains wine.hta which masquerades as invitation event details (0 points)
- .hta file contains malicious javanoscript, obfuscated with opensource tool (-1 points)
- .hta downloads BASE64 encoded .txt from compromised website (0 points)
- .hta uses certutils.exe to BASE64 decode .txt file (+1 point)
- BASE64 decoded text file transfroms into .zip file, extracted to C:\Windows\Tasks (+1 points)
- .zip extracts sqlwrite.exe and vcruntime140.dll (+1 points)
- APT29 uses DLL sideloading vulnerability (unknown at the time) on sqlwrite.exe to load fake vcruntime140.dll (+2 points)
- Side loaded DLL function se_se_translator pulls RSA encrypted .exe out of DLL (+1 point)
- Side loaded DLL encrypts and decrypts .exe when no longer in use (+2 points)
- .exe has different modules (plugins) for different task (+2 points)
- Modules use DLL Hollowing to inject into randomly selected DLLs (+1 point)
- Each module is downloaded individually from remote C2 (compromised websites) (+2 points)
- Connecting to C2 uses GET HTTP. Sent data is custom made data blobs containing information on modules and commands sent and received (+2 points)
- Persistent achieved by Microsoft signed sqlwriter.exe DLL side loading from Windows Task Scheduler (0 points)
- Memory is zero filled when not used (+1 points)
2024-02-27- European diplomats targeted by SPIKEDWIRE with WINELOADER
Notes:
*Zscaler on release of this article did not attribute it to any state-sponsored Threat Actor
*Mandiant later attributed this payload to APT29 March, 22nd 2024 in an article noscriptd: "APT29 Uses WINELOADER to Target German Political Parties"
- Targets specific European diplomats via malicious PDF (0 points)
- Targets carefully enumerated, low volume of malicious PDFs sent (+1 points)
- Malicious PDF masquerading as letter from Ambassador of India for wine tasting event (0 points)
- PDF requires registration to event, links to compromised website (+1 points)
- 'Invitation site' requires guest to download .zip file (-1 point)
- .zip file contains wine.hta which masquerades as invitation event details (0 points)
- .hta file contains malicious javanoscript, obfuscated with opensource tool (-1 points)
- .hta downloads BASE64 encoded .txt from compromised website (0 points)
- .hta uses certutils.exe to BASE64 decode .txt file (+1 point)
- BASE64 decoded text file transfroms into .zip file, extracted to C:\Windows\Tasks (+1 points)
- .zip extracts sqlwrite.exe and vcruntime140.dll (+1 points)
- APT29 uses DLL sideloading vulnerability (unknown at the time) on sqlwrite.exe to load fake vcruntime140.dll (+2 points)
- Side loaded DLL function se_se_translator pulls RSA encrypted .exe out of DLL (+1 point)
- Side loaded DLL encrypts and decrypts .exe when no longer in use (+2 points)
- .exe has different modules (plugins) for different task (+2 points)
- Modules use DLL Hollowing to inject into randomly selected DLLs (+1 point)
- Each module is downloaded individually from remote C2 (compromised websites) (+2 points)
- Connecting to C2 uses GET HTTP. Sent data is custom made data blobs containing information on modules and commands sent and received (+2 points)
- Persistent achieved by Microsoft signed sqlwriter.exe DLL side loading from Windows Task Scheduler (0 points)
- Memory is zero filled when not used (+1 points)
❤51🤯15👍5👏3🤣2🤓2😢1😍1