M4lcode

@M4lcode

Malware researcher exploring malware, APT groups, and their campaigns across the wild. | Threat Researcher @dexpose_io | Blog Author @anyrun_app & @cyber5w

Egypt

m4lcode.github.io

Inscrit en Février 2023

177Posts 653Abonnés 314Abonnements

M4lcode

@M4lcode

2 oct.

Fresh malware analysis from @anyrun_app: FunkLocker TTPs, artifacts, and practical takeaways for SOC and DFIR. Read: any.run/cybersecurity-…

M4lcode's tweet card. Discover a technical analysis of AI-based ransomware FunkLocker from the FunkSec APT that is targeting businesses worldwide.

FunkLocker Analysis: AI-powered Ransomware from FunkSec APT

Source: any.run

M4lcode a reposté

Just published a deep dive into APT27 (Emissary Panda/Iron Tiger/Lucky Mouse), a Chinese state-sponsored cyber-espionage group active since 2010, known for spear-phishing, watering-hole attacks and exploitation of internet-facing applications. dexpose.io/threat-actor-p…

M4lcode's tweet image. Just published a deep dive into APT27 (Emissary Panda/Iron Tiger/Lucky Mouse), a Chinese state-sponsored cyber-espionage group active since 2010, known for spear-phishing, watering-hole attacks and exploitation of internet-facing applications.

dexpose.io/threat-actor-p…

M4lcode a reposté

ANY.RUN

@anyrun_app

5 août

🚨#ANYRUN’s TI Feeds now offer a connector for Microsoft Sentinel Get fresh, filtered #IOCs from the latest attacks worldwide, updated every 2 hours and enriched with sandbox analyses Expand incident monitoring, boost detection rate, and slash MTTR 👇 any.run/cybersecurity-…

anyrun_app's tweet card. Ingest fresh IOCs from 15K SOCs into your Microsoft Sentinel SIEM to expand threat coverage and increase detection rate.

ANY.RUN & Microsoft Sentinel: Catch Emerging Threats with Real-Time Threat Intelligence - ANY.RUN's...

Source: any.run

M4lcode a reposté

Muhammad Hasan Ali

@muha2xmad

16 juil.

As-salamu Alaykum I wrote 3 #yara rules about #RedLine stealer , #ArrowRAT, and #MilleniumRat. RedLine:github.com/muha2xmad/yara… ArrowRAT:github.com/muha2xmad/yara… MilleniumRat:github.com/muha2xmad/yara…

M4lcode

@M4lcode

8 juil.

PureLogs is live. A new challenge created by me. good luck

Gameel Ali 🤘

@MalGamy12

8 juil.

New Challenge on MalOps.io: PureLogs Stealer A fresh analysis challenge is now live. This time, you're looking at PureLogs, a .NET-based info-stealer that’s been seen in active campaigns. Your job is to analysis it to answer our questions created by: @M4lcode

MalGamy12's tweet image. New Challenge on MalOps.io: PureLogs Stealer

A fresh analysis challenge is now live. This time, you're looking at PureLogs, a .NET-based info-stealer that’s been seen in active campaigns. Your job is to analysis it to answer our questions
created by: @M4lcode

M4lcode a reposté

Mohamed Sultan

@mSult4n

19 juin

Just published a new blog post on how Microsoft’s “Mouse Without Borders” can be abused for data exfiltration & lateral movement. Features KAPE Target, C# scripts, and a BOF as a poc: 0xsultan.github.io/dfir/Exfiltrat…

M4lcode

@M4lcode

14 juin

Open directory spotted: 20.243.255[.]185 Hosting multiple suspicious files, including: shell_le: Metasploit ELF payload - recently submitted to VirusTotal. true.png: PNG file with embedded VBScript (1/61 on VT) - recently submitted to VirusTotal main_mips: ELF binary flagged…

M4lcode's tweet image. Open directory spotted: 20.243.255[.]185
Hosting multiple suspicious files, including:

shell_le: Metasploit ELF payload - recently submitted to VirusTotal.

true.png: PNG file with embedded VBScript (1/61 on VT) - recently submitted to VirusTotal

main_mips: ELF binary flagged…

M4lcode

@M4lcode

11 juin

#clickfix #booking #fakecaptcha bokparthub[.]click → (Under Construction) apartmenr-di16[.]click → PowerShell (files.catbox.moe/09fd7c[.]txt) → LightYellow4.zip → LightYellow4.pfx Hex-based ZIP reconstructed → payload cleaned → executed via regsvr32.exe abuse (LOLBins)

M4lcode's tweet image. #clickfix #booking #fakecaptcha
bokparthub[.]click → (Under Construction)

apartmenr-di16[.]click → PowerShell (files.catbox.moe/09fd7c[.]txt) → LightYellow4.zip → LightYellow4.pfx Hex-based ZIP reconstructed → payload cleaned → executed via regsvr32.exe abuse (LOLBins)

M4lcode a reposté

Gameel Ali 🤘

@MalGamy12

10 mai

We’re excited to announce the launch of malops.io , a platform built by analysts, for analysts and it’s completely free. You can join and enjoin with our frist challenge about RokRat Loader.

MalGamy12's tweet image. We’re excited to announce the launch of malops.io , a platform built by analysts, for analysts and it’s completely free.
You can join and enjoin with our frist challenge about RokRat Loader.

M4lcode

@M4lcode

11 avr.

Lately, I've been working on analyzing several stealers and a PE injector. Take a look 😃 Fileless pe injector uses reflective loading : blog.dexpose.io/analysis-of-ar… Purelogger: blog.dexpose.io/purelogger-dee… Salat Stealer: blog.dexpose.io/understanding-… Flesh Stealer: blog.dexpose.io/flesh-stealer-…

M4lcode's tweet image. Lately, I've been working on analyzing several stealers and a PE injector. Take a look 😃

Fileless pe injector uses reflective loading : blog.dexpose.io/analysis-of-ar…

Purelogger: blog.dexpose.io/purelogger-dee…

Salat Stealer: blog.dexpose.io/understanding-…

Flesh Stealer: blog.dexpose.io/flesh-stealer-…

M4lcode a reposté

vx-underground

@vxunderground

28 mars

M4lcode

@M4lcode

24 mars

FExcited to share that ANY.RUN now supports Android OS inside its interactive sandbox! You can analyze APK behavior in real time, right in the cloud. 🔥 Available for ALL plans (yes, even free!). 📷 Let’s check it out together! app.any.run/?utm_source=x_…

M4lcode

@M4lcode

21 janv.

Fake job interviews are a growing attack vector One example here is InvisibleFerret, a malware from North Korea, that targets tech professionals See detailed analysis of its code and collect IOCs to avoid infection by @MauroEldritch any.run/cybersecurity-… @anyrun_app