English
English Indonesia Türkçe Deutsch Español Português Pусский Français Italiano Nederlands Polski العربية ไทย Tiếng Việt 繁體中文 简体中文 日本語 한국어
andreanaspi's profile picture. Msc Cybersecurity at @SapienzaRoma | Threat Hunting | Malware Analyst @nozominetworks

Andrea Naspi

@andreanaspi

Msc Cybersecurity at @SapienzaRoma | Threat Hunting | Malware Analyst @nozominetworks

291Posts 180Followers 544Following
You might like
Pinned
andreanaspi's profile picture.
Andrea Naspi
 @andreanaspi
Apr 28, 2022

I'd like to share a project I've been working recently related to the #Bumblebee #loader. This #Python script allows you to quickly extract the C&C server configuration from the #Bumblebee process through PE-Sieve by @hasherezade github.com/AndreaNaspi/un… @cluster25_io

andreanaspi's tweet card. Python script to extract the C&C configuration from an active Bumblebee process through PE-Sieve - AndreaNaspi/unbumblebee
GitHub - AndreaNaspi/unbumblebee: Python script to extract the C&C configuration from an active...
Source: github.com
2
28
81
13
0
Andrea Naspi reposted
0verfl0w_'s profile picture.
0verfl0w
 @0verfl0w_
Apr 10, 2024

Our latest post has just gone live! In this one, we're looking at using Capstone Disassembler, Unicorn Emulation Framework, and Python to defeat encrypted stack strings within a Conti ransomware sample 0ffset.net/reverse-engine…

0verfl0w_'s tweet card. It's not uncommon to come across some kind of string encryption functionality within malware samples, often more complex than a simple single-byte XOR operation which can often be brute-forced with...
Resolving Stack Strings with Emulation | 0ffset Training Solutions
Source: 0ffset.net
35
37
111
46
10K
andreanaspi's profile picture.
Andrea Naspi
 @andreanaspi
Feb 21, 2024

#Patchwork #Spyder v3 downloader delivering #Remcos RAT Campaign reference: mp.weixin.qq.com/s?__biz=MzI2MD…

JVPv5sIM3eFmGyi's profile picture.
why2try
 @JVPv5sIM3eFmGyi
Feb 20, 2024

9675534f941357ea29d8f5da363b72fa avengersonlineacademy[.]com #PatchWork #APT

1
1
3
1
2K
0
1
3
0
295
andreanaspi's profile picture.
Andrea Naspi
 @andreanaspi
Jan 17, 2024

As P2PInfect raises #cybersecurity concerns, our Labs team identified a strain of #P2Pinfect that targets a new #IoT architecture – ARM. Read this blog to learn about recent P2PInfect worm operations & behavior, and the implications for digital #security: ow.ly/7C9E50QrH7C

andreanaspi's tweet image. As P2PInfect raises #cybersecurity concerns, our Labs team identified a strain of #P2Pinfect that targets a new #IoT architecture – ARM. Read this blog to learn about recent P2PInfect worm operations & behavior, and the implications for digital #security: ow.ly/7C9E50QrH7C
0
0
0
0
52
Andrea Naspi reposted
Toga1726's profile picture.
Toga
 @Toga1726
Jan 3, 2024

Today, the pro-Palestinian hacker group "Islamic Cyber Team Indonesian" claims to have hacked the #FBI. Two compressed archives, referring to FBI data, totaling about 7GB were shared on their telegram channel. In the message, numerous pro Palestinian collectives have been quoted

Toga1726's tweet image. Today, the pro-Palestinian hacker group "Islamic Cyber Team Indonesian" claims to have hacked the #FBI. Two compressed archives, referring to FBI data, totaling about 7GB were shared on their telegram channel. In the message, numerous pro Palestinian collectives have been quoted
Toga1726's tweet image. Today, the pro-Palestinian hacker group "Islamic Cyber Team Indonesian" claims to have hacked the #FBI. Two compressed archives, referring to FBI data, totaling about 7GB were shared on their telegram channel. In the message, numerous pro Palestinian collectives have been quoted
Toga1726's tweet image. Today, the pro-Palestinian hacker group "Islamic Cyber Team Indonesian" claims to have hacked the #FBI. Two compressed archives, referring to FBI data, totaling about 7GB were shared on their telegram channel. In the message, numerous pro Palestinian collectives have been quoted
0
2
3
1
263
andreanaspi's profile picture.
Andrea Naspi
 @andreanaspi
Dec 7, 2023

Good news for #obfuscator/#packer researchers, the complete #VMProtect (v3.5.1) source code has just been leaked! 🔥 e41e4c6048abddeb5f3652bfb5036927f3e49b4a02b558d72839c9ebcf2c7e98 First submission: 2023-12-07 08:38:30 UTC

andreanaspi's tweet image. Good news for #obfuscator/#packer researchers, the complete #VMProtect (v3.5.1) source code has just been leaked! 🔥 e41e4c6048abddeb5f3652bfb5036927f3e49b4a02b558d72839c9ebcf2c7e98 First submission: 2023-12-07 08:38:30 UTC
2
2
12
4
880
andreanaspi's profile picture.
Andrea Naspi
 @andreanaspi
Dec 1, 2023

#GoTitan #botnet samples available on VT, have a good hunt! 9f639212aa8f31b4bf45adb9a8008502 e32a5b9c58c3e40d2246b7774cb4fb33

andreanaspi's tweet image. #GoTitan #botnet samples available on VT, have a good hunt! 9f639212aa8f31b4bf45adb9a8008502 e32a5b9c58c3e40d2246b7774cb4fb33
virusbtn's profile picture. Security information portal, testing and certification body. Organisers of the annual Virus Bulletin conference. @VirusBulletin@infosec.exchange
Virus Bulletin
 @virusbtn
Nov 29, 2023

Fortinet researchers detail the Apache ActiveMQ CVE-2023-46604 exploitation and provide insights into the malware associated with these recent attacks, such as the newly discovered Golang-based botnet named GoTitan and a .NET program called PrCtrl Rat. fortinet.com/blog/threat-re…

virusbtn's tweet image. Fortinet researchers detail the Apache ActiveMQ CVE-2023-46604 exploitation and provide insights into the malware associated with these recent attacks, such as the newly discovered Golang-based botnet named GoTitan and a .NET program called PrCtrl Rat. fortinet.com/blog/threat-re…
0
21
38
6
6K
0
0
5
0
163
Andrea Naspi reposted
Toga1726's profile picture.
Toga
 @Toga1726
Dec 1, 2023

Yesterday, the pro-Rus hacker group #XakNet Team claims to have "hacked #NATO." They shared an Excel containing personal information about natoschool students (elearning.natoschool.nato.int). In addition, they shared a series of accounts on the said platform. Screenshots:

Toga1726's tweet image. Yesterday, the pro-Rus hacker group #XakNet Team claims to have "hacked #NATO." They shared an Excel containing personal information about natoschool students (elearning.natoschool.nato.int). In addition, they shared a series of accounts on the said platform. Screenshots:
Toga1726's tweet image. Yesterday, the pro-Rus hacker group #XakNet Team claims to have "hacked #NATO." They shared an Excel containing personal information about natoschool students (elearning.natoschool.nato.int). In addition, they shared a series of accounts on the said platform. Screenshots:
Toga1726's tweet image. Yesterday, the pro-Rus hacker group #XakNet Team claims to have "hacked #NATO." They shared an Excel containing personal information about natoschool students (elearning.natoschool.nato.int). In addition, they shared a series of accounts on the said platform. Screenshots:
Toga1726's tweet image. Yesterday, the pro-Rus hacker group #XakNet Team claims to have "hacked #NATO." They shared an Excel containing personal information about natoschool students (elearning.natoschool.nato.int). In addition, they shared a series of accounts on the said platform. Screenshots:
0
2
5
0
365
andreanaspi's profile picture.
Andrea Naspi
 @andreanaspi
Nov 29, 2023

#Honeypots are essential tools for threat hunting, primarily used to lure #cyberattackers. They can also help warn that an intrusion attempt is happening, and improve our understanding of #threats. Learn how to set up & use an #IoT #honeypot: ow.ly/E2t050QcBti

andreanaspi's tweet image. #Honeypots are essential tools for threat hunting, primarily used to lure #cyberattackers. They can also help warn that an intrusion attempt is happening, and improve our understanding of #threats. Learn how to set up & use an #IoT #honeypot: ow.ly/E2t050QcBti
0
0
0
0
49
Andrea Naspi reposted
UK_Daniel_Card's profile picture.
mRr3b00t
@UK_Daniel_Card
Oct 24, 2023

OK, this morning I'm doing to go cruising with #Censys ############################ You all have very specific custom config ############################# "Very Secure FTP Daemon" HTML Fingerprint HTML Title: "404 That's an Error" 8.130.12.120 47.251.45.4 86.57.172.226…

UK_Daniel_Card's tweet image. OK, this morning I'm doing to go cruising with #Censys ############################ You all have very specific custom config ############################# "Very Secure FTP Daemon" HTML Fingerprint HTML Title: "404 That's an Error" 8.130.12.120 47.251.45.4 86.57.172.226…
UK_Daniel_Card's tweet image. OK, this morning I'm doing to go cruising with #Censys ############################ You all have very specific custom config ############################# "Very Secure FTP Daemon" HTML Fingerprint HTML Title: "404 That's an Error" 8.130.12.120 47.251.45.4 86.57.172.226…
3
12
41
11
20K
Andrea Naspi reposted
Yeti_Sec's profile picture.
Yeti
 @Yeti_Sec
Oct 13, 2023

Tried hunting for DarkGate servers ? Try using this search term on Censys. -> (Autoit3.exe) and services.service_name=`DARKGATE` Censys: 10 results #darkgate #threathunting #malware #threatintelligence #threatintel

Yeti_Sec's tweet image. Tried hunting for DarkGate servers ? Try using this search term on Censys. -> (Autoit3.exe) and services.service_name=`DARKGATE` Censys: 10 results #darkgate #threathunting #malware #threatintelligence #threatintel
Yeti_Sec's tweet image. Tried hunting for DarkGate servers ? Try using this search term on Censys. -> (Autoit3.exe) and services.service_name=`DARKGATE` Censys: 10 results #darkgate #threathunting #malware #threatintelligence #threatintel
1
13
49
16
6K
Andrea Naspi reposted
JonnyJohnson_'s profile picture.
Jonny Johnson
@JonnyJohnson_
Oct 12, 2023

It’s very common for us to see offensive tooling enable SeDebugPrivilege so that they may bypass certain OS checks. However, what does this mean? Which OS checks are skipped? I dove into this and decided to write a blog on it. Check it out! bit.ly/3trYxdg

JonnyJohnson_'s tweet card. SeDebugPrivilege matters when accessing process and thread objects. Accessing certain objects, namely processes, is a very common action performed by…
Mastering Windows Access Control: Understanding SeDebugPrivilege
Source: binarydefense.com
0
94
247
112
49K
Andrea Naspi reposted
sigma_hq's profile picture.
sigma
 @sigma_hq
Oct 10, 2023

We're pleased to announce the launch of our new website Access resources, documentation, and community projects to enhance your experience with the Sigma Rule Standard Special thx to @sifex for the hard work! Blog: medium.com/sigma-hq/intro… Explore now: sigmahq.io

sigma_hq's tweet image. We're pleased to announce the launch of our new website Access resources, documentation, and community projects to enhance your experience with the Sigma Rule Standard Special thx to @sifex for the hard work! Blog: medium.com/sigma-hq/intro… Explore now: sigmahq.io
sigma_hq's tweet image. We're pleased to announce the launch of our new website Access resources, documentation, and community projects to enhance your experience with the Sigma Rule Standard Special thx to @sifex for the hard work! Blog: medium.com/sigma-hq/intro… Explore now: sigmahq.io
sigma_hq's tweet image. We're pleased to announce the launch of our new website Access resources, documentation, and community projects to enhance your experience with the Sigma Rule Standard Special thx to @sifex for the hard work! Blog: medium.com/sigma-hq/intro… Explore now: sigmahq.io
sigma_hq's tweet image. We're pleased to announce the launch of our new website Access resources, documentation, and community projects to enhance your experience with the Sigma Rule Standard Special thx to @sifex for the hard work! Blog: medium.com/sigma-hq/intro… Explore now: sigmahq.io
1
72
203
42
101K
Andrea Naspi reposted
ginkgo_g's profile picture.
Ginkgo
 @ginkgo_g
Oct 8, 2023

#APT #Saaiwc #DarkPink #CVE-2023-38831 Keputusan Permohonan Mendapatkan Perkhidmatan Penceramah Luar Untuk Program Anjuran Kementerian Pertahanan\.zip ac28e93dbf337e8d1cc14a3e7352f061 fefe7fb2072d755b0bfdf74aa7c9013e Final payload is #TelePowerBot

ginkgo_g's tweet image. #APT #Saaiwc #DarkPink #CVE-2023-38831 Keputusan Permohonan Mendapatkan Perkhidmatan Penceramah Luar Untuk Program Anjuran Kementerian Pertahanan\.zip ac28e93dbf337e8d1cc14a3e7352f061 fefe7fb2072d755b0bfdf74aa7c9013e Final payload is #TelePowerBot
ginkgo_g's tweet image. #APT #Saaiwc #DarkPink #CVE-2023-38831 Keputusan Permohonan Mendapatkan Perkhidmatan Penceramah Luar Untuk Program Anjuran Kementerian Pertahanan\.zip ac28e93dbf337e8d1cc14a3e7352f061 fefe7fb2072d755b0bfdf74aa7c9013e Final payload is #TelePowerBot
0
11
35
5
5K

United States Trends

You might like

Something went wrong.


Something went wrong.