cybermariusf's profile picture.

Marius

@cybermariusf

Marius reposted

🚨 New campaign: #Rhadamanthys #infostealer is being delivered by an in-browser fake Windows Update, abusing the Fullscreen API (on-click), and using #ClickFix-style lures to trick users: buff.ly/GNXh9Dk

joe4security's tweet image. 🚨 New campaign: #Rhadamanthys #infostealer is being delivered by an in-browser fake Windows Update, abusing the Fullscreen API (on-click), and using #ClickFix-style lures to trick users:

buff.ly/GNXh9Dk

Marius reposted

🚀 Introducing what is likely the first MCP (Model Context Protocol) server to feature dynamic and static malware analysis! 🔍 Explore it here: buff.ly/KX3FRI0 🧠 Powered by Joe Sandbox #CyberSecurity #MalwareAnalysis #AI #ModelContextProtocol #DFIR #ThreatIntel

joe4security's tweet image. 🚀 Introducing what is likely the first MCP (Model Context Protocol) server to feature dynamic and static malware analysis!

🔍 Explore it here: buff.ly/KX3FRI0
🧠 Powered by Joe Sandbox

#CyberSecurity #MalwareAnalysis #AI #ModelContextProtocol #DFIR #ThreatIntel

Marius reposted

Great Joe Sandbox catch of #Quishing (QR Code #Phishing)! Submit various file formats like PNG, JPEG, GIF, PDF, EML, MSG, and more. Live Interaction extracts the URL and opens it in Chrome automatically. joesandbox.com/analysis/12974…

joe4security's tweet image. Great Joe Sandbox catch of #Quishing (QR Code #Phishing)! Submit various file formats like PNG, JPEG, GIF, PDF, EML, MSG, and more. Live Interaction extracts the URL and opens it in Chrome automatically.  
joesandbox.com/analysis/12974…

Marius reposted

#Emotet is back, this time big and fat!!! Check-out the file size of this Office doc and Dll! joesandbox.com/analysis/82229…

joe4security's tweet image. #Emotet is back, this time big and fat!!! Check-out the file size of this Office doc and Dll!

joesandbox.com/analysis/82229…
joe4security's tweet image. #Emotet is back, this time big and fat!!! Check-out the file size of this Office doc and Dll!

joesandbox.com/analysis/82229…

Marius reposted

Level UP! With Joe Sandbox, you can now perform deep malware analysis on an Win10 Analyzer connected to a real DC (Server 2019, no crappy EMU)! Checkout the blog post for all the use-cases and info: joesecurity.org/blog/900813386… #malware #sigma #dfir #infosec

joe4security's tweet image. Level UP! With Joe Sandbox, you can now perform deep malware analysis on an Win10 Analyzer connected to a real DC (Server 2019, no crappy EMU)! Checkout the blog post for all the use-cases and info:

joesecurity.org/blog/900813386…

#malware #sigma #dfir #infosec
joe4security's tweet image. Level UP! With Joe Sandbox, you can now perform deep malware analysis on an Win10 Analyzer connected to a real DC (Server 2019, no crappy EMU)! Checkout the blog post for all the use-cases and info:

joesecurity.org/blog/900813386…

#malware #sigma #dfir #infosec
joe4security's tweet image. Level UP! With Joe Sandbox, you can now perform deep malware analysis on an Win10 Analyzer connected to a real DC (Server 2019, no crappy EMU)! Checkout the blog post for all the use-cases and info:

joesecurity.org/blog/900813386…

#malware #sigma #dfir #infosec
joe4security's tweet image. Level UP! With Joe Sandbox, you can now perform deep malware analysis on an Win10 Analyzer connected to a real DC (Server 2019, no crappy EMU)! Checkout the blog post for all the use-cases and info:

joesecurity.org/blog/900813386…

#malware #sigma #dfir #infosec

Marius reposted

#CVE-2021-40444 (MS / IE Office ZeroDay, MSHTML, 4c80dc9fb7483214b1613957aae57e2a) -> hxxp[:]//hidusi[.]com/e8c76295a5f9acb7/ministry.cab -> #CobaltStrike: joesandbox.com/analysis/47618… #malware #CVE #ZeroDay

joe4security's tweet image. #CVE-2021-40444 (MS / IE Office ZeroDay, MSHTML, 4c80dc9fb7483214b1613957aae57e2a) -> hxxp[:]//hidusi[.]com/e8c76295a5f9acb7/ministry.cab -> #CobaltStrike: joesandbox.com/analysis/47618… #malware #CVE #ZeroDay

Marius reposted

#GuLoader (dropping #formbook, #nanocore, #remcos, #agenttesla etc.) has updated its hammering loop from 11M to 268M instructions and added a new time source! If you want to bypass #sandboxes it is definitely the loader of choice! buff.ly/2JLZ4QR buff.ly/3nfKheM

joe4security's tweet image. #GuLoader (dropping #formbook, #nanocore, #remcos, #agenttesla etc.) has updated its hammering loop from 11M to 268M instructions and added a new time source! If you want to bypass #sandboxes it is definitely the loader of choice! buff.ly/2JLZ4QR buff.ly/3nfKheM

Marius reposted

Thanks to automated .NET decompliation Joe Sandbox detects the #SUNBURST backdoor in OrionImprovementBusinessLayer C# code! .NET decompliation is also applied to unpacked binaries: buff.ly/37pTiNX #malware #dfir #infosec

joe4security's tweet image. Thanks to automated .NET decompliation Joe Sandbox detects the #SUNBURST backdoor in OrionImprovementBusinessLayer C# code! .NET decompliation is also applied to unpacked binaries: buff.ly/37pTiNX #malware #dfir #infosec

Marius reposted

[Feature] We have successfully added memory dumping capabilities to Joe Sandbox - #macOS dynamic analysis! This enables customer Yara rules for unpacked code! buff.ly/2SVkewU #malware #dfir #infosec

joe4security's tweet image. [Feature] We have successfully added memory dumping capabilities to Joe Sandbox - #macOS dynamic analysis! This enables customer Yara rules for unpacked code! buff.ly/2SVkewU
#malware #dfir #infosec

Marius reposted

Recent #TrickBot is using some nice API hammering to evade #sandbox! Read more about how API hammering works in our latest blog post: buff.ly/2ZpIfQF #malware #dfir #infosec #evasive

joe4security's tweet image. Recent #TrickBot is using some nice API hammering to evade #sandbox! Read more about how API hammering works in our latest blog post: buff.ly/2ZpIfQF
#malware #dfir #infosec #evasive

Marius reposted

Fully automated Joe Sandbox X analysis of #EvilQuest #ransomware on Mac bare metal! Kudos to @objective_see for the cool blog post! buff.ly/3ghrCMB #malware #DFIR #macOS

joe4security's tweet image. Fully automated Joe Sandbox X analysis of #EvilQuest #ransomware on Mac bare metal! Kudos to @objective_see for the cool blog post!
buff.ly/3ghrCMB #malware #DFIR #macOS
joe4security's tweet image. Fully automated Joe Sandbox X analysis of #EvilQuest #ransomware on Mac bare metal! Kudos to @objective_see for the cool blog post!
buff.ly/3ghrCMB #malware #DFIR #macOS
joe4security's tweet image. Fully automated Joe Sandbox X analysis of #EvilQuest #ransomware on Mac bare metal! Kudos to @objective_see for the cool blog post!
buff.ly/3ghrCMB #malware #DFIR #macOS
joe4security's tweet image. Fully automated Joe Sandbox X analysis of #EvilQuest #ransomware on Mac bare metal! Kudos to @objective_see for the cool blog post!
buff.ly/3ghrCMB #malware #DFIR #macOS

Marius reposted

#COVID19 is not only infecting your body but also your computer's #MBR 😈😈😈 - at least this #virus (ref buff.ly/3bKEFDW). Guess what the "Remove virus" button is just fake 😂 buff.ly/341pdkm #malware #dfir #infosec

joe4security's tweet image. #COVID19 is not only infecting your body but also your computer's #MBR 😈😈😈 - at least this #virus (ref buff.ly/3bKEFDW). Guess what the "Remove virus" button is just fake 😂 

 buff.ly/341pdkm

#malware #dfir #infosec

Marius reposted

Ensemble et solidaires. Et vous, que faites-vous? Racontez-le avec le hashtag #voicicommentnousprotéger et lancez le défi à trois autres personnes. Je défie @christarigozzi, @stressmusic et @rogerfederer. Et n’oubliez pas: restez le plus possible à la maison!


Marius reposted

Interested in LOLBins? Here is an example maldoc using cmstp.exe (Connection Manager) 🔗virustotal.com/gui/file/6f462… 🔬gist.github.com/JohnLaTwC/0eea… 🎁@joe4security joesandbox.com/analysis/21371… See the excellent research by @oddvarmoe 🧠oddvar.moe/2017/08/15/res… 😆🗃️lolbas-project.github.io/lolbas/Binarie…

JohnLaTwC's tweet image. Interested in LOLBins? Here is an example maldoc using cmstp.exe (Connection Manager)
🔗virustotal.com/gui/file/6f462…
🔬gist.github.com/JohnLaTwC/0eea…
🎁@joe4security joesandbox.com/analysis/21371…

See the excellent research by @oddvarmoe
🧠oddvar.moe/2017/08/15/res…
😆🗃️lolbas-project.github.io/lolbas/Binarie…
JohnLaTwC's tweet image. Interested in LOLBins? Here is an example maldoc using cmstp.exe (Connection Manager)
🔗virustotal.com/gui/file/6f462…
🔬gist.github.com/JohnLaTwC/0eea…
🎁@joe4security joesandbox.com/analysis/21371…

See the excellent research by @oddvarmoe
🧠oddvar.moe/2017/08/15/res…
😆🗃️lolbas-project.github.io/lolbas/Binarie…
JohnLaTwC's tweet image. Interested in LOLBins? Here is an example maldoc using cmstp.exe (Connection Manager)
🔗virustotal.com/gui/file/6f462…
🔬gist.github.com/JohnLaTwC/0eea…
🎁@joe4security joesandbox.com/analysis/21371…

See the excellent research by @oddvarmoe
🧠oddvar.moe/2017/08/15/res…
😆🗃️lolbas-project.github.io/lolbas/Binarie…
JohnLaTwC's tweet image. Interested in LOLBins? Here is an example maldoc using cmstp.exe (Connection Manager)
🔗virustotal.com/gui/file/6f462…
🔬gist.github.com/JohnLaTwC/0eea…
🎁@joe4security joesandbox.com/analysis/21371…

See the excellent research by @oddvarmoe
🧠oddvar.moe/2017/08/15/res…
😆🗃️lolbas-project.github.io/lolbas/Binarie…

Marius reposted

You don't have a Malware Analysis Lab, but want one? Check-out Joe Lab - the Industry's first Cloud based Malware Analysis Lab built for CERTs, CIRTs, SOCs and malware analysts: buff.ly/2Ty3ICX #dfir #infosec #LAB

joe4security's tweet image. You don't have a Malware Analysis Lab, but want one? Check-out Joe Lab - the Industry's first Cloud based Malware Analysis Lab built for CERTs, CIRTs, SOCs and malware analysts: buff.ly/2Ty3ICX #dfir #infosec #LAB

Marius reposted

[Analysis] of #macOS GMERA spying on sensitive data like documents, screenshots, WiFi networks and connecting back to C&C via reverse-shell. GMERA.A: buff.ly/2nuCpxc GMERA.B: buff.ly/2AUFRUX #malware #DFIR

joe4security's tweet image. [Analysis] of #macOS GMERA spying on sensitive data like documents, screenshots, WiFi networks and connecting back to C&C via reverse-shell.
GMERA.A: buff.ly/2nuCpxc 
GMERA.B: buff.ly/2AUFRUX 
#malware #DFIR
joe4security's tweet image. [Analysis] of #macOS GMERA spying on sensitive data like documents, screenshots, WiFi networks and connecting back to C&C via reverse-shell.
GMERA.A: buff.ly/2nuCpxc 
GMERA.B: buff.ly/2AUFRUX 
#malware #DFIR
joe4security's tweet image. [Analysis] of #macOS GMERA spying on sensitive data like documents, screenshots, WiFi networks and connecting back to C&C via reverse-shell.
GMERA.A: buff.ly/2nuCpxc 
GMERA.B: buff.ly/2AUFRUX 
#malware #DFIR
joe4security's tweet image. [Analysis] of #macOS GMERA spying on sensitive data like documents, screenshots, WiFi networks and connecting back to C&C via reverse-shell.
GMERA.A: buff.ly/2nuCpxc 
GMERA.B: buff.ly/2AUFRUX 
#malware #DFIR

Marius reposted

Great article of @McAfee_Labs on the evolution of #malware #sandbox evasion tactics (buff.ly/2LL7kxt). Summary: the future of sandboxing will be the bare metal analysis environment. Joe Sandbox supports this since 2015! Check it out: buff.ly/2ZPodAN #DFIR

joe4security's tweet image. Great article of @McAfee_Labs on the evolution of #malware #sandbox evasion tactics (buff.ly/2LL7kxt). Summary: the future of sandboxing will be the bare metal analysis environment. Joe Sandbox supports this since 2015! Check it out: buff.ly/2ZPodAN #DFIR

Marius reposted

Data privacy is critically important to us. Check out our latest blog post to see the measures we take to keep samples and IOCs private and safe. buff.ly/2YaSq7J #security #privacy #cloud #DFIR

joe4security's tweet image. Data privacy is critically important to us. Check out our latest blog post to see the measures we take to keep samples and IOCs private and safe. buff.ly/2YaSq7J  #security #privacy #cloud #DFIR

Marius reposted

[Analysis] #AgentSmith has infected over 25M #Android devices. Big code base with #Smali / #BackSmali based code injector! Multiple 1-days. Main payload: show ads! Analysis Report: buff.ly/30wvB02 Source Code Report: buff.ly/2LhW4La #malware #difr #infosec

joe4security's tweet image. [Analysis] #AgentSmith has infected over 25M #Android devices. Big code base with #Smali / #BackSmali based code injector! Multiple 1-days.  Main payload: show ads!

Analysis Report: buff.ly/30wvB02
Source Code Report: buff.ly/2LhW4La

#malware #difr #infosec

Loading...

Something went wrong.


Something went wrong.