#malwarelabdaily search results

#MalwareLabDaily 0x114 Recently @NVISOsecurity found 6 private keys, which are used by hundreds of #CobaltStrike servers for encrypting the communication with the beacons. This communication can be now decrypted with @DidierStevens tools👍 #BlueTeam #DFIR blog.nviso.eu/2021/10/21/cob…

#MalwareLabDaily 0x113 Creative #captcha on #AvosLocker Press Releases #darknet website. #dataleaks #hackers #malware #ransomware #cybersecurity #darkweb #tor

#MalwareLabDaily 0x112 New book and interesting project dedicated to #ransomware. Read and learn about history of ransomware, what it is, how to prevent and how to remove it. And more. ransomware.org/what-is-ransom…

#MalwareLabDaily 0x111 #BlackByte #Ransomware was active mainly in August and it was interesting because it tries to kill @cyb3rops #Raccine specifically and Defender. It also performs common tasks such as disable VSS and other services @anyrun_app: app.any.run/tasks/27eb2089…

#MalwareLabDaily 0x110 Older, but still interesting analysis of leaked #Conti #ransomware playbooks by @j91321 Mapping to @MITREattack and their coverage by Atomic Red Team (@redcanary) and @sigma_hq rules. #BlueTeam #RedTeam #sigmarules #ATTACK github.com/j91321/conti-m…

#MalwareLabDaily 0x10F #ThreatHunting, #PowerShell, Fileless malware attacks. What to log and search + how to configure group policies. Event IDs 4103, 4104 for PowerShell, Event ID 4688 for process creation. Don't forget to include command line. #Windows socinvestigation.com/threat-hunting…

#MalwareLabDaily 0x10E @Sysinternals #Sysmon is often mentioned in various #BlueTeam, #ThreatHunting and #DFIR scenarios as a free tool to monitor #Windows system activity. Depending on the provided config, it can bring visibility into endpoints. Now, there is #Linux version, too

#MalwareLabDaily 0x10B #ThreatIntelligence summit #Predict by @RecordedFuture starts in couple of minutes. We will see lot of talks dedicated to #ransomware, #malware, #ThreatIntel, @MITREattack and more. recordedfuture.com/predict/#sched…

#MalwareLabDaily 0x109 Second part of the #Top10 free #malware analysis tools by @IstroSec. #Reversing for fun and education without funds is pretty possible with these tools. #Dotnet decompiler, #Java #Bytecodeviewer by @Konloch, #oletools by @decalage2, @peepdf and #wireshark

#MalwareLabDaily 0x108 The @VMware conference #VMworld2021 is scheduled for the next three days. There are also several talks dedicated to #security and especially malware. E.g., the Automating #ransomware remediation with the @vmw_carbonblack #cloud #SDK myevents.vmware.com/widget/vmware/…

#MalwareLabDaily 0x107 Two #free videos from @kaspersky online #ReverseEngineering course. Lets analyze @golang #malware used in the #SolarWinds attack 👍

#MalwareLabDaily 0x106 October is a #CybersecurityAwarenessMonth. On this occasion @RangeForce released their Community Challenge Series based on network forensics and #ReverseEngineering modules. Successful learners and participants will receive the digital badge via @credly

#MalwareLabDaily 0x105 #R2CON2021 talks start in less than 20 minutes. After yesterday opening and obfuscation workshop, today schedule offers @radareorg, @fridadotre, @qiling_io and other tools and non mainstream architectures. rada.re/con/2021/

#MalwareLabDaily 0x104 Webinar tomorrow, 29th September at 10:00 AM ET. Full Spectrum #CobaltStrike #Detection: A Technical Profile from @RecordedFuture’s Insikt Group #DFIR #ThreatHunting #ThreatIntelligence #BlueTeam #SOC #CSIRT go.recordedfuture.com/cobalt-strike-…

#MalwareLabDaily 0x103 #REvil as #ELF file = #Ransomware which is able to run on #Linux and encrypt your files in similar way as it does it on #Windows machines Next time someone tells you that Linux is more secure because there are no viruses for Linux, just show them this video

#MalwareLabDaily 0x102 #Malware often uses services for #persistence and "stealthy" execution. This #mindmap covers creation and detection of #Windows services for #blueteam, #dfir and #threathunting.

#MalwareLabDaily 0x101 Researchers compile list of #vulnerabilities abused by #ransomware gangs in 2021. @BleepinComputer article based on the work of @uuallan, @pancak3lullz and others. #Fortinet #Microsoft #Exchange #F5 #PaloAlto #QNAP, #Atlassian, etc. bleepingcomputer.com/news/security/…

#MalwareLabDaily 0x100 @HexRaysSA 2021 #Plugin Contest is over. Congratulations to the winners and all of the participants, there are new #IDAPro plugins and "toys" for the malware analyst's toolkit. Check them out at hex-rays.com/contests_detai…

#MalwareLabDaily 0xFF This is perfect yet still simple example how powerful #CyberChef is. This @GCHQ tool comes very handy during deobfuscation for decrypting/decoding the payloads and IOCs extraction (such as #doc example below). Moreover, it is used by #CTF players for puzzles

#MalwareLabDaily 0xFE #CobaltStrike detection - great report by @RecordedFuture. It covers host-based detections (initial access, persistence, lateral movement), network-based detecions (team server and beacon traffic) and keylogger detection and C2 blocking. #ThreatIntelligence

#MalwareLabDaily 0x101 Researchers compile list of #vulnerabilities abused by #ransomware gangs in 2021. @BleepinComputer article based on the work of @uuallan, @pancak3lullz and others. #Fortinet #Microsoft #Exchange #F5 #PaloAlto #QNAP, #Atlassian, etc. bleepingcomputer.com/news/security/…

#MalwareLabDaily 0x113 Creative #captcha on #AvosLocker Press Releases #darknet website. #dataleaks #hackers #malware #ransomware #cybersecurity #darkweb #tor

#MalwareLabDaily 0xF7 What information from web #proxy logs can we use and and how can we can use it to hunt or detect #malware and #threats? Blog post #ThreatHunting and #Detection with Web Proxy Logs by @Cyb3rMonk brings some ideas and #cheetsheet posts.bluraven.io/threat-hunting…

#MalwareLabDaily 0xC5 New #OpenSecurityTraining2 is now available ➡️ ost2.fyi There are learning paths for system #security, #securecoding and #vulnerability #exploitation, and #MalwareAnalysis. Keep doing what you do @OpenSecTraining 👍 #free #EducationForAll

#MalwareLabDaily 0x106 October is a #CybersecurityAwarenessMonth. On this occasion @RangeForce released their Community Challenge Series based on network forensics and #ReverseEngineering modules. Successful learners and participants will receive the digital badge via @credly

#MalwareLabDaily 0xF9 Some people think that for #MalwareAnalysis we need lot of expensive tools. However, we can deep dive into #reversing without funds, there are lot of #free tools. See this overview of #Top10 free #malware analysis tools by @IstroSec istrosec.com/blog/malware-a…

#MalwareLabDaily 0xEF Source code of #Babuk #ransomware leaked. #Windows, #ESXI and #NAS versions included. Thanks @vxunderground for notification. Leaked RAR archive contains decryptors for some of their victims, too.

#MalwareLabDaily 0xE7 Do you want to try #IncidentResponse and analysis of malware-related cases? There are couple of them on @LetsDefendIO: #REvil #Ransomware, #IcedID, #CobaltStrike. #printnightmare #vulnerability analysis is available, too. app.letsdefend.io/dfir/list/ #DFIR

#MalwareLabDaily 0xD7 @BlueTeamVillage @defcon talks will start in less than 30 minutes. There are topics dedicated to monitoring and #ThreatHunting with @securityonion, @osquery and @velocidex. There are also #forensics and #malware #packers workshops. dc29.blueteamvillage.org/call-for-conte…

#MalwareLabDaily 0xCE Analyzing #vulnerability CVE-2020-15999 in #libpng in #Chrome. Detailed blog with analysis of crash and buffer owerflow. @tetrane use their own interesting tool, #REVEN. There are also free demos available blog.tetrane.com/2021/CVE-2020-… tetrane.com/demos.html

#MalwareLabDaily 0xE6 Older #JavaScript interpreter from @avast_antivirus turned into interactive shell by @taviso for #vulnerability research. For details please see the link, however, the shell itself can be still used for #MalwareAnalysis in sandboxes. github.com/taviso/avscript

#MalwareLabDaily 0x110 Older, but still interesting analysis of leaked #Conti #ransomware playbooks by @j91321 Mapping to @MITREattack and their coverage by Atomic Red Team (@redcanary) and @sigma_hq rules. #BlueTeam #RedTeam #sigmarules #ATTACK github.com/j91321/conti-m…

#MalwareLabDaily 0xF6 And the answer is... Portable Executable. PE is the standard executable format in EFI environments and it can be booted by firmware.

#MalwareLabDaily 0xDB When analyzing a malware, we often need to check if some files are known good or not. There are databases such as #NSRL, however, for quick check against current version we can use #hashlookup by @circl_lu #REST + #DNS #API circl.lu/services/hashl… #DFIR

#MalwareLabDaily 0xC1 @MITREattack mappings for built-in #Microsoft @Azure #security controls. @msftsecurity @MITREengenuity #microsoftazurecloud #Azure #cybersecuritytips microsoft.com/security/blog/… …for-threat-informed-defense.github.io/security-stack…

#MalwareLabDaily 0xE8 #IDAPython Made Easy with #Sark - an object-oriented scripting layer/library written on top of IDAPython by @tmr232 . Simple #API, works with IDA 7.4+ and @python 3, older IDA still supported. sark.rtfd.io github.com/tmr232/Sark

#MalwareLabDaily 0xF2 New malware analysis service by @filescan_itsec. Free public instance available at filescan.io They also offer hourly public feeds with details 👍

#MalwareLabDaily 0x10C Using Genetic #MalwareAnalysis & Enrichment to Investigate #FancyBear - webinar by @OLRowley (@Maltego) and @AbbyMCH (@IntezerLabs) will start in approx. one hour. Registration is still open: register.gotowebinar.com/register/74698…

#MalwareLabDaily 0xC9 #CyberDaily email newsletter by @RecordedFuture is a concise yet valuable free source of daily #ThreatIntelligence. Also malware trends are clearly visible when something happen - e.g. #Pegasus, #REvil #Kaseya, #DearCry #ransomware go.recordedfuture.com/cyber-daily

#MalwareLabDaily 0x111 #BlackByte #Ransomware was active mainly in August and it was interesting because it tries to kill @cyb3rops #Raccine specifically and Defender. It also performs common tasks such as disable VSS and other services @anyrun_app: app.any.run/tasks/27eb2089…