#vincss search results

🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet. ⚔️Use random exported function name, not DllRegisterServer. ⚔️Push the xor key to another param. ⚔️The ECC key decryption function does not include the size param. Thanks @Myrtus0x0 #VinCSS

kienbigmummy's tweet image. 🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet.
⚔️Use random exported function name, not DllRegisterServer.
⚔️Push the xor key to another param.
⚔️The ECC key decryption function does not include the size param.
Thanks @Myrtus0x0
#VinCSS
kienbigmummy's tweet image. 🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet.
⚔️Use random exported function name, not DllRegisterServer.
⚔️Push the xor key to another param.
⚔️The ECC key decryption function does not include the size param.
Thanks @Myrtus0x0
#VinCSS
kienbigmummy's tweet image. 🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet.
⚔️Use random exported function name, not DllRegisterServer.
⚔️Push the xor key to another param.
⚔️The ECC key decryption function does not include the size param.
Thanks @Myrtus0x0
#VinCSS

⚔️This payload still uses the old decryption method with xor_key is "123456789". (2/2) 📄Connect to C2s: 185[.]239[.]226[.]5:108 185[.]239[.]226[.]5:111 185[.]239[.]226[.]5:438 185[.]239[.]226[.]5:236 #VinCSS #malwareanalysis

kienbigmummy's tweet image. ⚔️This payload still uses the old decryption method with xor_key is "123456789". (2/2)
📄Connect to C2s:
185[.]239[.]226[.]5:108
185[.]239[.]226[.]5:111
185[.]239[.]226[.]5:438
185[.]239[.]226[.]5:236
#VinCSS #malwareanalysis
kienbigmummy's tweet image. ⚔️This payload still uses the old decryption method with xor_key is "123456789". (2/2)
📄Connect to C2s:
185[.]239[.]226[.]5:108
185[.]239[.]226[.]5:111
185[.]239[.]226[.]5:438
185[.]239[.]226[.]5:236
#VinCSS #malwareanalysis

#Follina #CVE-2022-30190 Submitted from Viet Nam. Someone try to create a POC? #VinCSS #MalwareAnalysis

kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis

My colleague sharing his research about #IDA #microcode and how to write a simple plugin. #VinCSS blog.vincss.net/2021/10/re024-…

kienbigmummy's tweet image. My colleague sharing his research about #IDA #microcode and how to write a simple plugin. #VinCSS
blog.vincss.net/2021/10/re024-…
kienbigmummy's tweet image. My colleague sharing his research about #IDA #microcode and how to write a simple plugin. #VinCSS
blog.vincss.net/2021/10/re024-…
kienbigmummy's tweet image. My colleague sharing his research about #IDA #microcode and how to write a simple plugin. #VinCSS
blog.vincss.net/2021/10/re024-…

#Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade Check it out: blog.vincss.net/2021/03/re021-…

kienbigmummy's tweet image. #Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade 
Check it out: blog.vincss.net/2021/03/re021-…
kienbigmummy's tweet image. #Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade 
Check it out: blog.vincss.net/2021/03/re021-…
kienbigmummy's tweet image. #Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade 
Check it out: blog.vincss.net/2021/03/re021-…
kienbigmummy's tweet image. #Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade 
Check it out: blog.vincss.net/2021/03/re021-…

🔥 #Qakbot malware has now changed its tactics, now using the .msi file to infect instead of using XLM macros as before. 👹Sample hash: c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad (1/3) #VinCSS #MalwareAnalysis

kienbigmummy's tweet image. 🔥 #Qakbot malware has now changed its tactics, now using the .msi file to infect instead of using XLM macros as before.
👹Sample hash: c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
(1/3) #VinCSS #MalwareAnalysis

Through cyber security monitoring, #VinCSS has discovered a document containing malicious code with Vietnamese content that was found by @ShadowChasing1 group. This is Part 1 in a series of analyzes this sample: blog.vincss.net/2021/05/re022-…

kienbigmummy's tweet image. Through cyber security monitoring, #VinCSS has discovered a document containing malicious code with Vietnamese content that was found by @ShadowChasing1 group. This is Part 1 in a series of analyzes this sample: blog.vincss.net/2021/05/re022-…
kienbigmummy's tweet image. Through cyber security monitoring, #VinCSS has discovered a document containing malicious code with Vietnamese content that was found by @ShadowChasing1 group. This is Part 1 in a series of analyzes this sample: blog.vincss.net/2021/05/re022-…
kienbigmummy's tweet image. Through cyber security monitoring, #VinCSS has discovered a document containing malicious code with Vietnamese content that was found by @ShadowChasing1 group. This is Part 1 in a series of analyzes this sample: blog.vincss.net/2021/05/re022-…
kienbigmummy's tweet image. Through cyber security monitoring, #VinCSS has discovered a document containing malicious code with Vietnamese content that was found by @ShadowChasing1 group. This is Part 1 in a series of analyzes this sample: blog.vincss.net/2021/05/re022-…

🔥My Deep Dive into #Zloader - the Silent Night 👹 Including: ⚔️Unpack Zloader Core Dll ⚔️Decrypt strings used by Zloader ⚔️Apply #AppCall to recover the Windows API calls. ⚔️Process Injection technique ⚔️Decrypt configuration tinyurl.com/2p82p4yn #VinCSS #malwareanalysis

kienbigmummy's tweet image. 🔥My Deep Dive into #Zloader - the Silent Night 👹
Including:
⚔️Unpack Zloader Core Dll
⚔️Decrypt strings used by Zloader
⚔️Apply #AppCall to recover the Windows API calls.
⚔️Process Injection technique
⚔️Decrypt configuration
tinyurl.com/2p82p4yn
#VinCSS #malwareanalysis
kienbigmummy's tweet image. 🔥My Deep Dive into #Zloader - the Silent Night 👹
Including:
⚔️Unpack Zloader Core Dll
⚔️Decrypt strings used by Zloader
⚔️Apply #AppCall to recover the Windows API calls.
⚔️Process Injection technique
⚔️Decrypt configuration
tinyurl.com/2p82p4yn
#VinCSS #malwareanalysis
kienbigmummy's tweet image. 🔥My Deep Dive into #Zloader - the Silent Night 👹
Including:
⚔️Unpack Zloader Core Dll
⚔️Decrypt strings used by Zloader
⚔️Apply #AppCall to recover the Windows API calls.
⚔️Process Injection technique
⚔️Decrypt configuration
tinyurl.com/2p82p4yn
#VinCSS #malwareanalysis
kienbigmummy's tweet image. 🔥My Deep Dive into #Zloader - the Silent Night 👹
Including:
⚔️Unpack Zloader Core Dll
⚔️Decrypt strings used by Zloader
⚔️Apply #AppCall to recover the Windows API calls.
⚔️Process Injection technique
⚔️Decrypt configuration
tinyurl.com/2p82p4yn
#VinCSS #malwareanalysis

🔥#Emotet👹 When we show off...Ivan kept silent. When Ivan comeback, we cried 😭... I have to shift del my scripts..Now they're useless!!!!🤢 #VinCSS #MalwareAnalysis

kienbigmummy's tweet image. 🔥#Emotet👹 When we show off...Ivan kept silent. When Ivan comeback, we cried 😭... I have to shift del my scripts..Now they're useless!!!!🤢
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. 🔥#Emotet👹 When we show off...Ivan kept silent. When Ivan comeback, we cried 😭... I have to shift del my scripts..Now they're useless!!!!🤢
#VinCSS #MalwareAnalysis

Based on the hashes of the samples provided by ESET, we have not only re-analyzed them, but also digged deeper. we have discovered a new RAT, which is named #ElephantRat. #VinCSS #SupplyChains #MalwareAnalysis [Eng] blog.vincss.net/2021/02/re020-… [Vie] blog.vincss.net/2021/02/re020-…

kienbigmummy's tweet image. Based on the hashes of the samples provided by ESET, we have not only re-analyzed them, but also digged deeper.  we have discovered a new RAT, which is named #ElephantRat. #VinCSS #SupplyChains #MalwareAnalysis
[Eng] blog.vincss.net/2021/02/re020-…
[Vie] blog.vincss.net/2021/02/re020-…
kienbigmummy's tweet image. Based on the hashes of the samples provided by ESET, we have not only re-analyzed them, but also digged deeper.  we have discovered a new RAT, which is named #ElephantRat. #VinCSS #SupplyChains #MalwareAnalysis
[Eng] blog.vincss.net/2021/02/re020-…
[Vie] blog.vincss.net/2021/02/re020-…
kienbigmummy's tweet image. Based on the hashes of the samples provided by ESET, we have not only re-analyzed them, but also digged deeper.  we have discovered a new RAT, which is named #ElephantRat. #VinCSS #SupplyChains #MalwareAnalysis
[Eng] blog.vincss.net/2021/02/re020-…
[Vie] blog.vincss.net/2021/02/re020-…

Good News CEO of VinCSS, Simon Trac Do will be a featured speaker at the prestigious FIDO Alliance Seoul Public Seminar. Time: December 5th (Tuesday), 2023! 🔍 Topic: FDO (FIDO Device Onboard) Application Case - Vietnam 📍 Location: Seoul, South Korea #VinCSS #FIDOAlliance

Nhhai0406Hai's tweet image. Good News

CEO of VinCSS, Simon Trac Do  will be a featured speaker at the prestigious FIDO Alliance Seoul Public Seminar.

Time: December 5th (Tuesday), 2023!

🔍 Topic: FDO (FIDO Device Onboard) Application Case - Vietnam
📍 Location: Seoul, South Korea

#VinCSS #FIDOAlliance

Credit to my colleague @tqkve. In this post, he will show how to exploit #CVE_2021_22986 #VinCSS #BIG_IP #F5 blog.vincss.net/2021/03/ex006-…

kienbigmummy's tweet image. Credit to my colleague @tqkve. In this post, he will show how to exploit #CVE_2021_22986 #VinCSS #BIG_IP #F5
blog.vincss.net/2021/03/ex006-…
kienbigmummy's tweet image. Credit to my colleague @tqkve. In this post, he will show how to exploit #CVE_2021_22986 #VinCSS #BIG_IP #F5
blog.vincss.net/2021/03/ex006-…

🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group. [En]: tinyurl.com/yckjb6rr [Vi]: tinyurl.com/yj5t8z6r #VinCSS #malwareanalysis #threathunting

kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting
kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting
kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting
kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting

#VinHMS just wrapped our first-ever joint Year End Party with #VinCSS! Proud to see both teams—each with 6 years of growth—come together as fellow Vingroup tech companies. From spring performances to honoring top employees, it was a celebration of collaboration and innovation. 🚀

hoangnv's tweet image. #VinHMS just wrapped our first-ever joint Year End Party with #VinCSS! Proud to see both teams—each with 6 years of growth—come together as fellow Vingroup tech companies. From spring performances to honoring top employees, it was a celebration of collaboration and innovation. 🚀
hoangnv's tweet image. #VinHMS just wrapped our first-ever joint Year End Party with #VinCSS! Proud to see both teams—each with 6 years of growth—come together as fellow Vingroup tech companies. From spring performances to honoring top employees, it was a celebration of collaboration and innovation. 🚀
hoangnv's tweet image. #VinHMS just wrapped our first-ever joint Year End Party with #VinCSS! Proud to see both teams—each with 6 years of growth—come together as fellow Vingroup tech companies. From spring performances to honoring top employees, it was a celebration of collaboration and innovation. 🚀
hoangnv's tweet image. #VinHMS just wrapped our first-ever joint Year End Party with #VinCSS! Proud to see both teams—each with 6 years of growth—come together as fellow Vingroup tech companies. From spring performances to honoring top employees, it was a celebration of collaboration and innovation. 🚀

At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique. [Eng]tinyurl.com/mrshmhp9 [Vie]tinyurl.com/mr3k6svd

kienbigmummy's tweet image. At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique.
[Eng]tinyurl.com/mrshmhp9
[Vie]tinyurl.com/mr3k6svd
kienbigmummy's tweet image. At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique.
[Eng]tinyurl.com/mrshmhp9
[Vie]tinyurl.com/mr3k6svd
kienbigmummy's tweet image. At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique.
[Eng]tinyurl.com/mrshmhp9
[Vie]tinyurl.com/mr3k6svd

Celebrating 5 Amazing Years VinCSS! We're thrilled to share our journey in this special video From humble beginnings to remarkable achievements, it's been a fantastic ride with the VinCSS family #VinCSS #5thAnniversary #Cybersecurity #Passwordless #EnteringSeriesBGoingGlobal

Nhhai0406Hai's tweet image. Celebrating 5 Amazing Years VinCSS!  We're thrilled to share our journey in this special video

From humble beginnings to remarkable achievements, it's been a fantastic ride with the VinCSS family #VinCSS #5thAnniversary #Cybersecurity #Passwordless #EnteringSeriesBGoingGlobal
Nhhai0406Hai's tweet image. Celebrating 5 Amazing Years VinCSS!  We're thrilled to share our journey in this special video

From humble beginnings to remarkable achievements, it's been a fantastic ride with the VinCSS family #VinCSS #5thAnniversary #Cybersecurity #Passwordless #EnteringSeriesBGoingGlobal
Nhhai0406Hai's tweet image. Celebrating 5 Amazing Years VinCSS!  We're thrilled to share our journey in this special video

From humble beginnings to remarkable achievements, it's been a fantastic ride with the VinCSS family #VinCSS #5thAnniversary #Cybersecurity #Passwordless #EnteringSeriesBGoingGlobal

Another fantastic journey has come to an end, again. Today, I end my journey with VinCSS Cyber. Thank you VinCSS for another great journey! #DrTekFarmer #Farewell #VinCSS

DrPhilipCao's tweet image. Another fantastic journey has come to an end, again. Today, I end my journey with VinCSS Cyber. Thank you VinCSS for another great journey!

#DrTekFarmer #Farewell #VinCSS

VinCSS Applauded by Frost & Sullivan for its Pioneering FIDO IoT Device Onboarding (FDO) Security and its Transformational Innovation Leadership theindustrial.in/news/4b20f9000… #VinCSS #FrostAndSullivan #FIDO #IoTSecurity #FDO #TechInnovation #CyberSecurity #IoTDevices #SecureOnboarding

theindustrialfc's tweet image. VinCSS Applauded by Frost & Sullivan for its Pioneering FIDO IoT Device Onboarding (FDO) Security and its Transformational Innovation Leadership
theindustrial.in/news/4b20f9000…
#VinCSS #FrostAndSullivan #FIDO #IoTSecurity #FDO #TechInnovation #CyberSecurity #IoTDevices #SecureOnboarding

#VinHMS just wrapped our first-ever joint Year End Party with #VinCSS! Proud to see both teams—each with 6 years of growth—come together as fellow Vingroup tech companies. From spring performances to honoring top employees, it was a celebration of collaboration and innovation. 🚀

hoangnv's tweet image. #VinHMS just wrapped our first-ever joint Year End Party with #VinCSS! Proud to see both teams—each with 6 years of growth—come together as fellow Vingroup tech companies. From spring performances to honoring top employees, it was a celebration of collaboration and innovation. 🚀
hoangnv's tweet image. #VinHMS just wrapped our first-ever joint Year End Party with #VinCSS! Proud to see both teams—each with 6 years of growth—come together as fellow Vingroup tech companies. From spring performances to honoring top employees, it was a celebration of collaboration and innovation. 🚀
hoangnv's tweet image. #VinHMS just wrapped our first-ever joint Year End Party with #VinCSS! Proud to see both teams—each with 6 years of growth—come together as fellow Vingroup tech companies. From spring performances to honoring top employees, it was a celebration of collaboration and innovation. 🚀
hoangnv's tweet image. #VinHMS just wrapped our first-ever joint Year End Party with #VinCSS! Proud to see both teams—each with 6 years of growth—come together as fellow Vingroup tech companies. From spring performances to honoring top employees, it was a celebration of collaboration and innovation. 🚀

Uncover how Vietnam’s very first digital bank, Timo, safeguard its users! Learn how they help enrich your life and secure your assets in the chaotic digital landscape. These valuable insights will be revealed by Timo’s CEO and CISO #VinCSS #TimoDigitalBank #IntoTheCyberverse


Another fantastic journey has come to an end, again. Today, I end my journey with VinCSS Cyber. Thank you VinCSS for another great journey! #DrTekFarmer #Farewell #VinCSS

DrPhilipCao's tweet image. Another fantastic journey has come to an end, again. Today, I end my journey with VinCSS Cyber. Thank you VinCSS for another great journey!

#DrTekFarmer #Farewell #VinCSS

Good News CEO of VinCSS, Simon Trac Do will be a featured speaker at the prestigious FIDO Alliance Seoul Public Seminar. Time: December 5th (Tuesday), 2023! 🔍 Topic: FDO (FIDO Device Onboard) Application Case - Vietnam 📍 Location: Seoul, South Korea #VinCSS #FIDOAlliance

Nhhai0406Hai's tweet image. Good News

CEO of VinCSS, Simon Trac Do  will be a featured speaker at the prestigious FIDO Alliance Seoul Public Seminar.

Time: December 5th (Tuesday), 2023!

🔍 Topic: FDO (FIDO Device Onboard) Application Case - Vietnam
📍 Location: Seoul, South Korea

#VinCSS #FIDOAlliance

Celebrating 5 Amazing Years VinCSS! We're thrilled to share our journey in this special video From humble beginnings to remarkable achievements, it's been a fantastic ride with the VinCSS family #VinCSS #5thAnniversary #Cybersecurity #Passwordless #EnteringSeriesBGoingGlobal

Nhhai0406Hai's tweet image. Celebrating 5 Amazing Years VinCSS!  We're thrilled to share our journey in this special video

From humble beginnings to remarkable achievements, it's been a fantastic ride with the VinCSS family #VinCSS #5thAnniversary #Cybersecurity #Passwordless #EnteringSeriesBGoingGlobal
Nhhai0406Hai's tweet image. Celebrating 5 Amazing Years VinCSS!  We're thrilled to share our journey in this special video

From humble beginnings to remarkable achievements, it's been a fantastic ride with the VinCSS family #VinCSS #5thAnniversary #Cybersecurity #Passwordless #EnteringSeriesBGoingGlobal
Nhhai0406Hai's tweet image. Celebrating 5 Amazing Years VinCSS!  We're thrilled to share our journey in this special video

From humble beginnings to remarkable achievements, it's been a fantastic ride with the VinCSS family #VinCSS #5thAnniversary #Cybersecurity #Passwordless #EnteringSeriesBGoingGlobal

VINCSS ON FRONTIER ENTERPRISE In a recent interview with Frontier Enterprise magazine, Mr. Simon Trac Do, the CEO of VinCSS, discussed the challenges and opportunities of implementing FIDO standards in Vietnam and the Asia Pacific region.#VinCSS #Passwordless #FIDO2

VinCSSCyber's tweet image. VINCSS ON FRONTIER ENTERPRISE
In a recent interview with Frontier Enterprise magazine, Mr. Simon Trac Do, the CEO of VinCSS, discussed the challenges and opportunities of implementing FIDO standards in Vietnam and the Asia Pacific region.#VinCSS #Passwordless #FIDO2

NewswireToday / VinCSS Applauded by Frost & Sullivan for Reducing Security Risks Associated with Traditional Authentication Technologies #Frost_Sullivan #_VinCSS_ #VinCSS #Authentication #FIDO2 #Passwordless #IoT #ITSecurity #AntiSpam #Cybersecurity - newswiretoday.com/news/180864/


I'm going to share about "Phishing attack failed on Passwordless" at the FIDO APAC SUMMIT 2023 event, organized by FIDO Alliance and VinCSS #cybersecurity #vincss #fido2 #passwordless #phishing

HHieupc's tweet image. I'm going to share about "Phishing attack failed on Passwordless" at the FIDO APAC SUMMIT 2023 event, organized by FIDO Alliance and VinCSS

#cybersecurity #vincss #fido2 #passwordless #phishing

NewswireToday / VinCSS Applauded by Frost & Sullivan for Enabling the Protection of Users, Devices, and Data from Password-related Attacks #Frost_Sullivan #VinCSS #Protection #IAM #FIDO2 #Passwordless #IoT #Identity #ITSecurity #AntiSpam #Cybersecurity - newswiretoday.com/news/178964/


⚔️This payload still uses the old decryption method with xor_key is "123456789". (2/2) 📄Connect to C2s: 185[.]239[.]226[.]5:108 185[.]239[.]226[.]5:111 185[.]239[.]226[.]5:438 185[.]239[.]226[.]5:236 #VinCSS #malwareanalysis

kienbigmummy's tweet image. ⚔️This payload still uses the old decryption method with xor_key is "123456789". (2/2)
📄Connect to C2s:
185[.]239[.]226[.]5:108
185[.]239[.]226[.]5:111
185[.]239[.]226[.]5:438
185[.]239[.]226[.]5:236
#VinCSS #malwareanalysis
kienbigmummy's tweet image. ⚔️This payload still uses the old decryption method with xor_key is "123456789". (2/2)
📄Connect to C2s:
185[.]239[.]226[.]5:108
185[.]239[.]226[.]5:111
185[.]239[.]226[.]5:438
185[.]239[.]226[.]5:236
#VinCSS #malwareanalysis

At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique. [Eng]tinyurl.com/mrshmhp9 [Vie]tinyurl.com/mr3k6svd

kienbigmummy's tweet image. At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique.
[Eng]tinyurl.com/mrshmhp9
[Vie]tinyurl.com/mr3k6svd
kienbigmummy's tweet image. At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique.
[Eng]tinyurl.com/mrshmhp9
[Vie]tinyurl.com/mr3k6svd
kienbigmummy's tweet image. At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique.
[Eng]tinyurl.com/mrshmhp9
[Vie]tinyurl.com/mr3k6svd

#Follina #CVE-2022-30190 Submitted from Viet Nam. Someone try to create a POC? #VinCSS #MalwareAnalysis

kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis

🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group. [En]: tinyurl.com/yckjb6rr [Vi]: tinyurl.com/yj5t8z6r #VinCSS #malwareanalysis #threathunting

kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting
kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting
kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting
kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting

🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet. ⚔️Use random exported function name, not DllRegisterServer. ⚔️Push the xor key to another param. ⚔️The ECC key decryption function does not include the size param. Thanks @Myrtus0x0 #VinCSS

kienbigmummy's tweet image. 🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet.
⚔️Use random exported function name, not DllRegisterServer.
⚔️Push the xor key to another param.
⚔️The ECC key decryption function does not include the size param.
Thanks @Myrtus0x0
#VinCSS
kienbigmummy's tweet image. 🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet.
⚔️Use random exported function name, not DllRegisterServer.
⚔️Push the xor key to another param.
⚔️The ECC key decryption function does not include the size param.
Thanks @Myrtus0x0
#VinCSS
kienbigmummy's tweet image. 🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet.
⚔️Use random exported function name, not DllRegisterServer.
⚔️Push the xor key to another param.
⚔️The ECC key decryption function does not include the size param.
Thanks @Myrtus0x0
#VinCSS

A quick sum up about the "heaven's gate" technique.. blog.vincss.net/2020/06/re015-… #VinCSS #HeavensGate

kienbigmummy's tweet image. A quick sum up about the "heaven's gate" technique.. blog.vincss.net/2020/06/re015-… #VinCSS #HeavensGate
kienbigmummy's tweet image. A quick sum up about the "heaven's gate" technique.. blog.vincss.net/2020/06/re015-… #VinCSS #HeavensGate

⚔️This payload still uses the old decryption method with xor_key is "123456789". (2/2) 📄Connect to C2s: 185[.]239[.]226[.]5:108 185[.]239[.]226[.]5:111 185[.]239[.]226[.]5:438 185[.]239[.]226[.]5:236 #VinCSS #malwareanalysis

kienbigmummy's tweet image. ⚔️This payload still uses the old decryption method with xor_key is "123456789". (2/2)
📄Connect to C2s:
185[.]239[.]226[.]5:108
185[.]239[.]226[.]5:111
185[.]239[.]226[.]5:438
185[.]239[.]226[.]5:236
#VinCSS #malwareanalysis
kienbigmummy's tweet image. ⚔️This payload still uses the old decryption method with xor_key is "123456789". (2/2)
📄Connect to C2s:
185[.]239[.]226[.]5:108
185[.]239[.]226[.]5:111
185[.]239[.]226[.]5:438
185[.]239[.]226[.]5:236
#VinCSS #malwareanalysis

#VinCSS from ThaiCERT: "Threat Group Cards: A Threat Actor Encyclopedia"

kienbigmummy's tweet image. #VinCSS from ThaiCERT: "Threat Group Cards: A Threat Actor Encyclopedia"

🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet. ⚔️Use random exported function name, not DllRegisterServer. ⚔️Push the xor key to another param. ⚔️The ECC key decryption function does not include the size param. Thanks @Myrtus0x0 #VinCSS

kienbigmummy's tweet image. 🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet.
⚔️Use random exported function name, not DllRegisterServer.
⚔️Push the xor key to another param.
⚔️The ECC key decryption function does not include the size param.
Thanks @Myrtus0x0
#VinCSS
kienbigmummy's tweet image. 🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet.
⚔️Use random exported function name, not DllRegisterServer.
⚔️Push the xor key to another param.
⚔️The ECC key decryption function does not include the size param.
Thanks @Myrtus0x0
#VinCSS
kienbigmummy's tweet image. 🔥#Emotet👹Some minor changes that Ivan has made between recent versions of Emotet.
⚔️Use random exported function name, not DllRegisterServer.
⚔️Push the xor key to another param.
⚔️The ECC key decryption function does not include the size param.
Thanks @Myrtus0x0
#VinCSS

#Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade Check it out: blog.vincss.net/2021/03/re021-…

kienbigmummy's tweet image. #Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade 
Check it out: blog.vincss.net/2021/03/re021-…
kienbigmummy's tweet image. #Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade 
Check it out: blog.vincss.net/2021/03/re021-…
kienbigmummy's tweet image. #Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade 
Check it out: blog.vincss.net/2021/03/re021-…
kienbigmummy's tweet image. #Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade 
Check it out: blog.vincss.net/2021/03/re021-…

#Follina #CVE-2022-30190 Submitted from Viet Nam. Someone try to create a POC? #VinCSS #MalwareAnalysis

kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. #Follina #CVE-2022-30190 
Submitted from Viet Nam. Someone try to create a POC?
#VinCSS #MalwareAnalysis

Based on the hashes of the samples provided by ESET, we have not only re-analyzed them, but also digged deeper. we have discovered a new RAT, which is named #ElephantRat. #VinCSS #SupplyChains #MalwareAnalysis [Eng] blog.vincss.net/2021/02/re020-… [Vie] blog.vincss.net/2021/02/re020-…

kienbigmummy's tweet image. Based on the hashes of the samples provided by ESET, we have not only re-analyzed them, but also digged deeper.  we have discovered a new RAT, which is named #ElephantRat. #VinCSS #SupplyChains #MalwareAnalysis
[Eng] blog.vincss.net/2021/02/re020-…
[Vie] blog.vincss.net/2021/02/re020-…
kienbigmummy's tweet image. Based on the hashes of the samples provided by ESET, we have not only re-analyzed them, but also digged deeper.  we have discovered a new RAT, which is named #ElephantRat. #VinCSS #SupplyChains #MalwareAnalysis
[Eng] blog.vincss.net/2021/02/re020-…
[Vie] blog.vincss.net/2021/02/re020-…
kienbigmummy's tweet image. Based on the hashes of the samples provided by ESET, we have not only re-analyzed them, but also digged deeper.  we have discovered a new RAT, which is named #ElephantRat. #VinCSS #SupplyChains #MalwareAnalysis
[Eng] blog.vincss.net/2021/02/re020-…
[Vie] blog.vincss.net/2021/02/re020-…

My colleague sharing his research about #IDA #microcode and how to write a simple plugin. #VinCSS blog.vincss.net/2021/10/re024-…

kienbigmummy's tweet image. My colleague sharing his research about #IDA #microcode and how to write a simple plugin. #VinCSS
blog.vincss.net/2021/10/re024-…
kienbigmummy's tweet image. My colleague sharing his research about #IDA #microcode and how to write a simple plugin. #VinCSS
blog.vincss.net/2021/10/re024-…
kienbigmummy's tweet image. My colleague sharing his research about #IDA #microcode and how to write a simple plugin. #VinCSS
blog.vincss.net/2021/10/re024-…

🔥My Deep Dive into #Zloader - the Silent Night 👹 Including: ⚔️Unpack Zloader Core Dll ⚔️Decrypt strings used by Zloader ⚔️Apply #AppCall to recover the Windows API calls. ⚔️Process Injection technique ⚔️Decrypt configuration tinyurl.com/2p82p4yn #VinCSS #malwareanalysis

kienbigmummy's tweet image. 🔥My Deep Dive into #Zloader - the Silent Night 👹
Including:
⚔️Unpack Zloader Core Dll
⚔️Decrypt strings used by Zloader
⚔️Apply #AppCall to recover the Windows API calls.
⚔️Process Injection technique
⚔️Decrypt configuration
tinyurl.com/2p82p4yn
#VinCSS #malwareanalysis
kienbigmummy's tweet image. 🔥My Deep Dive into #Zloader - the Silent Night 👹
Including:
⚔️Unpack Zloader Core Dll
⚔️Decrypt strings used by Zloader
⚔️Apply #AppCall to recover the Windows API calls.
⚔️Process Injection technique
⚔️Decrypt configuration
tinyurl.com/2p82p4yn
#VinCSS #malwareanalysis
kienbigmummy's tweet image. 🔥My Deep Dive into #Zloader - the Silent Night 👹
Including:
⚔️Unpack Zloader Core Dll
⚔️Decrypt strings used by Zloader
⚔️Apply #AppCall to recover the Windows API calls.
⚔️Process Injection technique
⚔️Decrypt configuration
tinyurl.com/2p82p4yn
#VinCSS #malwareanalysis
kienbigmummy's tweet image. 🔥My Deep Dive into #Zloader - the Silent Night 👹
Including:
⚔️Unpack Zloader Core Dll
⚔️Decrypt strings used by Zloader
⚔️Apply #AppCall to recover the Windows API calls.
⚔️Process Injection technique
⚔️Decrypt configuration
tinyurl.com/2p82p4yn
#VinCSS #malwareanalysis

Through cyber security monitoring, #VinCSS has discovered a document containing malicious code with Vietnamese content that was found by @ShadowChasing1 group. This is Part 1 in a series of analyzes this sample: blog.vincss.net/2021/05/re022-…

kienbigmummy's tweet image. Through cyber security monitoring, #VinCSS has discovered a document containing malicious code with Vietnamese content that was found by @ShadowChasing1 group. This is Part 1 in a series of analyzes this sample: blog.vincss.net/2021/05/re022-…
kienbigmummy's tweet image. Through cyber security monitoring, #VinCSS has discovered a document containing malicious code with Vietnamese content that was found by @ShadowChasing1 group. This is Part 1 in a series of analyzes this sample: blog.vincss.net/2021/05/re022-…
kienbigmummy's tweet image. Through cyber security monitoring, #VinCSS has discovered a document containing malicious code with Vietnamese content that was found by @ShadowChasing1 group. This is Part 1 in a series of analyzes this sample: blog.vincss.net/2021/05/re022-…
kienbigmummy's tweet image. Through cyber security monitoring, #VinCSS has discovered a document containing malicious code with Vietnamese content that was found by @ShadowChasing1 group. This is Part 1 in a series of analyzes this sample: blog.vincss.net/2021/05/re022-…

🔥 #Qakbot malware has now changed its tactics, now using the .msi file to infect instead of using XLM macros as before. 👹Sample hash: c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad (1/3) #VinCSS #MalwareAnalysis

kienbigmummy's tweet image. 🔥 #Qakbot malware has now changed its tactics, now using the .msi file to infect instead of using XLM macros as before.
👹Sample hash: c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
(1/3) #VinCSS #MalwareAnalysis

Credit to my colleague @tqkve. In this post, he will show how to exploit #CVE_2021_22986 #VinCSS #BIG_IP #F5 blog.vincss.net/2021/03/ex006-…

kienbigmummy's tweet image. Credit to my colleague @tqkve. In this post, he will show how to exploit #CVE_2021_22986 #VinCSS #BIG_IP #F5
blog.vincss.net/2021/03/ex006-…
kienbigmummy's tweet image. Credit to my colleague @tqkve. In this post, he will show how to exploit #CVE_2021_22986 #VinCSS #BIG_IP #F5
blog.vincss.net/2021/03/ex006-…

🔥#Emotet👹 When we show off...Ivan kept silent. When Ivan comeback, we cried 😭... I have to shift del my scripts..Now they're useless!!!!🤢 #VinCSS #MalwareAnalysis

kienbigmummy's tweet image. 🔥#Emotet👹 When we show off...Ivan kept silent. When Ivan comeback, we cried 😭... I have to shift del my scripts..Now they're useless!!!!🤢
#VinCSS #MalwareAnalysis
kienbigmummy's tweet image. 🔥#Emotet👹 When we show off...Ivan kept silent. When Ivan comeback, we cried 😭... I have to shift del my scripts..Now they're useless!!!!🤢
#VinCSS #MalwareAnalysis

🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group. [En]: tinyurl.com/yckjb6rr [Vi]: tinyurl.com/yj5t8z6r #VinCSS #malwareanalysis #threathunting

kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting
kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting
kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting
kienbigmummy's tweet image. 🔥Excited to share our latest analysis in which we detail our hunting and analyzing samples were uploaded from Vietnam related to the #MustangPanda(#PlugX)-a China-based APT group.
[En]: tinyurl.com/yckjb6rr
[Vi]: tinyurl.com/yj5t8z6r
#VinCSS #malwareanalysis #threathunting

At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique. [Eng]tinyurl.com/mrshmhp9 [Vie]tinyurl.com/mr3k6svd

kienbigmummy's tweet image. At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique.
[Eng]tinyurl.com/mrshmhp9
[Vie]tinyurl.com/mr3k6svd
kienbigmummy's tweet image. At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique.
[Eng]tinyurl.com/mrshmhp9
[Vie]tinyurl.com/mr3k6svd
kienbigmummy's tweet image. At #VinCSS,I recently wrote an analysis related to the samples of the #MustangPanda(#PlugX) group.However,in all log.dll files uploaded from VN,there is one file that is not related to the this group's attack technique.
[Eng]tinyurl.com/mrshmhp9
[Vie]tinyurl.com/mr3k6svd

Recently, I have been investigating a malware loader which is ModiLoader. This loader is delivered through the Malspam services to lure end users to execute malicious code. blog.vincss.net/2020/09/re016-… #VinCSS #ModiLoader #MalwareAnalysis #Z2A

kienbigmummy's tweet image. Recently, I have been investigating a malware loader which is ModiLoader. This loader is delivered through the Malspam services to lure end users to execute malicious code. blog.vincss.net/2020/09/re016-… #VinCSS #ModiLoader #MalwareAnalysis #Z2A
kienbigmummy's tweet image. Recently, I have been investigating a malware loader which is ModiLoader. This loader is delivered through the Malspam services to lure end users to execute malicious code. blog.vincss.net/2020/09/re016-… #VinCSS #ModiLoader #MalwareAnalysis #Z2A
kienbigmummy's tweet image. Recently, I have been investigating a malware loader which is ModiLoader. This loader is delivered through the Malspam services to lure end users to execute malicious code. blog.vincss.net/2020/09/re016-… #VinCSS #ModiLoader #MalwareAnalysis #Z2A
kienbigmummy's tweet image. Recently, I have been investigating a malware loader which is ModiLoader. This loader is delivered through the Malspam services to lure end users to execute malicious code. blog.vincss.net/2020/09/re016-… #VinCSS #ModiLoader #MalwareAnalysis #Z2A

Credit to @tqkve. My colleague shares his deep diving about the vulnerability on the #BIG_IP system. blog.vincss.net/2020/07/ex005-… #VinCSS #CVE_2020_5902

kienbigmummy's tweet image. Credit to @tqkve. My colleague shares his deep diving  about the vulnerability on the #BIG_IP system.
blog.vincss.net/2020/07/ex005-… #VinCSS #CVE_2020_5902
kienbigmummy's tweet image. Credit to @tqkve. My colleague shares his deep diving  about the vulnerability on the #BIG_IP system.
blog.vincss.net/2020/07/ex005-… #VinCSS #CVE_2020_5902
kienbigmummy's tweet image. Credit to @tqkve. My colleague shares his deep diving  about the vulnerability on the #BIG_IP system.
blog.vincss.net/2020/07/ex005-… #VinCSS #CVE_2020_5902

Check out this blog post by my colleague. English version: blog.vincss.net/2020/12/pt008-… Vietnamese version: blog.vincss.net/2020/12/pt008-… #VinCSS #fuzzing #syzkaller

kienbigmummy's tweet image. Check out this blog post by my colleague.
English version: blog.vincss.net/2020/12/pt008-…
Vietnamese version: blog.vincss.net/2020/12/pt008-… #VinCSS #fuzzing #syzkaller
kienbigmummy's tweet image. Check out this blog post by my colleague.
English version: blog.vincss.net/2020/12/pt008-…
Vietnamese version: blog.vincss.net/2020/12/pt008-… #VinCSS #fuzzing #syzkaller
kienbigmummy's tweet image. Check out this blog post by my colleague.
English version: blog.vincss.net/2020/12/pt008-…
Vietnamese version: blog.vincss.net/2020/12/pt008-… #VinCSS #fuzzing #syzkaller

Loading...

Something went wrong.


Something went wrong.


United States Trends