Social 📸 Photography

jesterchen42Is there any way to decode <a href="https://social.tchncs.de/tags/ANSI" class="mention hashtag" rel="nofollow noopener" target="_blank">#ANSI</a> color sequences in <a href="https://social.tchncs.de/tags/CyberChef" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberChef</a>? You know, old school stuff like]2mor]0;39m?

MalwareLabRecent <a href="https://infosec.exchange/tags/stegocampaign" class="mention hashtag" rel="nofollow noopener" target="_blank">#stegocampaign</a> delivering <a href="https://infosec.exchange/tags/XWorm" class="mention hashtag" rel="nofollow noopener" target="_blank">#XWorm</a> RAT <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> samples. Quick review of <a href="https://infosec.exchange/tags/sandbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#sandbox</a> analysis reports reveal simple, yet interesting infection chain. It contains <a href="https://infosec.exchange/tags/VisualBasic" class="mention hashtag" rel="nofollow noopener" target="_blank">#VisualBasic</a> script, <a href="https://infosec.exchange/tags/PowerShell" class="mention hashtag" rel="nofollow noopener" target="_blank">#PowerShell</a> scripts, picture with Base64-encoded executable and the <a href="https://infosec.exchange/tags/xwormrat" class="mention hashtag" rel="nofollow noopener" target="_blank">#xwormrat</a> itself. Those payloads have been downloaded from online hosting services such as <a href="https://infosec.exchange/tags/Pastebin" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pastebin</a> and <a href="https://infosec.exchange/tags/Firebase" class="mention hashtag" rel="nofollow noopener" target="_blank">#Firebase</a>.My new article with <a href="https://infosec.exchange/tags/IOC" class="mention hashtag" rel="nofollow noopener" target="_blank">#IOC</a> and analysis <a href="https://malwarelab.eu/posts/stego-xworm/" rel="nofollow noopener" translate="no" target="_blank">https://malwarelab.eu/posts/stego-xworm/</a><a href="https://infosec.exchange/tags/steganography" class="mention hashtag" rel="nofollow noopener" target="_blank">#steganography</a> <a href="https://infosec.exchange/tags/Steganoanalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#Steganoanalysis</a> <a href="https://infosec.exchange/tags/anyrun" class="mention hashtag" rel="nofollow noopener" target="_blank">#anyrun</a> <a href="https://infosec.exchange/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#malwareanalysis</a> <a href="https://infosec.exchange/tags/obfuscation" class="mention hashtag" rel="nofollow noopener" target="_blank">#obfuscation</a> <a href="https://infosec.exchange/tags/cyberchef" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberchef</a>

MalwareLabAnalysis of <a href="https://infosec.exchange/tags/infostealer" class="mention hashtag" rel="nofollow noopener" target="_blank">#infostealer</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> pretending to be a hack for <a href="https://infosec.exchange/tags/roblox" class="mention hashtag" rel="nofollow noopener" target="_blank">#roblox</a> anticheat.This week I delivered one lecture about cyber attacks and three 45-minutes malware analysis workshops with <a href="https://infosec.exchange/tags/anyrun" class="mention hashtag" rel="nofollow noopener" target="_blank">#anyrun</a> and <a href="https://infosec.exchange/tags/cyberchef" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberchef</a> for high school students in <a href="https://infosec.exchange/tags/Roznava" class="mention hashtag" rel="nofollow noopener" target="_blank">#Roznava</a>, <a href="https://infosec.exchange/tags/Slovakia" class="mention hashtag" rel="nofollow noopener" target="_blank">#Slovakia</a>.<a href="https://infosec.exchange/tags/Education" class="mention hashtag" rel="nofollow noopener" target="_blank">#Education</a> <a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#blueteam</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener" target="_blank">#dfir</a> <a href="https://infosec.exchange/tags/sandbox" class="mention hashtag" rel="nofollow noopener" target="_blank">#sandbox</a> <a href="https://infosec.exchange/@securitydungeon/111914649805730340" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@securitydungeon/111914649805730340</a>

rugk<a href="https://chaos.social/tags/Hall1" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hall1</a> In other news: The loading screen of <a href="https://chaos.social/tags/CyberChef" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberChef</a> is also very cool. <a href="https://chaos.social/tags/37c3" class="mention hashtag" rel="nofollow noopener" target="_blank">#37c3</a>

MalwareLabMy write-up for the <a href="https://infosec.exchange/tags/kaspersky" class="mention hashtag" rel="nofollow noopener" target="_blank">#kaspersky</a> challenge from <a href="https://infosec.exchange/tags/ekoparty" class="mention hashtag" rel="nofollow noopener" target="_blank">#ekoparty</a> <a href="https://infosec.exchange/tags/CTF" class="mention hashtag" rel="nofollow noopener" target="_blank">#CTF</a> is online. This was very nice challenge - <a href="https://infosec.exchange/tags/network" class="mention hashtag" rel="nofollow noopener" target="_blank">#network</a> traffic analysis, exploitation, <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a>, <a href="https://infosec.exchange/tags/reverseengineering" class="mention hashtag" rel="nofollow noopener" target="_blank">#reverseengineering</a> and <a href="https://infosec.exchange/tags/crypto" class="mention hashtag" rel="nofollow noopener" target="_blank">#crypto</a><a href="https://malwarelab.eu/posts/ekoparty-ctf-2023-kaspersky/" rel="nofollow noopener" translate="no" target="_blank">https://malwarelab.eu/posts/ekoparty-ctf-2023-kaspersky/</a><a href="https://infosec.exchange/tags/networksecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#networksecurity</a> <a href="https://infosec.exchange/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#malwareanalysis</a> <a href="https://infosec.exchange/tags/cyberchef" class="mention hashtag" rel="nofollow noopener" target="_blank">#cyberchef</a> <a href="https://infosec.exchange/tags/IDAFree" class="mention hashtag" rel="nofollow noopener" target="_blank">#IDAFree</a> <a href="https://infosec.exchange/tags/IDAFreeware" class="mention hashtag" rel="nofollow noopener" target="_blank">#IDAFreeware</a> <a href="https://infosec.exchange/tags/cutter" class="mention hashtag" rel="nofollow noopener" target="_blank">#cutter</a> <a href="https://fosstodon.org/@rizin" class="u-url mention" rel="nofollow noopener" target="_blank">@rizin</a>

MalwareLabDecryption of strings from <a href="https://infosec.exchange/tags/AsyncRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#AsyncRAT</a>/#DcRat/#VenomRAT configuration with <a href="https://infosec.exchange/tags/CyberChef" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberChef</a>. Little bit of <a href="https://infosec.exchange/tags/Dotnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#Dotnet</a> <a href="https://infosec.exchange/tags/reversing" class="mention hashtag" rel="nofollow noopener" target="_blank">#reversing</a> and commented recipe with usage of registers for PBKDF2 and AES decryptionBlog post: <a href="https://malwarelab.eu/posts/asyncrat-cyberchef/" rel="nofollow noopener" translate="no" target="_blank">https://malwarelab.eu/posts/asyncrat-cyberchef/</a> Recipe with example input: <a href="https://tinyurl.com/AsyncRatConfigDecryptor2" rel="nofollow noopener" translate="no" target="_blank">https://tinyurl.com/AsyncRatConfigDecryptor2</a>

MalwareLabHow to recognize possible <a href="https://infosec.exchange/tags/stealer" class="mention hashtag" rel="nofollow noopener" target="_blank">#stealer</a>? It tries to access sensitive files (e.g. browser cookies, credential stores, crypto wallets, steam keys) followed by the data upload.One example: <a href="https://infosec.exchange/tags/Redline" class="mention hashtag" rel="nofollow noopener" target="_blank">#Redline</a> <a href="https://infosec.exchange/tags/stealer" class="mention hashtag" rel="nofollow noopener" target="_blank">#stealer</a>. Accessing sensitive data followed by data upload including list of user processes, passwords and screenshot.<a href="https://infosec.exchange/tags/CyberChef" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberChef</a> recipe for extracting screenshot: <a href="https://gchq.github.io/CyberChef/#recipe=To_Hex('None',0)Regular_expression('User%20defined','89504e470d0a1a0a.*49454e44ae42.%7B4%7D',true,true,false,false,false,false,'List%20matches')Render_Image('Hex')" rel="nofollow noopener" target="_blank">https://gchq.github.io/CyberChef/#recipe=To_Hex('None',0)Regular_expression('User%20defined','89504e470d0a1a0a.*49454e44ae42.%7B4%7D',true,true,false,false,false,false,'List%20matches')Render_Image('Hex')</a><a href="https://infosec.exchange/tags/anyrun" class="mention hashtag" rel="nofollow noopener" target="_blank">#anyrun</a> sample: <a href="https://app.any.run/tasks/39f5008c-b5c3-4917-ab0c-f3e48ac13dc9/" rel="nofollow noopener" target="_blank">https://app.any.run/tasks/39f5008c-b5c3-4917-ab0c-f3e48ac13dc9/</a><a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener" target="_blank">#dfir</a> <a href="https://infosec.exchange/tags/infostealer" class="mention hashtag" rel="nofollow noopener" target="_blank">#infostealer</a> <a href="https://infosec.exchange/tags/malwareanalysis" class="mention hashtag" rel="nofollow noopener" target="_blank">#malwareanalysis</a>

Recent searches

Search options

Administered by:

Server stats:

#cyberchef