DFIR, Malware Analyst, Reverse Engineer, Information Security Officer. OSCP, OSCE, GXPN Certified. My tweets are my own views and not that of my employer.
Milan
Joined September 2009
- Tweets3.1K
- Following383
- Followers734
- Likes3.5K
I know that I’m getting old when a new shiny macbook arrived and I prefer resting on the bed and take a nap with my two children.
Kartone retweeted
#Golang IDA plugins make the lives of Go #malware reverse engineers easier - an absolute gem of a plugin is AlphaGolang from @LabsSentinel @juanandres_gs. Highly recommended, try it, use it, and enjoy!
github.com/SentineLabs/Alpha…
Kartone retweeted
Over the last few months, Digital Forensics Discord Server members collaborated on a DFIR book. Today version 1.0 is published, with more content to come as chapters are completed in the future! It's free on Leanpub, so check it out in the following tweet!
Tbh I had to read some comments before getting it. Now I can go sleep happier.
This Post is from a suspended account. Learn more
On average, what is the minimum size of a file to be encrypted by a ransomware? #ransomware #malwareanalysis
It is truly hilarious how we still see managers, or who call themselves managers, spending countless hours in meaningless meetings, without setting an agenda and talking about random things without getting nowhere and starting over every day. Where has productivity gone?
Kartone retweeted
SRUM is maybe one of the best Windows digital forensic artefacts, if you’re willing to roll your sleeves up.
You can get proof of execution and execution runtime, as well as proof of network communication and the bytes sent and received
Let's take a look in this #DFIR thread🧵
Kartone retweeted
Securing VMware vSphere references:
Top 5 VMware Security Features
hub.trimarcsecurity.com/post…
Part 1 ESXi Host Versions
hub.trimarcsecurity.com/post…
Part 2 Access Controls
hub.trimarcsecurity.com/post…
Part 3 Host Controls
hub.trimarcsecurity.com/post…
VMWare Security
docs.vmware.com/en/VMware-vS…
Kartone retweeted
New ransomware samples have appeared for:
- Blackcat (ALPHV) ransomware
- Lockbit ransomware
- Hive ransomware
We have uploaded them to @abuse_ch to make it easier to download & so they appear in automated feeds.
My bet is that the #Conti #Ransomware group will quickly disappear and from its hashes another group will form. Money is the only thing the vast majority of these criminals care and entering in other worlds, especially political in these days, is the worst thing they can do.
Kartone retweeted
If you missed @DonAndrewBailey Dec 17 workshop, which gave a sneak peek into the attack surface of #RISCV and how to exploit it, catch the replay video here: ringzer0.training/riscv.html. Register for his FULL training course at #CATCH2022 on Feb 21 to learn more about RISC-V attacks.
I made few changes to the awesome script of @DidierStevens for retrieving #CobaltStrike #DNS beacon. github.com/kartone/Scripts/b…. I only added some retrying logic and parametrised the dns domain. All credits to the author of the original script.
Kartone retweeted
VNC Malware (TinyNuke, TightVNC) Used by Kimsuky Group asec.ahnlab.com/en/27346/
Kartone retweeted
To extract files from Veeam backup you need this utility only. ff8e797fd091f2d1883980af541a493c extract.exe. Your welcome. #DFIR
