Malware Hunter / I've already taken the red pill!
Down The Wrong Rabbit Hole
Joined November 2010
- Tweets22.9K
- Following916
- Followers15.7K
- Likes0
PhysicalDrive0 retweeted
We found one more #zeroday exploit that was used in APT.
securelist.com/new-win32k-ze…
PhysicalDrive0 retweeted
Now, Sibyl can be called from @GHIDRA_RE (github.com/cea-sec/Sibyl/pul…) or use it headless for function address discovering (github.com/cea-sec/Sibyl/pul…) :)
PhysicalDrive0 retweeted
Circumventing Windows Defender ATP's user-mode APC Injection sensor from Kernel-mode : rce4fun.blogspot.com/2019/04…
Operation #ShadowHammer Sample MD5 aa15eb28292321b586c27d8401703494
cape.contextis.com/analysis/… #Asus #Susafone
WINRAR EXPLOIT BUILDER
Select your malware file and upload it and your malicious RAR-file will be created
hxxp://lofi.stream cve-2018-20250
CVE-2019-5786 Chrome 72.0.3626.119 stable FileReader UaF exploit for Windows 7 x86
github.com/exodusintel/CVE-2…
PhysicalDrive0 retweeted
Microsoft fixed a Windows 0day (CVE-2019-0808) in Patch Tuesday. Our team constructed the POC and reproduced the vulnerability triggering process. Click here to read more: blogs.360.cn/post/RootCause_…
PhysicalDrive0 retweeted
One more #zeroday exploit was used in APT attack.
securelist.com/cve-2019-0797…
PhysicalDrive0 retweeted
Google discovered a Chrome RCE #0day in the wild (CVE-2019-5786). Reportedly, a full chain with a sandbox escape: chromereleases.googleblog.co…
In 2019, I expect epic 0days to be found in the wild: Android, iOS, Windows, Office, virtualization, and more. Stay safe and enjoy the show.
Meet #ATMPot - the ATM malware designed to automate the dispensing of cash from a popular range of ATM machines.
The designers even went to the trouble of making the interface look like that of a slot-machine.
Learn more: kas.pr/t4w6
A curated list of IDA x64DBG and OllyDBG plugins
github.com/fr0gger/awesome-i…
#KerrDown Sample SHA256 e56ffcf5df2afd6b151c24ddfe7cd450f9208f59b5731991b926af0dce24285a cape.contextis.com/analysis/…
#APT32 #OceanLotus
PhysicalDrive0 retweeted
2019-02-08: #ExileRAT Group:
"CVE-2017-8759" altered toolkit "get_robin.py" server thread w/ local logging
{ SHELLCODE1 = 'sc.dat' as JScript | LOG_FILE = 'robins.log' }
h/t @PhysicalDrive0
Original Research 👍 ->
xitter.gq/TalosSecurity/status/1…
We recently observed a malware campaign delivering malicious PowerPoints using a mailing list run by the Central Tibetan Administration. Given the nature of this malware, it's likely designed for espionage purposes. #ExileRAT #LuckyCat cs.co/6016ERz94
PhysicalDrive0 retweeted
CVE-2018-16858 - My writeup about a RCE vulnerability via macro execution in Libreoffice: insert-script.blogspot.com/2…
#Zebrocy MD5 c9e1b0628ac62e5cb01bf1fa30ac8317 cape.contextis.com/analysis/…
details and indicators of Zebrocy's overlap with BlackEnergy/GreyEnergy securelist.com/greyenergys-o…
PhysicalDrive0 retweeted
Version 1.1 of BinCAT, our static binary code analyzer for reversers, was just released, with long awaited AMD64 support and huge performance improvements. Get it there: github.com/airbus-seclab/bin…
PhysicalDrive0 retweeted
#CVE-2018-8453 deep analysis, from Use After Free to arbitrary memory read/write by 360 Threat Intelligence Center, a follow up of vulnerability being used by #FruityArmor group targeting the Middle East.
ti.360.net/blog/articles/cve…
the video：video.twimg.com/tweet_video/…