Malware Researcher | Reverse Engineer | Ex GoogleDevExpert | Speaker
YouTube
Joined September 2018
- Tweets4.5K
- Following366
- Followers1.3K
- Likes6.3K
Shrutirupa Banerjiee (She/Her) retweeted
Seqrite analyses MacSync, a family of macOS information stealers & remote-access stagers designed to evade detection and sold commercially under a MaaS model. MacSync is delivered primarily through ClickFix social engineering & search engine malvertising seqrite.com/blog/macsync-the…
🤖 Made with AI
Shrutirupa Banerjiee (She/Her) retweeted
Latest Activity of #SideCopy #APT using Go-based(Windows) #DeskRAT Malware to Target #Indian Government Entities.
File: NEET-UG Paper leak legal documents[.zip
MD5: 00f341a353de29dfe19e4796d27c1879
C2: modbdwindtgt[.]website:8080
File: document.exe
MD5: 762be35836deca45e8ac43aee5559212
File: Voidtools.exe
MD5: 66edc36cce90ae9cef641685e1f95e92
C2: modbdwindtgt[.]website:8080
All Infra:
modbdwindtgt[.]website
modbdwindtgt[.]shop
5.181.1[.]181
45.141.58[.]166
@500mk500 #Malware #APT #RAT #ioc
ALT Virus Total Results for SideCopy APT Infra - 1
ALT Virus Total Results for SideCopy APT Infra - 2
Shrutirupa Banerjiee (She/Her) retweeted
Windows defender has been compromised.
right now there is a public unpatched exploit that gives any app on your windows PC full system admin access. no password. no popup. nothing
your antivirus doesnt stop it. your antivirus IS the exploit. windows defender is the attack vector
ransomware gangs can use this to encrypt your entire machine and steal every saved password, browser session, and discord token you have. fully patched windows 11. real time protection on
thread
Shrutirupa Banerjiee (She/Her) retweeted
Application Security Engineer Interview Questions - @security_prince
ishaqmohammed.me/posts/appli…
Shrutirupa Banerjiee (She/Her) retweeted
🚨 Don't miss Shrutirupa @freak_crypt, Google Developer Expert, at #DevFest2024 #Coimbatore!
She'll be exposing the dark side of #AI in her talk "AI-Powered Malware: The Evolving Threat Landscape."
Learn how to protect yourself from the rising threat of AI-driven malware.
Shrutirupa Banerjiee (She/Her) retweeted
A huge loss to the infosec community
@rossjanderson Professor Ross Anderson, FRS, FREng Dear friend and treasured long term campaigner for privacy and security, Professor of Security Engineering at Cambridge University and Edinburgh University, Lovelace Medal winner, has died suddenly at home in Cambridge.
Shrutirupa Banerjiee (She/Her) retweeted
Hi everyone, I’m seeking new career opportunities and would greatly appreciate your support. I’m ready to embrace new challenges and continue my professional growth. If you know of any exciting opportunities or are open to a discussion, please feel free to DM me or comment below.
Shrutirupa Banerjiee (She/Her) retweeted
RE tip of the day: There are multiple artifacts revealing the presence of the VM to malware on a guest system, mainly associated with auxiliary tools:
* Files
* Processes and services
* Registry keys
* Devices and named pipes
#infosec #cybersecurity #malware #reverseengineering
Shrutirupa Banerjiee (She/Her) retweeted
RE tip of the day: Malware can detect VM by simply checking hardware details (model, manufacturer, etc) on the current machine, for example, using WMI queries:
* SELECT * FROM Win32_ComputerSystem
* SELECT * FROM Win32_BIOS
#infosec #cybersecurity #malware #reverseengineering
Shrutirupa Banerjiee (She/Her) retweeted
RE tip of the day: Another x86 instruction commonly used by malware to detect virtual machines is CPUID. For example, with EAX=1, it returns processor information as a set of bits. 0x1F bit in ECX will be set to 1 if it is a VM
#infosec #cybersecurity #malware #reverseengineering
Shrutirupa Banerjiee (She/Her) retweeted
RE tip of the day: To detect a virtualized x86 environment, malware can use the IN instruction with a port 5658h (“VX” in ASCII) and 564D5868h in EAX (“VMXh”). VMWare CPU will return the same magic value in EBX revealing itself
#infosec #cybersecurity #malware #reverseengineering
Shrutirupa Banerjiee (She/Her) retweeted
RE tip of the day: There are many ways how a simple sandbox can be detected by malware:
* Short execution time
* Weak system hardware
* Unusual system settings
* No user interaction
* Standard sandbox setup (default user, malware filename, etc)
#infosec #cybersecurity #malware
Shrutirupa Banerjiee (She/Her) retweeted
🎉Just released: Threat Actors are using GitHub to distribute malware🔥. In one case `cracked` TurboTax software is being frequently updated with new versions of malware and the repositories are still active.
Let's reverse this and have some fun.💥
youtu.be/bw6atjKs8Oo
Shrutirupa Banerjiee (She/Her) retweeted
RE tip of the day: Don't forget that storing strings on the stack byte-by-byte or dword-by-dword is not an anti-RE technique, this is just how the compiler uses local variables.
#infosec #cybersecurity #malware #reverseengineering
Shrutirupa Banerjiee (She/Her) retweeted
GIVEAWAY ALERT!
We are giving away our "Windows API Hooking for Red Teamers" course for 5 persons who liked and retweeted this tweet.
winners will be picked on Wednesday this week.
courses.pointersec.com/p/win…
#infosec #malware #redteam #cybersecurity #hacking #pentest
Shrutirupa Banerjiee (She/Her) retweeted
Just Released 🎉: A malicious LNK file leads to a compromised WordPress site hosting a HTA file. Upon deobfuscating this reveals a malicious Exe which is going to be run.
Hope you learn something about LNK forensics and enjoy some CyberChef tips!
youtu.be/XxHFr2xvPFc
Shrutirupa Banerjiee (She/Her) retweeted
This new loader named d3f@ck has a stage which is JPHP.
Here is how to analyse JPHP
#d3fackloader #d3fack
Shrutirupa Banerjiee (She/Her) retweeted
RE tip of the day: Examples of using control flow instructions for obfuscation include
* push + ret instead of jmp
* call at the end of the function
* one-option conditional jumps
* instructions spread across multiple locations
#infosec #cybersecurity #malware #reverseengineering