Tweetovi
- Tweetovi, trenutna stranica.
- Tweetovi i odgovori
- Medijski sadržaj
Blokirali ste korisnika/cu @VK_Intel
Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @VK_Intel
-
Prikvačeni tweet
2020-02-05: [Breaking]
"
Pro-Russian CyberSpy #Gamaredon#aPT Intensifies Ukrainian
Security Targeting"
The 'Fifth Domain': Gamaredon Wages Silent War with Ukranian Military & Law Enforcement
5k Victim Scope in Ukraine Along 'Separation Line'
https://labs.sentinelone.com/pro-russian-cyberspy-gamaredon-intensifies-ukrainian-security-targeting/ …pic.twitter.com/tbt6meM8Rw
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
2020-02-05:
#Netwalker#Ransomware
Cfg
"prc":["psexec.exe","system"]
net":{"use":true,"ignore":{"use":true,"disk":true,"share":["ipc$","admin$"]
kill":{"use":true,"task":["reboot","restart","shutdown","logoff","back"]}
h/t @malwrhunterteam
https://github.com/k-vitali/Malware-Misc-RE/blob/master/2020-02-05-netwalker-config.vk.raw …pic.twitter.com/BCvqbbVvVX
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Gamaredon activities serve as a testing ground for Russian #military to observe the potential of cyber warfare in a contemporary violent conflict or in a state-wide political confrontation.
While not super tech sophisticated, this (little a)PT group is important to track.Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
2020-02-05:
#NetWalker#Ransomware#Decrypter
|
'Auto decrypt' & 'Manual decrypt' Mode
RegisterClassW 'netwallker'
Build:Nov 12 09:57:08 2019
Resource Name Troll
:"1337"
'Load keys config''expand 32-byte kexpand 16-byte k'
Net MPR.DLL API
h/t @malwrhunterteampic.twitter.com/9PVjRAseBQ
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Vitali Kremez proslijedio/la je Tweet
So, hearing that Toll Group got hit with ransomware that is caled "Mailto"... But (just as with REvil), we can take a look at the decrypter for it, and then we see they named it "Netwalker Decrypter", instead of "Mailto Decrypter" or anything else...
@demonslay335 cc@VK_Intelpic.twitter.com/GSyyIjzV4X
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
It is notable Ryuk has
South Korea CLSID in decoder for 'HKLM\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage':
'0x412'/'1042' CLSID
icalcs /grant Everyone:F /T /C /Q (modify access control)
'HERMES' usual marker
usual "8 LAN" argpic.twitter.com/rfNhUaIb60
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
2020-02-05:
#Ryuk#Ransomware
|#SignedSunday Build: Jan 19 13:24:28 2020
String Dec
for ( i = 0; i < len_byt; ++i )
*(_BYTE *)(i + bin) -=*(_BYTE *)(ind + 4 * (iter % arg_div));
Cert 
https://twitter.com/VK_Intel/status/1222087389302050816 …
h/t @malwrhunterteam MD5:31a8623c16177fb3e4619d05d97335fapic.twitter.com/EPvIBOFzis
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
2020-02-04:
(UNK) #Loader Powershell Loader #BinLoader|#Signed
[Datasähkö Uusimaa Oy]#DigiCert
Decoy:"Windows is up to date"
Injection 'RtlCreateUserThread':
VirtualAllocExWriteProcessRtlCreateUserThread
h/t @malwrhunterteam MD5: fc3d18547cde73df7ed188ce6e0f4fb0pic.twitter.com/H0yNrT27Pt
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Block the following servers for this install:
[HTTP]
GatewayAddress=GJUAUYFHJHA. CN:443
SecondaryGateway=sasggegzui. cn:443
GSK=FO;H@BEA9I?BCIFO;F?H
Domains are .cn 
over port 443Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
2020-02-04:
#NetSupport Manager#RAT
V12.10F8 |#Signed[FAN-CHAI,TOV]#DigiCert NSIS#PowerShell ScriptNSM
HookKeyboard\.\KeyboardClass|PointerClass0
ftr
[nskbfltr.NT.Wdf]
KmdfService:nskbfltr,nskbfltr_wdfsect
h/t @malwrhunterteam MD5: 603ea83bd595e21d32b87139adf23612pic.twitter.com/pTOkdDGRUv
Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Vitali Kremez proslijedio/la je Tweet
Some signed downloader sample from December: 74cd333a24cedc7f0f1f5f1a0a025dc6bcf0d508fd5131fdd33f7756702e15cd It already had much Trump related strings (look at the sample for all), maybe as bypass (different way than here: https://twitter.com/VK_Intel/status/1222607671431434241 …) method/attempt?
cc @VK_Intelpic.twitter.com/ie2KTCxG0p
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
2020-02-03:
[Researcher Pin] 
#EKANS/#SNAKE Ransomware Analysis & ICS Targeting PerspectiveAs the ransomware strain was first identified and discovered with myself & @malwrhunterteam hunting for Golang ransomware.
Sober outlook & analysis from the intel perspective.https://twitter.com/DragosInc/status/1224350671761289218 …
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Team, we're looking for your feedback & offering a 10% discount
as we are working on advanced #malware analysis & reverse engineering course.
Our first course attracted ~5,000 global students w/ 100+ certified w/ 7hrs of latest malware/RE content.
The form is below.
https://twitter.com/0verfl0w_/status/1224445691520405512 …Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Vitali Kremez proslijedio/la je Tweet
Since the release of Z2H and my course,
@VK_Intel and I have had a lot of requests to release a more advanced one, so we've drafted up a possible syllabus! We'd love to hear your opinions on it! Plus we'll be giving 10% off to everyone who completes it!https://forms.gle/1GtwbNfhyAo2fivB9 …Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Vitali Kremez proslijedio/la je Tweet
DoppelPaymer Ransomware Sells Victims' Data on Darknet if Not Paid - by
@LawrenceAbramshttps://www.bleepingcomputer.com/news/security/doppelpaymer-ransomware-sells-victims-data-on-darknet-if-not-paid/ …Prikaži ovu nitHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
2020-02-03:
#Maze#Ransomware
"Logging enabled | Maze"
Note:
Hacked network
Downloaded a lot of data from network
Google "Allied Universal Maze Ransomware"
If paid, the data will be removed & decryptor will be given
h/t @malwrhunterteam
: https://twitter.com/malwrhunterteam/status/1224329938972618753 …pic.twitter.com/Wij16gCUJ7
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
2020-02-03:
#Shellcode Loader#hVNC 'HiddenDesktop'#Malware"FudV"|Recompiled from #TinyNuke Leak|AVE_MARIA
C2:
94.103.81. 79
PDB:
C:\Users\Administrator\Documents\c++ project\hVNC\Client\Release\FudV.pdb
h/t @malwrhunterteam MD5: 6d8d825d00a4a1d8e3f406bad69fa4a7pic.twitter.com/bsvz8nCkeE
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Vitali Kremez proslijedio/la je Tweet
Vitali talked me into leaving my malware labhttps://twitter.com/vk_intel/status/1224101133574119424 …
2020-02-02:
[Meetup] I will be in 
Tel Aviv, Israel on the first time trip
.
I invite you to join our researher meetup if you're local and/or there for @BlueHatIL on February 6 @ 6pm. We'll share notable observations from#APT &#Crimeware world. https://www.eventbrite.com/e/when-crimeware-meets-apt-tickets-89775840957?aff=eand …Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
2020-02-02:
[Meetup] I will be in Tel Aviv, Israel on the first time trip.
I invite you to join our researher meetup if you're local and/or there for @BlueHatIL on February 6 @ 6pm. We'll share notable observations from#APT &#Crimeware world.https://www.eventbrite.com/e/when-crimeware-meets-apt-tickets-89775840957?aff=eand …Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi -
Vitali Kremez proslijedio/la je Tweet
I hope my last 3 write-ups have covered the subject of filesystem bugs enough. It talks about discovery using procmon, and also poc writing now. You can just copy paste from the poc on github for a lot of bugs I guess. I hope it helps get atleast one person into the field.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.