The story of that Logger.dll is somewhat funnypic.twitter.com/iOoRd3GmS0
Prikaži ovu nit
My preliminary YARA rule for CVE-2020-0601 brought up some interesting samples WUT.exe https://www.virustotal.com/gui/file/b2ef6d2d005b9442447e2f07a0a0e5f9d4b32a4e066a94015fd9930f752a7477/details … Logger.dll (submitter: KR) https://www.virustotal.com/gui/file/584886c3382d66b77f1123f6ce02cbbf88ccc35b402fc7a8f497d581be0d17ad/detection …pic.twitter.com/Y3ALJUXljB
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
That logger.dll is compiled pre-public release details right? Someone had access to NDA details here??
-
I'd say it was compiled before the publication but signed after it.
Kraj razgovora
Novi razgovor -
-
-
Big question I have right now, probably I'm missing something: if the problem lies in the ecc validation routine in win10, what this signature (Yara or whatever else) is going to check?
-
It’s a dirty rule. I don’t want to publish it but I’m pretty confident that I can find all malicious samples that get uploaded in the next days with it.
- Još 3 druga odgovora
Novi razgovor -
-
-
lol, WUT.exe does this. nice work whoever did that, it was within hours of public disclosure.pic.twitter.com/facC1vvXnO
-
Hi, I’m mickey.
That file is my fault...
Kraj razgovora
Novi razgovor -
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
0/67, totally innocent because VT is always right
/sHvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.