OD @_OD_

@HalifaxBank Replicates 3 time, standing order, any recipient. Any amount. Monthly. If you type the password it’s fine :) I am going to guess, the bug is due to a apostrophe in my name :)))

1 0 0 61 0

View Details

OD @_OD_

2 years ago

@struppigel can you add the data.bin to VT plz :)

1 0 0 71 0

View Details

OD @_OD_

3 years ago

@luke92881 @AnFam17 @SquiblydooBlog @JAMESWT_MHT @ankit_anubhav nice extractor :)

1 0 1 31 0

View Details

Karsten Hahn @struppigel

4 years ago

I created a NightHawk String Decoder IDAPython Script. It will add the decoded strings as comments to IDA. github.com/struppigel/hed…

2 88 260 0 38

View Details

OD @_OD_

4 years ago

@nahamike01 my fave bit so far o.O

0 0 1 0 0

View Details

Loader update from @lazyactivist192: Seems Ivan is a bit upset at @Sophos today. Gotta love those UTF-16 "Fuck Sophos" strings. Additionally, to add fuel to the fire, here's a yara rule that hits off all binaries today: pastebin.com/mJURR7WL Enjoy :)

3 17 35 0 1

View Details

Joshua Saxe @joshua_saxe

7 years ago

1\ I've written a little compiler to ship ML models as standalone Yara rules, and done proof of concept detectors for Macho-O, RTF files, and powershell scripts. So far I have decision trees, random forests, and logistic regression (LR) working. github.com/inv-ds-researc…

13 88 231 0 34

View Details

OD @_OD_

7 years ago

Cobalt shellcode saying hello... o.O

0 0 8 0 0

View Details

Albert Zsigovits @albertzsigovits

7 years ago

Technical synopsis and IoCs of new DarkRat #darkrat. Now distributed via #RigEK. github.com/albertzsigovit… @benkow_ @egeblc @siri_urz @Xylit0l @fumik0_ @prsecurity_ @MisterCh0c @sS55752750 @ViriBack @v0id_hunter @voidm4p @nao_sec @P3pperP0tts @FewAtoms @0xffff0800 @executemalware

9 40 88 0 9

View Details

PeterM🌻 @AltShiftPrtScn

7 years ago

#Colbalt beacon: C:\Users\<username>\Chrome.exe (490ea728a239f448f17a669fbbb0fa7548bf58d5858692d450ca94ce791456e9) used in #RYUK attack. Talks to C2: 45.77.141.82 which has an interesting shodan result shodan.io/host/45.77.141… pretending to be signed by Rapid7.

0 3 6 0 0

View Details

Gabor Szappanos @GaborSzappanos

7 years ago

CVE-2018-0798 was a less-known Equation Editor exploit. Until the end of June. Then we started to see crimeware infection campaigns (Formbook, Lokibot, AzoruLT, Fareit) using it. Over 200 new samples since then. anomali.com/blog/multiple-…