Source Byte
Открыть в Telegram
هشیار کسی باید کز عشق بپرهیزد وین طبع که من دارم با عقل نیامیزد Saadi Shirazi 187
Больше8 175
Подписчики
+1824 часа
+997 дней
+36030 день
Архив постов
8 178
Emulating inline decryption for triaging C++ malware
Blog
References Glory Sprout string decryptor: gsprout_string_decryption.py Glory Sprout Hash resolver: gsprout_api_resolver.py GlorySprout sample: Malwarebazaar Insight from GlorySprout and Taurus Stelaer: RussianPanda Research Blog Let’s play (again) with Predator the thief An In-Depth analysis of the new Taurus Stealer#malware_analysis
8 178
Windows Internals Learning Resources
credit : Patrick Matula
A summary of learning resources in the categories:
+ Windows Internals + Windows Debugging and Troubleshooting + Windows Performance + Windows Programminghttps://github.com/pmatula/Windows-Internals-Learning-Resources
8 178
IAT-Tracer V2
IAT-Tracer V2 is a plugin for Tiny-Tracer framework Now, you can automatically trace and watch any Windows API function a binary uses, whether imported or *dynamically resolved*.
credit : Yoav Levi
https://github.com/YoavLevi/IAT-Tracer
8 178
Repost from 1N73LL1G3NC3
Ghostly Hollowing Via Tampered Syscalls
Implementing the ghostly hollowing (a hybrid technique between Process Hollowing and Process Ghosting) PE injection technique using tampered syscalls (to bypass userland hooks while simultaneously spoofing the invoked syscall's arguments).
8 178
New maldev academy module https://x.com/MalDevAcademy/status/1810659900218855536?t=tTCrTdfyJLNWI020OYN6Lg&s=19dive sleep obfuscation Credit: Austin Hudson [ Explanation -> Src ] #maldev #malware_dev
8 178
![Red Team infrastructure hardening resources [+] GitHub This wiki is intended to provide a resource for setting up a resilient](data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDACgcHiMeGSgjISMtKygwPGRBPDc3PHtYXUlkkYCZlo+AjIqgtObDoKrarYqMyP/L2u71////m8H////6/+b9//j/2wBDASstLTw1PHZBQXb4pYyl+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj/wAARCAARACgDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDPooooAAKkjjDvjOB1zTBU6KqFGZzHuz82OgoAjdNhxz7Zop8kOBuDlh1BzmigCCiiigB1JN/q0+tFFAD7b/UXH0H8xRRRQB//2Q==)
Red Team infrastructure hardening resources
[+] GitHub
This wiki is intended to provide a resource for setting up a resilient Red Team infrastructure. It was made to complement Steve Borosh (@424f424f) and Jeff Dimmock's (@bluscreenofjeff) BSides NoVa 2017 talk "Doomsday Preppers: Fortifying Your Red Team Infrastructure" (slides)[ Slides ] #c2 #redteam
8 178
CBS - Custom Breakpoint Setter
This is an IDA Plugin powered by Python that sets a disabled breakpoint on specific instruction's mnemonic.
credit : AmirMohammad Jahangirzad
https://github.com/Reodus/CBS
8 178
Research into removing strings & API call references at compile-time (Anti-Analysis)
GitHub
An example in C/C++ of how we can remove static string & function call references by using obfuscation paired with runtime function pointers. As a result, static analysis using tools such as IDA or x64Dbg increases in time/difficulty. You may be able to hide specific API calls from anti-malware systems. On the other hand, some AVs might also flag this behavior as being malicious due to there being a lack of "real looking behavior" in the binary.#malware_dev #evasion
8 178
Repost from APT
🔑 RockYou2024: 10 billion passwords leaked in the largest compilation of all time
Researchers discovered what appears to be the largest password compilation with a staggering 9,948,575,739 unique plaintext password
🔗 Source:
https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/
🔗 Source archive:
https://fastupload.io/1824d409732f30be
#wordlist #rockyou #passwords
