@DissectMalware
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
Senior Security Engineer @Amazon. Ex Assistant Professor. Opinions are mine; not my employer's. DM is open. Author of xlmdeobfuscator and https://nitter.cf/t.co/eh1fMHMADE
Joined February 2018
- Tweets2.7K
- Following158
- Followers15K
- Likes3K
Pinned Tweet
"#ShadowMove: a Stealthy Lateral Movement Strategy" is now available to read
Read if interested to see a new practical lateral movement
usenix.org/conference/usenix…
Demo (TDS (MS SQL) & FTP):
uofi.app.box.com/folder/9302…
Prototype will be released soon
@MITREattack @USENIXSecurity
Lesser known feature of #YaraDbg: you can drag/drop a pass-protected zip file to analyze the file inside. The pass must be "infected"
The decompressed file will be in the memory not on the local filesystem
github.com/DissectMalware/ya…
live: yaradbg.dev
#100DaysOfYara
Want to run #YaraDbg locally on your system using #Docker?
1⃣ docker pull dissectmalware/yaradbg:latest
2⃣ docker run -p 7071:7071 -p 8081:80 -d dissectmalware/yaradbg:latest
3⃣ browse http://localhost:8081
Want to build the image yourself?
github.com/DissectMalware/ya…
Both #YaraDbg backend and frontend run in the docker container
Loved the idea!
So, I've donated the entire amount collected since activating the feature to St. Jude Children's Research Hospital, although it wasn't that much.
Thank you all who donated : )
stjude.org/donate/donate-to-…
#YaraDbg is now open-source (under Apache license v2)!
Frontend: github.com/DissectMalware/ya…
Backend: github.com/DissectMalware/ya…
Live: yaradbg.dev/
#Yara grammar: github.com/DissectMalware/ya…
Short-term goal: Consolidate the frontend and backend projects.
Long-term goal: Transition to a frontend-only application by eliminating the backend.
Remember maldocs with XOR encryption back in 2020?
I crafted a decryptor and integrated it with my msoffcrypto-tool fork 3 years back!
Guess what? it is now merged with github.com/nolze/msoffcrypto… main branch! Tnx @nolze : )
Context: nitter.cf/JohnLaTwC/status/13146… by @JohnLaTwC
ICYMI, looks like a campaign with XOR encrypted XLS with the VelvetSweatshop password. 0 AV detects.
cc/ @BouncyHat
📎virustotal.com/gui/file/0f69…
📎virustotal.com/gui/file/f402…
📎virustotal.com/gui/file/0034…
📎virustotal.com/gui/file/6fd9…
👉nitter.cf/BouncyHat/status/13088…
📄docs.microsoft.com/en-us/ope…
Thrilled to announce my move to @Amazon as a senior security engineer! Leaving the amazing team at @Microsoft was a tough call—they're truly incredible people. However, I'm buzzing with excitement for this new chapter and the opportunities it holds.
.@virustotal added a new #yara editor with syntax highlighting, autocomplete, rule templates, ... :)
blog.virustotal.com/2023/07/……
#YaraDbg is not done, will definitely continue to extend it more
yaradbg.dev
The #yaradbg editor offers advanced features such as autocomplete (keywords, rulenames, strings) and reference display (shift + F12), which can greatly enhance the coding experience for analysts.
Here is a short demo
yaradbg.dev
The #yaradbg editor offers advanced features such as autocomplete (keywords, rulenames, strings) and reference display (shift + F12), which can greatly enhance the coding experience for analysts.
Here is a short demo
yaradbg.dev
#yaradbg v0.0.3 is out
1⃣ New yara editor: syntax highlighting, showing evaluation res inline, autocomplete, ...
2⃣ You can upload pass-protected zip containing malware directly (pass must be" infected")
Not sure who uses it but ping if you do, enjoy :)
yaradbg.dev/
One of my former colleagues/friends and his wife are killed by a stalker.
Milad was a gifted software engineer and also a super nice person.
Such a huge loss
Life is too short...
cbsnews.com/amp/news/podcast…
#pyOneNote v0.0.1 is now on #PyPI
pip install pyonenote
It prints:
1⃣ header fields
2⃣ all metadata (i.e. all PropertySets such as jcidEmbeddedFileNode, jcidImageNode)
3⃣ embedded files
and also dumps all embedded files
github.com/DissectMalware/py…
related nitter.cf/DissectMalware/status/…
Let me introduce you to #pyOneNote v0.0.1; a pure python library to parse #one file format:
github.com/DissectMalware/py…
Covers 20 out of 38 FileNode types
E.g.: .one in 835239c095e966bf6037f5755b0c4ed333a163f5cc19ba0bc50ea3c96e0f1628
nitter.cf/ffforward/status/16211…
HT @D00m3dR4v3n and @matte_lodi for the PRs, thank you : )
* If you have cycle and can, please contribute to this project. You can DM me if you want.
fun fact about #pyOneNote v0.0.1 release:
parse_filetime, time32_to_datetime, and half_inch_size_to_pixels methods in PropertySet are generated by #OpenAI #Chatgpt3
parse_filetime: github.com/DissectMalware/py…
Let me introduce you to #pyOneNote v0.0.1; a pure python library to parse #one file format:
github.com/DissectMalware/py…
Covers 20 out of 38 FileNode types
E.g.: .one in 835239c095e966bf6037f5755b0c4ed333a163f5cc19ba0bc50ea3c96e0f1628
nitter.cf/ffforward/status/16211…
