my chilhood, while playing games like dave, prince of persia, pac-man, paratrooper .. then came DOOM - that completely changed how we saw what a PC could do ... how can we even forget this .. and after reading Masters of Doom, I kind of relived those days ... cc: @romero

Explored how LLMs can be silently backdoored using minimal data and compute. Here’s the full PoC write-up: medium.com/@int0x50/silent-s… #AI #AISecurity #RedTeam #LLMSecurity #CyberSecurity #OffensiveSecurity #VulnerabilityResearch

much of my childhood spent on these .. and these and these ... these games inspired me a lot to get into programming ... Turbo C, GWBASIC .. those days !!! cc: @romero

discord data. #MarsStealer #Malware

#qbot #qakbot landed at EP on hollowed explorer . exe

#qbot #qakbot explorer.exe hollowing happens twice. first time fails, second time success.

#qbot #qakbot #fasm developed smallest and fastest PE enumerator. 10k bytes. against qbot.

#qbot #qakbot after section injection into explorer.exe

#qbot #qakbot CreateSection, explorer.exe SECTION_MAP_EXECUTE_READ_WRITE = E PAGE_EXECUTE_READWRITE = 0x40

#qbot #qakbot indicator of process manipulation

#qbot #qakbot after explorer.exe CreateProcess, API string generation through xor

#qbot #qakbot GetModuleHandle into rsrc

union REGS regs; regs.x.dl = 0; int86(0x21, &regs, &regs);

#qbot #qakbot overwrites itself through ShellExecute

#qbot copies itself

#qbot #qakbot snxhk_border_mywnd

#qbot av filenames

#emotet #trickbot anyone seen emotet or trickbot using ROP to transfer control to different parts of the malware? cc @VK_Intel

#emotet #trickbot emotet anchor connects to a domain related to trickbot. but the anchor is flagged as Trojan Mikey by VirusTotal