Malware Research. Threat Inteligence. Trainings - contact@malwarelab.pl
Joined February 2020
- Tweets19
- Following3
- Followers586
- Likes13
Last month, for @AmnestyTech, we analyzed OSX sample of #FinFisher and provide other insights we gather along the way including some scripts aiding further analysis. If you need any help with any #malware related problems, don't hesitate to drop us an email, we are happy to help!
German-made FinSpy spyware found in Egypt, and Mac and Linux versions revealed
amnesty.org/en/latest/resear…
Jeżeli chcecie zobaczyc jakas konkretna kampanie - czekamy na propozycje do 14.07, jak nie to cos sobie znajdziemy ;]
Chcecie zobaczyć na żywo analizę kampanii malware?
Zapraszamy na remote sekurak hacking party. Prezentował będzie @maciekkotowicz:
sekurak.pl/zapraszamy-na-lip…
MalwareLab.pl retweeted
@maciekkotowicz is our next speaker at #CCCC2020. He worked before as Senior Security Researcher in Kaspersky GReAT or Principal Botnet owner at CERT.pl. He'll talk about #Fishing Elephant, or How to Build a Cloud-Based #APT.
bit.ly/3dSx8E0 #Conference
This time we write about #Skidware - blog.malwarelab.pl/posts/ven… | We found new #hackforums grade rat based on #Quasar - its hilarious, check it out #Malware //cc @JAMESWT_MHT @James_inthe_box @Casperinous
document (virustotal.com/gui/file/ab54… - Bubar Parlimen.docx) dropping #DADSTACHE, download urls: hxxps://armybar.hopto[.]org/{RemoteLoad.dotm,LogiMailApp.exe,LogiMail.dll,Encrypted} c2: tomema.myddns[.]me #Leviathan/#APT40 cc: @Mao_Ware
bunch of #TA505 docs with name: Human Resources Annual Report.docx (list: github.com/MalwareLab-pl/ioc…) mimics real vba code, will drop a dll with typical packer and #get2 with c2: shr-links[.]com probable lure email: virustotal.com/gui/file/9145… #ThreatIntel #Malware #APT #ThreatHunting
Interesting clue about operation timeline of #Higaisa based on samples from @Malwarebytes's article - before jumping to shellcode loader checks if current year is in [2018,2021] time frame (it also makes quite a good #yara ) #APT #Malware #ThreatHunting #threatintel
We write up our analysis of a validator dropped by documents used by #Lazarus, this validator was used in a campaing described by telsy as well as the ones recenty conducted against LockheedMartin, BAESystemsplc, Boeing. blog.malwarelab.pl/posts/laz… cc: @Manu_De_Lucia @Arkbird_SOLG
Couple of #Lazarus #APT samples, with decoy documents referencing @LockheedMartin, @BAESystemsplc, @Boeing. Downloads remote templates and drops double-base64 encoded patched sqlite3 dlls, iocs: gist.github.com/mak/81f6161f… patched/added exports: sqlite3_stmt_all,sqlite3_stepsW
Second part (and last;) of our #Nazar's #APT tool is live. blog.malwarelab.pl/posts/naz… . With some experimental #snort/#suricata rule for you amusement #Malware #ThreatIntel #sig37 /cc @juanandres_gs
Quick update on #Nazar #APT capabilities (blog.malwarelab.pl/posts/naz…) | Tomorrow will post analysis of c2 protocol
We put some hours into covering blanks about tool used by #Nazar #APT /cc: @juanandres_gs blog.malwarelab.pl/posts/naz…
New #aggah campaign, #GuLoader added to chain
Doc: 7418b898c989e3fb0d13b5db2c9773478e23150c590acad5832ccc3c14b80a26
remote payloads: hxxp://office-updates-index[.]com/{Report.rtf,Attack.jpg,File.vbs, track.jpg,max.bin}
#AgentTesla c2: fxp://ftp.centredebeautenellycettier[.]fr/
We put some effort into analyzing #RoyalRoad (aka 8t) rtf weaponizer. Take a look
blog.malwarelab.pl/posts/on_… /cc @nao_sec #APT #malware #ThreatIntel
MalwareLab.pl retweeted
@maciekkotowicz at #x33fcon 2020!
Fishing Elephant, or How To Build Cloud Based APT
x33fcon.com/#!s/mak.md
Register: x33fcon.com/#!conference.md#…
Our first public analysis, new campaing from #Aggah analyzed with a lot of #bashfu blog.malwarelab.pl/posts/bas…