Reverse engineer / malware analyst. On the hunt for domain generation algorithms. Current side project: https://xitter.cf/t.co/Cv3COq0ZmR
- Tweets196
- Following166
- Followers1.8K
- Likes160
ALT Screenshot of the "reports" section of Rösti. The page displays multiple reports in a grid format, each with a card-like design. Each card includes information such as the report title, author, publication date, associated threat indicators (IOCs and YARA rules), and source organization.
![Screenshot of the blog post by cloudflare, where they suggest readers "search [their] environment for the FlyingYeti indicators of compromise (IOCs) shown below", but the IOCs are just low-res screenshots.](https://pbs.twimg.com/media/GO1umOdWEAA8t9L.jpg?name=orig)
ALT Screenshot of the blog post by cloudflare, where they suggest readers "search [their] environment for the FlyingYeti indicators of compromise (IOCs) shown below", but the IOCs are just low-res screenshots.
ALT MooBot botnet C2 domain zelenskyj.ru
ALT A cat hunts a wolf with a crossbow.
ALT A colorful cartoon image of a Python sitting in front of a computer monitor. The monitor shows the logo of Microsoft .Net
ALT Cartoony image of a large sinkhole. A monster character sits at the bottom of the sinkhole with a desperate face. In large letters the title "Sinkholing the DGA of m0yv" is shown.
ALT This screenshot shows the output for the command "bazaar recent -s" which is a list of recently uploaded samples to MalwareBazaar.
ALT This screenshot shows the output of Vendor data for a sample uploaded to MalwareBazaar.
ALT This screenshot shows the output for the command "yaraify recent -s" which is a list of recently uploaded Yara rules to YARAify.
ALT This screenshot shows data related to a scanning task on YARAify and includes detections from ClamAV as well as triggered Yara rules.
ALT how TA551 malspam works: An encrypted zip file contains a word document. This document contains an obfuscated and hidden hta file which is extracted and run by macro code. The hta deobfuscates a Javascript with ActiveX that will download the final payload from an url.
