Kyle Cucci
@d4rksystem
Followers
4,520
Following
513
Media
169
Statuses
2,290
Threat Research @proofpoint | Author of "Evasive Malware" @nostarch | Talks about cybercrime, threat intel, and malware stuff.
Germany
Joined September 2015
Don't wanna be here?
Send us removal request.
Explore trending content on Musk Viewer
#الهلال_الاهلي
• 74336 Tweets
#HUEAreMyEverything
• 69862 Tweets
#휴닝카이가수놓은여름밤의은하수
• 65857 Tweets
The UAW
• 65757 Tweets
Martes 13
• 55820 Tweets
#愛され天使ヒュニンカイ
• 42482 Tweets
OUR BAND LEADER HUENINGKAI
• 37160 Tweets
D-14 TO CHANYEOL SOLO
• 36304 Tweets
ガラスの仮面
• 32646 Tweets
CRAZY TRACK SAMPLER
• 23195 Tweets
Colbert
• 21623 Tweets
LEAVE BLACKPINK ALONE
• 20671 Tweets
#كاس_الدرعيه_للسوبر_السعودي
• 18780 Tweets
Ferdi
• 16042 Tweets
Jaime Garzón
• 16023 Tweets
Thunderbolts
• 15977 Tweets
Maradona
• 14064 Tweets
チェンソーマン
• 13987 Tweets
Adorni
• 13188 Tweets
ポケモン赤緑
• 13140 Tweets
横井さん
• 11165 Tweets
Pinned Tweet
I’m excited to announce that my book, “Evasive Malware”, will soon be available for pre-order! The past 2.5 years of late nights, eye strain, and carpal tunnel is almost worth it 😎
Also excited to announce that my technical reviewer is the amazing
@fr0gger_
!
Stay tuned! 👇
44
254
1K
#Malware
Analysis Tip:
Windows registry contains an interesting key (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UAC\COMAutoApprovalList) that shows all COM objects that auto-elevate, bypassing UAC. Malware may be able to modify or hijack some these to elevate privileges.
13
299
1K
As a former IDA Pro guy (who must now use Ghidra because of money reasons), this guide really helped me get my Ghidra interface more IDA-like 😎 A lot of useful stuff here.
4
180
663
#CobaltStrike
hunting tip of the week:
CobaltStrike uses named pipes for communication between processes. Default beacon configs use pipes in the format "MSSE-x-server", where "x" is a number from 1 to 4 characters. Hunting for this named pipe pattern may find things 😉
6
189
593
#Malware
analysis tip:
You can automatically extract certain files hidden inside an image file (steganography) using 7zip, such as this PK file hidden inside a JFIF image. Remove the file extension and extract with 7z, and 7z will attempt to locate embedded files and extract 🥳
12
120
500
#Malware
Analysis Tip:
Setting the registry key "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM\ConsentPromptBehaviorAdmin" to 0 seems to disable UAC prompts. If you see a malware sample reading or modifying this key, now you know what it may be trying to do 😉
4
156
510
Excited to share the cover for my upcoming book
#EvasiveMalware
! I think
@nostarch
did a great job with this one. Obviously not the final final version, but let me know what you think 😄
Ps. If you try to print this, your printer will explode.
33
49
487
Interesting project for anti-forensics and evasion. Blue-teamers should study this one for learning 🤓
4
136
436
#Malware
analysis tip of the week:
If you spot malware using memcpy or WriteProcessMemory to write the bytes "4C 8B D1” to an arbitrary address in memory, it is probably trying to unhook AV or EDR by overwriting inline hooks. 🧐
4
89
383
Is malware detecting your VirtualBox VM's? Is pafish giving you trouble? Try out the latest release of my PowerShell-based tool VBoxCloak! A quick and dirty way to hide your VM's from some common VM-detection techniques. VMware coming soon! 🥳
8
104
373
Want to learn how a simple UAC bypass / priv elevation works? Start msconfig, go to Tools menu, select "Command Prompt", and click Launch. Depending on your system configuration, a shell will pop open as a child process of msconfig, with elevated privileges and higher integrity.
8
64
284
#Malware
analysis tip of the week:
Malware can call DeviceIoControl with the parameter 0x7405C (IOCTL_DISK_GET_LENGTH_INFO) to check the size of the disk. This can be used as an anti-VM and anti-sandbox technique 🥳
7
55
233
In case you didn't know,
#VirusTotal
has this (new?) feature that can generate hunting rules for files and URL's in one click 😍
It's hidden in the "Follow" menu.
2
47
232
Want to learn how
#malware
evades defenses and analysis tools? You can pre-order my new book "Evasive Malware" at Barnes & Noble for 25%-off (through 28 April)🥳
Use promo code "PREORDER25" when ordering.
5
49
229
#CobaltStrike
hunting tip of the week:
CS powershell loader one-liners can often be decoded using Cyberchef. Specifically,
@0xtornado
has a great recipe for this (link will be in comments). The resulting shellcode can then be run through a shellcode debugger (like Scdbg)!
2
96
226
#Malware
analysis tip of the week:
Malware can hide from a debugger by calling NtSetInformationThread and setting the ThreadHideFromDebugger flag. If this flag is set, the running code thread will no longer send debug events to the debugger, essentially hiding code execution. 🧐
3
72
223
#CobaltStrike
hunting tip of the week:
#PEsieve
by
@hasherezade
can oftentimes extract CS implants and loader shellcode directly from memory (depending, of course, on code injection methods). Try this out during investigations into suspect processes!
3
74
209
This write-up from
@_EthicalChaos_
is still one of the best ways to learn how EDR works at a fundamental level. 🤓 Good for both Blue and Red teams.
1
71
208
#MalwareAnaysis
tip: I've been using "shellcode2exe" a lot lately. It makes it a lot easier to statically analyze and especially debug shellcode, or run the shellcode in a sandbox. Shellcode2exe basically adds a PE header to your raw shellcode. 🤓
Any similar tools you all use?
11
36
203
The wait is over 🥳 I completed some major updates for VMwareCloak, a Powershell script that sanitizes VMware Workstation VM's from some of the common VM-detection techniques used by
#malware
! Try it out and let me know how it works for you 👇
Is malware detecting your VirtualBox VM's? Is pafish giving you trouble? Try out the latest release of my PowerShell-based tool VBoxCloak! A quick and dirty way to hide your VM's from some common VM-detection techniques. VMware coming soon! 🥳
8
104
373
1
58
194
Excited to announce that my book "Evasive Malware: Understanding Deceptive and Self-Defending Threats" is officially on the
@nostarch
website for Early Access! There is even a 25% discount available! 🥳
Thanks for all the support I've gotten so far!
2
38
185
Is malware detecting your VM's and making you sad? In case you missed it, I made some improvements to my PowerShell-based tool VBoxCloak! A quick and dirty way to hide your VM's from some common VM-detection techniques. 🥳
VMware updates coming soon!
2
68
167
VT Academy, a free course from
@VirusTotal
, is really awesome. It covers the basics of VT, as well as many important incident response, threat intel, and threat hunting fundamentals.
2
47
157
#CobaltStrike
hunting tip of the week:
EDR and AV got you down? Another way to detect/hunt for CS in your environment is through the deployment of Yara rules.
This list has some good stuff, including Yara rules from
@tenacioustek
and
@cyb3rops
.
0
69
155
Here is a really cool new feature in
@virustotal
: Code Insights! Basically it gives you an LLM-generated analysis of what the code does, for example in this VBS file 🔥
I'm not sure if this is only available in the commercial version of VT, but probably.
4
37
181
#MalwareAnalysis
tip: Inetsim is a network simulator for malware analysis. You can host your own files/payloads in inetsim really easily. I had to do this today to analyze a shellcode implant that was no longer hosted on its staging domain.
Here is how to do this 👇
3
26
146
Saw malware use DLL hijacking with an old legit copy of calc.exe. This version of calc.exe looks for a DLL called "windowscodecs.dll". Guess what happens when the malware drops a malicious DLL with the same name alongside calc.exe? 🥳
1
24
139
Here is an awesome list of anti-anti-VM measures you can implement in VMWare Workstation by simply modifying your VMX file. 🥳
1
40
143
Excited to announce I joined
@proofpoint
's Threat Research team! I'm fired up to be part of a team that makes up some of the best threat intel folks, detection engineers, and malware reversers I know😈
11
4
142
In VMware Workstation, you can add "SMBIOS.reflectHost = “True” to your VMX file to hide the default hypervisor BIOS info from
#malware
. Anyone know how to do this in VirtualBox? 🧐
1
35
139
As the usage of
#malware
written in Go is increasing, I was looking for a good analysis methodology for Go samples. Here is a good one from the team at
@SentinelOne
. 🤓
3
35
135
#CobaltStrike
hunting tip of the week:
"Beacon.dll" and "ReflectiveLoader" are hardcoded artifacts in (default!) Beacon implants. When hunting for implants in memory, these are a good clue!
For example, here is an implant injected into Acrobat Reader:
3
49
134
Hey infosec fam, hope you're all doing well! 😎Just a heads up - Barnes&Noble is offering 25% off on pre-orders for my book "Evasive Malware". If you ❤️ malware, check it out! No pressure, just wanted to share with you all. Promo code is: PREORDER25.
3
26
115
I was investigating a
#malware
sample that uses the Beep WinAPI function as an anti-analysis technique. It was just annoying enough to write a blog post on. Check it out if you want to learn more 🤓
1
37
115
Finally added
#VMware
support for my
#malware
anti-evasion scripts. This script will attempt to sanitize your VMware malware analysis VM's by modifying registry keys, files, and processes. Get it and test it out here:
Is
#Malware
detecting and evading your
#VirtualBox
virtual machines? Check out VBoxCloak - a Powershell script for hiding VirtualBox from malware. Guaranteed to bring down your pafish detections😄
3
29
78
2
60
109
"Stand up a 100% containerized Elastic stack, TLS secured, with Elasticsearch, Kibana, Fleet, and the Detection Engine all pre-configured, enabled and ready to use, within minutes." Yes please. 😎
0
23
104
Shout-out to
@hasherezade
for making
#hollows_hunter
! Working with this tool inspired me to write a quick tutorial on it:
Anyone know of other good malcode extraction tools like hollows_hunter?
2
47
94
Here's a list of
#shellcode
analysis tools, separated by runners/emulators and converters.
Thanks to all the people who contributed their favorite tools! 👇
#MalwareAnaysis
tip: I've been using "shellcode2exe" a lot lately. It makes it a lot easier to statically analyze and especially debug shellcode, or run the shellcode in a sandbox. Shellcode2exe basically adds a PE header to your raw shellcode. 🤓
Any similar tools you all use?
11
36
203
1
16
95
Not sure who needs to hear this, but I was today years old when I realized how effective conditional breakpoints in x64dbg are.. I had a need to break conditionally on all VirtualAlloc calls with a size parameter > 0x3000000. Here is how to do this.😎
3
16
93
#CobaltStrike
hunting tips for
@virustotal
:
1) The imports hash (imphash) "dc25ee78e2ef4d36faa0badf1e7461c9" is very common for Beacon implants.
2) The hardcoded pipe string "MSSE-%d-server" is very common as well.
If you want to find some implants, search for these in VT 😉
2
32
93
A simple stenography trick used by
#malware
is modifying data bytes in an image, reading the image (ReadFile), and extracting the modified bytes. For example, the highlighted bytes in this image, when executed as x86 code, could be shellcode:
mov eax, [ebp+0x5]
call eax
0
22
87
This analysis on a
#BruteRatel
agent is awesome. Nice work on this. I love to see deep-dives into adversarial emulation tools, especially tools being abused by malicious actors.❤️
1
21
87
Interested in learning how to analyze RTF
#malware
? I wrote up my step-by-step analysis of the recent 2023 NATO Summit lure maldoc. Let me know if I missed any techniques/tools that could have made this a better analysis 🤓
2
28
86
Interesting new project for purple-teaming AD. Thanks for the awesome research
@myexploit2600
and
@ZephrFish
. 😎
0
13
85
#Malware
analysis tip of the week:
As an anti-analysis technique, malware can sneakily execute code by registering a malicious exception handler using the AddVectoredExceptionHandler WinAPI function. The malware can then trigger an exception which jumps to the malicious code.
3
17
77
@JusticeRage
Wow. This is kinda groundbreaking actually. I wonder how it does with more bespoke code?
"This is a C2 decryption routine used by APT10".
1
2
77
I love this new Mitre visualization tool! A great way to visualize threat actor TTP's and other data. 😍
1
15
78
Is
#Malware
detecting and evading your
#VirtualBox
virtual machines? Check out VBoxCloak - a Powershell script for hiding VirtualBox from malware. Guaranteed to bring down your pafish detections😄
3
29
78
#Malware
analysis tip of the week:
Running simple XOR "bruteforcing" (like the great xorsearch from
@DidierStevens
) can help you find additional embedded executable code in a malicious file. Takes 30 seconds and can save a lot of time in the long run.
1
20
76
Having trouble identifying evasion techniques in
#malware
? CAPA can help you quickly assess where these techniques may lie in the malware's code. 🧐
4
29
72
I was investigating a
#SmokeLoader
#malware
sample and noticed it deletes its zone identifier information as an evasion technique.
I wrote up a quick blog post on this. Check it out if you find this as interesting as I did: 🤓 🥳
0
17
69
In one of the malware groups I am part of, someone asked a question about malware using the "unaligned function calls" evasion technique. Here is how this technique works: (1/5)
1
8
66
Just finished final edits for some additional chapters for my book "Evasive Malware". You can pre-order it from
@nostarch
. Thanks to everyone for the amazing feedback so far! ❤️
Make sure to read the book summary here:
0
18
63
Here is a stupid-simple PowerShell script for changing a system's username, hostname, and domain. I run this script before executing
#malware
in my sandboxes and sometimes it circumvents some basic VM checks. 🥳
0
13
61
Can AV vendors please stop calling
#CobaltStrike
and similar tools "riskware" or "PUA's/PUP's"? I think by now these "tools" are being used more often by threat actors than by pentesters...
14
8
62
Really cool presentation from researchers at
@TrendMicro
. Talks all about recent attacks abusing legitimate/commercial tools (for example, AnyDesk).
5
15
59
@cyb3rops
Florian, you are missing one key fact. Threat actors never use open source tooling. They only develop their own custom tooling because GitHub says “for educational use only”.
3
1
59
#VirusTotal
has a special field for mutexes (mutexes_created) in their Yara plugin. You can basically hunt for mutex references in the malware behaviors. I have found this useful on several occasions.
Here is an example hunt for common Remcos mutexes:
1
17
59
Interested in learning one method for unpacking
#StrelaStealer
? I wrote up a quick blog post on my experience with a recent sample.
SHA1: 627c28a917a2c700951f574d3ea7608cbf6546a5
C2: 45[.]9.74.12/server.php
Have fun 😈
4
15
60
When analysing malware strings prior to Yara rule creation, I use a one-liner for extracting and comparing strings from a malware sample set. I wrote up a quick blog post about this here. Happy
#100DaysOfYara
!
1
18
59
Pretty much sums up the new hunting fad started by the SolarWinds breach.
3
11
58
Nice
#malware
analysis methodology from the
@anyrun_app
team. Obviously vendor-focused, but some good tips nonetheless 🤓
0
15
54
Latest
#IcedID
droppers download the payload to "C:\programdata\*.jpg" and seem to be executed using:
"rundll32.exe C:\programdata\*.jpg, PlugInit".
Some indicators to hunt for 🙂
cc
@malwrhunterteam
@JAMESWT_MHT
@malware_traffic
@executemalware
@MalwarePatrol
@James_inthe_box
3
20
53
To all my friends located in the US, Barnes & Noble is running a pre-order sale (code: PREORDER25) for my upcoming book "Evasive Malware" through Friday, September 8th! 😎
Thanks to everyone who has already ordered and/or given me feedback! ❤️
0
9
52
Dynmx is a handy detection language for malware sandbox logs. Basically, it runs rules (similar to Yara or Sigma) against malware sandbox function logs to create custom detections for malware behaviours. 😎
2
17
48
To my US peeps, you can pre-order
#EvasiveMalware
today for 25% off at Barnes & Noble. The ebook is malware-free, promise. 😇
Use code “PREORDER25”.
0
11
48
Cool repository of malware source code from
@vxunderground
. Not sure how I just heard about this. Apparently I live under a rock. 🤔
1
17
46
I'm working on a research project around evasive, context-aware, and self-defending
#malware
. Any experts (or wanna-be experts) see any cool new techniques being used out there in the wild? DM's open, please RT for visibility.
8
30
46
Short update:
You can pre-order the book from many sites online, but these do not include the Early Access version of the book. With Early Access, you get an early version of the book (plus the final version once it’s ready). Early access will be available from No Starch soon!
I’m excited to announce that my book, “Evasive Malware”, will soon be available for pre-order! The past 2.5 years of late nights, eye strain, and carpal tunnel is almost worth it 😎
Also excited to announce that my technical reviewer is the amazing
@fr0gger_
!
Stay tuned! 👇
44
254
1K
2
6
45
Fun
#malware
analysis story. I submitted a sample to a sandbox today. The sample downloads a payload, so I started analysing that. 30 minutes in and I find out I'm reversing the fake executable that inetsim returns. 🙄
6
1
45
Merged new updates to the
#VMwareCloak
project, thanks to the suggestions from
@t_mtsmt
! This Powershell script helps hide your analysis VM's from
#malware
(by modifying registry keys, killing processes, etc.) 😎 Try it out, and I'm open to feedback!
0
14
47
Looks like some of the new
#Emotet
payloads are executing using:
"rundll32.exe <shady_temp_dir>,Control_RunDLL"
This would make for a good threat hunt. Not sure how many false-positives this would bring though.. 🙄
Thoughts?
2
6
43
Really nice analysis from
@voidsec
of the vulnerable driver used by Spybot's Terminator tool.
1
9
42
This is a no-brainer change that all orgs should try to make. This is such a prevalent attack vector. A simple GPO can make a lot of difference.
Malware campaign uses PDFs with OneDrive URLs to download JS, user interaction required to run the JS, delivers WasabiSeed using MSI, VBS, more JS and EXE.
Consider GPO to change the default file handler for JS,VBS,WSF etc. away from WScript to notepad
4
57
179
1
4
43
#IcedID
#malware
DLL's being delivered from Word documents containing macros.
C2: potimomainger[.]top
Many have compilation timestamp "2021-06-07 11:25:48".
cc
@malwrhunterteam
@JAMESWT_MHT
@malware_traffic
@executemalware
@abuse_ch
@MalwarePatrol
@James_inthe_box
1
19
40
Fresh
#CobaltStrike
Beacons here, with Adobe theme!
Are you awesome threat intel folks tracking this?
hxxp://microsoft.up-adobe[.]com
hxxp://flash.up-adobe[.]com
@malwrhunterteam
@JAMESWT_MHT
@malware_traffic
@executemalware
@abuse_ch
@MalwarePatrol
@James_inthe_box
@VK_Intel
2
13
39
Fresh
#CobaltStrike
beacons delivered here, with a Windows Update theme. Happy Friday!
hxxps://101.32.46[.]240/
Likely C2 domain: windows-update[.]nz
cc
@malwrhunterteam
@JAMESWT_MHT
@malware_traffic
@executemalware
@abuse_ch
@MalwarePatrol
@James_inthe_box
@bryceabdo
0
11
38
Fresh
#CobaltStrike
beacons delivered here! Happy Friday!
hxxp://155.94.151[.]222:443/m7Et
hxxp://156.239.157[.]66/uBZK
hxxp://207.148.102[.]51/Ds6p
cc
@malwrhunterteam
@JAMESWT_MHT
@malware_traffic
@executemalware
@abuse_ch
@MalwarePatrol
@James_inthe_box
@bryceabdo
1
19
37
Seeing
#CobaltStrike
Beacon C2 callbacks to here:
update.webguardsecurity[.]xyz
cc
@malwrhunterteam
@JAMESWT_MHT
@malware_traffic
@executemalware
@abuse_ch
@MalwarePatrol
@James_inthe_box
@bryceabdo
3
11
38
If you want to pre-order my book "Evasive Malware" (
@nostarch
) while also supporting
@fr0gger_
and
@DarkCoderSc
's
#UnprotectProject
, you can use the purchase code "EVASIVE25"! 🥳
More details below:
0
8
34
Tips to avoid ransomware infections:
Step 1: Install the Russian language pack on all your computers.
Step 2: Change all wallpaper to the image of Putin riding a bear.
Step 3: (Optional): Move to Russia.
5
6
36
This is a great video from
@DidierStevens
on reversing code in a malicious document, completed entirely with
#cyberchef
. Sometimes I think I'm too l33t for cyberchef and would rather punish myself with command line tools, but cyberchef is amazing.
0
12
37
#Log4j
exploitation attempting to download
#Mirai
payloads.
Delivery IP: 62.210.130.[250]
Mirai C2: Nazi[.]uy
cc
@malwrhunterteam
@JAMESWT_MHT
@malware_traffic
@executemalware
@abuse_ch
@MalwarePatrol
@James_inthe_box
2
10
35
Fresh
#CobaltStrike
beacons hosted here!
hxxp://app.hikvision[.]buzz
lol "hikvision" 😂
cc
@malwrhunterteam
@JAMESWT_MHT
@malware_traffic
@executemalware
@abuse_ch
@MalwarePatrol
@James_inthe_box
@bryceabdo
3
11
35
Want to learn how modern
#malware
hides from defenses and analysis tools? I wrote a summary of my new book. Check it out here! 👇
0
10
35
Love investigating malware? You can preorder and get early access to "Evasive Malware: Understanding Deceptive and Self-Defending Threats" - use coupon code "EVASIVE25" to get 25% off and send some ❤️ to the
#UnprotectProject
(
@fr0gger_
/
@DarkCoderSc
)
1
11
33
#CobaltStrike
beacon implant "Zoom Meetings.exe" using possible expired legit Zoom certificate, and using same C2 IP as this one from
@malwrhunterteam
.
@JAMESWT_MHT
@malware_traffic
@executemalware
@abuse_ch
@MalwarePatrol
@James_inthe_box
@bryceabdo
"DES8install.exe": 2e55617db3cc088420d78898548be6e92b88e6f1e56b732284fcbef2131dd6d8
47.95.205[.]52
cc
@VK_Intel
@bryceabdo
@JAMESWT_MHT
0
2
5
2
10
33
In the spirit of
#100DaysOfYara
, I've been working on a simple rule for a malware family I'm tracking, OriginBotnet. OriginBotnet is lightweight, modular offshoot of AgentTesla. I'll likely share the rule later to my Git - for now you all just get the screenshot 🤓
1
5
33
Fresh
#CobaltStrike
beacon implants delivered here, attempting to spoof Microsoft domain 😑
microsoft.systemservices[.]network
cc
@malwrhunterteam
@JAMESWT_MHT
@malware_traffic
@executemalware
@abuse_ch
@MalwarePatrol
@James_inthe_box
@bryceabdo
0
13
30
Today's fresh
#CobaltStrike
Beacons being served with
#Office365
theme.
hxxp://office.microsoft365[.]ga
hxxp://office.microsoft365[.]ga:8080
hxxp://xxx.vhvh[.]pw/
@malwrhunterteam
@JAMESWT_MHT
@malware_traffic
@executemalware
@abuse_ch
@MalwarePatrol
@James_inthe_box
@VK_Intel
2
15
30