My beginner's course for malware analysis is finally ready. 🎉🦔🦔🧫🧑‍🔬 Get access for free for the next 5 days by using the link below:

@BHinfoSecurity I teach malware analysis

CISA found a backdoor in a patient monitor. Direct link to PDF:

@huettenhain @malcat4ever @SquiblydooBlog

@greenplan_it Yeah, it was shared on OALabs discord. :D

@huettenhain Thanks, I was not aware of the snip -r option. The rest I actually could have done better X)

RT @vxunderground: Mildly irritating things seen by malware nerds: - Person saying {thing} evades EDR and/or AV, but they've never perform…

RT @_montysecurity: Dropped a new tool for malware researchers. It is used to continuously ingest, analyze, and alert on samples given a se…

@greenplan_it @ShanHolo @lontze7 @RexorVc0 @DaveLikesMalwre @JAMESWT_MHT Nice one!

RT @x86matthew: I created a hypervisor-based emulator for Windows x64 binaries. This project uses Windows Hypervisor Platform to build a vi…

@decalage2 MSI which are also .JAR have been abused. MSI part is legit and validly signed. JAR is malicious.

Articles make it often seem easier than it actually is. So choosing one that looks do-able, should have the right difficulty to feel challenged but not too much. The article also serves as feedback mechanism, you can compare whether you came to the same results.

Juicy bits in Lumma Stealer dev Q&A

@vxunderground So we just use Haskell

@ShanHolo @lontze7 @RexorVc0 @DaveLikesMalwre @JAMESWT_MHT Thanks 😄

@ShanHolo @lontze7 @RexorVc0 @DaveLikesMalwre @JAMESWT_MHT This decodes it sample | snip 27:209493 | rex "(..)." {1} | hex | carve -sd intarray [| alu B-147 ]| carve -sd b64 | recode | rex \".+?\" | carve -sd b64 | decompress

@DebugPrivilege Yeah, malware researcher here.

We would have less fake news about malware on USB adapters and analysis time wasted if sandboxes changed their wording from "malicious" to "interesting to look at"--which is how they are actually understood by analysts.

RT @dodo_sec: As promised, my Ida script for finding a common string encryption algorithm in Delphi samples has been improved and I've rele…