MalwareLab

Malware Analysis, DFIR, Computer Forensics, Incident Response, ThreatIntel, OSINT, CyberSecurity, Education. EN/SK content. Opinions are my own.

Public Key

npub1ksxp2k6449prsqz6e3uq4k87hzw64v6c6u7zqdw9u99ev2y7gfpsnh07l5

NIP-05 Address

[email protected]

NIP-57 Address

[email protected]

Profile Code

nprofile1qqstgrq4td26js3cqpdvc7q2mrlt38d2kdvdw0pqxhz7zjuk9z0yyscpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsldr2a6

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1ksxp2k6449prsqz6e3uq4k87hzw64v6c6u7zqdw9u99ev2y7gfpsnh07l5

Show more details

Last Notes

2024-08-16 21:54:07

One example why to use strong #passwords for users who use file sharing over #SMB even when the file transfers are #encrypted.
If the SMB traffic is captured/eavesdropped, then the attacker can try to crack the user password.
The attacker is able to extract challenge/response values from the Session Setup and then use #passwordcracking tools such as #hashcat
If the attack is successful, the attacker will gain not only the access to the user account, but it is also possible to decrypt the captured SMB file transfers. There is lack of perfect forward secrecy in this encryption.
For more details and practical examples, see this blog post:
https://malwarelab.eu/posts/tryhackme-smb-decryption/
#networktrafficanalysis #networktraffic #encryption #windows #fileshare #pentesting #cybersecurity #hardening #password #cracking #offensivesecurity #offsec #blueteam #purpleteam

2024-08-15 21:44:29

- reply

True. Usually we have more followers than friends. And follower-relation is unidirectional, while it would be nice if the friendship relation will be bidirectional

2024-08-15 20:24:28

Recent #TryHackMe room inspired me to publish blog about Decryption of #SMB traffic.
 Summarized 3 methods of decryption in #Wireshark: - with user password - with NTLM hash - without them, just by cracking the captured #network traffic
 https://malwarelab.eu/posts/tryhackme-smb-decryption/
 #cryptography #networkanalysis #networktrafficanalysis #networktraffic #samba #encryption

2024-03-26 19:12:17

If you want to create your custom #packetsniffer based on #Scapy, the recent webcast by #ActiveCountermeasures could be a good starting point.
Bill provided nice explanation and his sniffer template is available on GitHub.
https://github.com/activecm/sniffer-template
https://www.youtube.com/watch?v=gO3OjyyLN40
#networkmonitoring #networkanalysis #networkforensics #networking
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/163/302/852/914/101/small/db38a1a34e8f09cc.png

2024-03-25 22:13:17

Top 10 #Networking #Tools & Techniques by #ActiveCountermeasures.
I have lot of fun watching this video and there are several useful tips&tricks by Chris and Bill.
Especially recommended to see use cases for #tshark, #tcpdump with #BPF and counting connections per hour from PCAP an #zeek logs
https://www.youtube.com/watch?v=0I6W175cUQk
#networkanalysis #networktraffic #networkforensics

2024-03-23 17:58:26

Recent #stegocampaign delivering #XWorm RAT #malware
#VBS -> #PowerShell -> #stego picture with executable -> TXT -> #xwormrat
Payloads at #Pastebin and #Firebase
My new analysis + #IOC: https://malwarelab.eu/posts/stego-xworm/
#steganography #anyrun #malwareanalysis #obfuscation #cyberchef
https://malwarelab.eu/img/stego-xworm-processes.png
https://malwarelab.eu/img/stego-xworm-stego-powershell.png
https://malwarelab.eu/img/stego-xworm-stego-image.png
https://malwarelab.eu/img/stego-xworm-stego-cyberchef.png

2024-03-23 10:52:04

LNK file with "Copy" command used as simple downloader for #Xworm #RAT and #AsyncRAT The source argument of copy command is the network location in this case, which effectively means that the remote BAT file is downloaded to the victim computer.
https://void.cat/d/LJ24du48Di4aEeDSMMfswN.webp
LNK files are often used for malicious purposes. For example, they can be the delivered as email attachments and can run malicious PowerShell commands. However, this one is demonstration of KISS principle - simple and stupid (or actually smart) usage of essential utility.
https://void.cat/d/VjMqoszc4GxEW6WZkm6pWQ.webp
Ref: https://app.any.run/tasks/1cbca783-8323-474e-aa6a-ca655ed6637e/
#malware #malwareanalysis #lolbin #sandbox #AnyRun

2024-02-15 02:34:13

Food for thought: what would you recommend for non-tech people and BFU to improve their online security?
Just one recommendation for people who do not like technology, they are not able to install OS such as #Qubes, #Tails, Whonix, Linux, etc. Let’s assume the standard Windows user with OS preinstalled on their computers, with enabled security updates.
================
What about these recommendations:
- more privacy-oriented browser?
- password manager?
- 2FA?
================
With privacy oriented browser they could prevent their tracking and leaking info. Moreover, they will see more cleaner websites without lot of junk and even YouTube videos will be ad-free. They will love it.
With password manager, they will prevent easy to guess passwords and password spraying. In top of that, with browser extension’s checks of URLs/Domains they can prevent phishing sites. But using local password manager (e.g. keepassxc) can be very annoying for them, especially when they will want to login from some other device (computer at work, smartphone, tablet).
Alternatively, they could use cloud password manager (or local password manager with db synchronized via cloud) and mobile app. So they will always have access to their passwords, but still very annoying when they will need to manually type 20-chars long random password from mobile to some other computer (e.g at work). They will hate it.
With 2FA enabled and their habit to use 3-4 passwords everywhere, they will prevent successful login with password spraying (because of 2FA). They will partially prevent phishing (except scenarios such as 2FA MITM, Browser in Browser for hijack sessions). They will be able to login even from other devices.
It is relatively easy to install auth app on smartphone and enable 2FA everywhere possible. Most of important services already support TOTP. Lot of them can send notification after successful password attempt from non-usual location, so users will be notified about problem and hopefully they realize that 3-4 passwords are not a good long-term approach. They will accept it.
What are your options?
#cybersec #dilemma #privacy #security #passwords #mfa #2fa #browser #authenticator #totp #awareness #hardening #education

2024-02-15 01:48:51

Sounds like a good idea to spread more #cybersecurity awareness content
#note1jv3…xgd3

2024-02-14 07:08:07

This is very sad. With offers like this, there is a motivation for bad actors to join #opensource projects as developers and hide a backdoor or vulnerability in their code.
Similar offers can turn developers into #insiderthreat and more reviews and #security audits will be needed - more funds for open source projects needed for operations and processes instead of salaries for developers to pay their great work and effort.
#0day #vulnerability #audit #backdoor #development #cybersecurity #pentest #redteam
#note1mjf…938l

2024-02-13 22:52:59

My older article about #malware #analysis #tools, part 1.
Screenshots are two years old, but these 5 free tools are still suitable especially for analysis of native executable files (PE for OS #Windows, or ELF for OS #Linux)
https://malwarelab.eu/posts/malware-analysis-tools-1/

2024-02-12 08:05:33

Sample analysis of #infostealer #malware pretending to be a hack for #roblox anticheat.
https://www.securitydungeon.sk/img/2024-oarv-den-bezpecnosti-anyrun.png
This week I delivered one lecture about cyber attacks and three 45-minutes malware analysis workshops with #anyrun and #cyberchef for high school students in #Roznava, #Slovakia.
https://www.securitydungeon.sk/img/2024-oarv-den-bezpecnosti-cyberchef.png
#Education #CyberSecurity #blueteam #dfir #sandbox
[SK post] https://www.securitydungeon.sk/blog/2024-oarv-den-bezpecnosti/

2024-02-09 10:36:41

TLDR: if you use Fortinet SSL VPN you have to disconnect your remote users. Immediately 🤦‍♂️
Critical #vulnerability in #Fortinet #FortiOS SSL #VPN.
Remote code execution without authentication.
Potentially already exploited in the wild.
Patches for supported versions are available, and they also recommend workaround: disable SSL VPN. Not just a webmode, but the entire SSL VPN.
It means that companies with Fortigate firewalls have to disconnect their remote workers from VPN if they cannot patch immediately or if they do not use IPsec VPN instead of SSL VPN.
https://www.fortiguard.com/psirt/FG-IR-24-015

2024-02-08 07:25:11

So easy.
https://i.nostrimg.com/697da56568a590cd15125fa001050efb38ad3573d54bdf858e02826bd4c54347/file.jpg
It goes #viral despite the lack of serious resources and information in the original article by Swiss news site.
While there are still lot of articles and posts about the 3 million #toothbrush #DDoS, several #security companies already stated somethnig like this. Until now I still have not seen any evidence of bothet with 3M toothbrushes and their DDoS attack - botnet of this kind and size will be observed very soon.
#Fortinet already said that the toothbrushes botnet was the hypothetical scenario during the interview.
https://i.nostrimg.com/3b72bbbd991b21bfd0195b74c8e489536d79a1becb790a3f6feb8aa9a39699c3/file.png
Ref:
https://www.malwarebytes.com/blog/awareness/2024/02/how-to-tell-if-your-toothbrush-is-being-used-in-a-ddos-attack
https://www.bleepingcomputer.com/news/security/no-3-million-electric-toothbrushes-were-not-used-in-a-ddos-attack/
#nevent1q…7wjj

2024-02-06 23:50:51

- reply

Yes, very good question. Everywhere is something “smart”, but too often it is very stupid to own and use those things. Single purpose things should stay single purpose, we do not need to turn them into smart devices just because it is cool (no, it isn’t, it is just marketing). #Privacy matters

2024-02-06 22:19:44

- reply

Currently it is not clear if this is real or not (important info is missing in the original source).
However, this illustrates that lot of internet-connected things around us could be potential threat. Even the things we do not realize immediately such as washing machines, toothbrushes, refrigerators, etc. Of course, there are lot of examples of things already participated in DDoS attacks and/or infected with malware: soho routers, smart tv, printers, lightbulbs and other smarthome stuff.

2024-02-06 22:02:32

#IoT often means Internet of Threats… so many “smart” toothbrushes infected with #malware 🪥 🦠 ☠️
#ddos #cybersecurity
#note1c9c…3zzk

2024-02-05 23:52:25

#SSH keys with #Yubikey are very convenient and secure way to login. And you can have as many SSH keys as you want (*) protected with a single Yubikey or other #FIDO2 authenticator.
(*) I mean standard (non-resident) ed25519-sk and ecdsa-sk public/private keys.
There is also option to generate the resident key, where the credential id file is stored in Yubikey and not on your computer. But this is kind of equivalent of storing file with your credential id file on USB flashdrive and keep it together with Yubikey. The resident keys can be extracted from Yubikey.
And yes, I write credential id file instead of private key, because the generated file with private key is not the true private key. Instead, it is kind of seed/key handle and the true secret is stored in Yubikey and cannot be extracted.
* Non-resident keys are ideal for systems where #privacy is important if the YubiKey is lost or stolen.
* Resident keys are ideal for ease of access where the FIDO2 PIN is known.
More info: https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html
#cryptography #authentication #fido2 #webauthn #2FA #MFA
#nevent1q…lqja

2024-02-04 17:16:07

- reply

Alby extension is available for firefox and it also supports chromium-like browsers, too. I was able to try it without google login in one of the more privacy-oriented browser for my experiments. However, I still have not tested the setup on android mobile, so good to know that it is not straightforward process.

2024-02-04 09:28:49

- reply

Pekný článok, vysvetlené poplatky aj možnosti, ako ich znížiť na minimum a ako bonus ku tomu mať aj rýchlejšie platby 👍
snáď sa to skrz Alzu dostane aj ku trocha širšej verejnosti

2024-02-04 09:19:18

This clearly demonstrates the meaning of real ownership of our accounts and the difference bewteen #Nostr and #Mastodon.
Do you have a private key for your account? Are you the only one who owns the key? Then the account is yours. Otherwise it can belongs to someone else - this is the case of Mastodon and other social media accounts.
If you have only the username/password, then the service provider is the person who can publish content on behalf of you, or do whatever they want with your account. They are also responsible for protecting your identity. But do they their best for protecting you? Can you trust them?
Similarities with custodial and non-custodial #wallets are not accidental.
#privacy #socialmedia #ownership #crypto #keys
#nevent1q…4etn

2024-02-04 09:04:33

Critical #vulnerability in #Mastodon. Attackers can impersonate and take over any remote account. Users cannot do anything, this issue mast be solved by admins of Mastodon instances. And they should update their instances as soon as possible, on 2024-02-15 more details about vulnerability will be published.
However, this announcement means that attackers will focus their research to origin validation in Mastodon. So, we can expect exploitation attempts soon. And in two weeks, provided with details from updated announcement, it will be very easy to come up with an exploit, as announcement said.
https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw

2024-02-02 22:28:50

- reply

That sounds really good. Your experiences are the best advertisement for #PostmarketOS 👍

2024-02-02 22:02:41

- reply

Yeah, Wazuh is great tool, it provides good visibility into your infrastructure. #Velociraptor is another example, but more useful for incident response and threat hunting in larger networks.
In top of that, network monitoring with IDS such as #suricata + ET Open signatures is useful addition especially for detect threats and anomalies originating from devices without wazuh installed. Analyzing traffic from IoT, guest laptops and smartphones and identification of all devices connected to the network is often very educative exercise.

2024-02-02 01:59:39

- reply

Thank you. Actually, malware analysis can be very funny and often it is kind of #puzzle solving game. Great hobby for those who like mysteries and #technology. I learned lot of things just by trying to understand the binaries, assemblies, decompiled code and scripts

2024-02-02 01:34:53

Any.Run now supports #Ubuntu operating system for behavioral analysis of #Linux samples.
#AnyRun is very useful #malware analysis #sandbox, you can interact with the virtual machine through your browser. It provides good visibility of processes, file and network events. Sandbox utilizes various signatures and rules for detection of suspicious activity. It can extract configs of several malware families.
Thanks to built-in #ChatGPT support it produces human-readable malware analysis report of windows samples suitable for less experienced analysts.
https://any.run/cybersecurity-blog/linux-in-anyrun/
https://i.nostrimg.com/31b898dedd48077d3052a248226e15b60459a6e551ed99eaed4b51401772b03b/file.png
https://i.nostrimg.com/e6a0dfbc6aef295435e1c1699a144f61bf9bf9632809a1d7c5944b08a01e4137/file.png
https://i.nostrimg.com/da041179c5d5773d5e7da6ed945976c59ab9276897b2b3efd9ba1ee53e5d34dc/file.png

2024-02-01 07:27:55

- reply

Syslog vulnerability was introduced after Ubuntu 22.04, it affects Ubuntu 23.04 and newer.
Less severe qsort vulnerability is also in Ubuntu 22.04, and it is already patched.

2024-02-01 01:12:20

- reply

IMHO shorter blog with experiences from installation and initial setup and then daily/weekly updates here of what works and what doesn’t work will be more attractive. It could also motivate some folks to try #postmarketos, too :-)

2024-02-01 00:39:31

Recent privilege escalation vulnerabilities in GNU C Library #glibc widely used in many #Linux distributions such as #Debian, #Ubuntu, #Fedora and others.
CVE-2023-6246 #privesc #vuln can be triggered via #syslog by using long program name or ident parameter in openlog().
Another vulnerability is in #qsort function. While real-world affected programs are currently not known, this vulnerability is pretty old - since 1992 until now.
Reference: https://blog.qualys.com/vulnerabilities-threat-research/2024/01/30/qualys-tru-discovers-important-vulnerabilities-in-gnu-c-librarys-syslog
This is just another reason to consider using Linux distribution without glibc, for example #Alpine Linux with #musl

2024-01-31 22:28:53

- reply

It seems that #introductions is better hashtag than #introduction
So once again:
Hello #nostr
Time to short #intro of myself. I am a #cybersecurity analyst with a passion for #malwareanalysis, #dfir, #threathunting, #threatintel and other #blueteam stuff.
From time to time I would like to share some ideas, thoughts, tips&tricks and participate in discussions.

2024-01-31 22:24:08

Hello #nostr. Time to short #introduction of myself. I am a #cybersecurity analyst with a passion for #malwareanalysis, #dfir, #threathunting, #threatintel and other #blueteam stuff.
From time to time I would like to share some ideas, thoughts, tips&tricks and participate in discussions.

2024-01-31 22:14:13

@npub1tea…gq5u Verifying My Public Key: "malwarelab_eu"