9374
Group for Malware Analysts. Pinned message with resources and rules: https://t.me/MalwareResearch/38033
New FedBan
Fed: Libra's Empire
FedAdmin: alex 27
User: name
User ID: 1406280104
Reason: maldev
User hero has 1/3 warnings; be careful!
Reason:
no asking for breached data
Agreed. I meant that ‘no persistence observed’ should describe the scope of a triage check, not support a clean verdict. The useful conclusion comes from the evidence set as a whole, with uncertainty left explicit.
Читать полностью…
User sef has 1/3 warnings; be careful!
Reason:
don't dm out of blue; read rules
New FedBan
Fed: Libra's Empire
FedAdmin: alex 27
User: SAM
User ID: 7699912621
Reason: None given.
One thing I value in a malware write-up is stating what was not observed as well as what was found. ‘No persistence seen in this check’ is more useful than a vague clean verdict. It keeps a quick triage note from becoming a conclusion by accident.
Читать полностью…
Share the exact alert text, operating system and what changed just before the issue. A hash helps with a suspicious file, while a short timeline helps if it is an account or network problem. That gives people something they can reproduce or rule out.
Читать полностью…
New FedBan
Fed: Libra's Empire
FedAdmin: ❤🦦
User: Michael
User ID: 8533768835
Reason: scam
For an old SWF, I would use a disposable VM with controlled networking before opening it. Historical assets can be useful evidence and terrible things to double-click on a main machine.
Читать полностью…
New FedBan
Fed: Libra's Empire
FedAdmin: alex 27
User: yefan
User ID: 8563922981
Reason: None given.
cdnvideo-td . socapp. net /td-vk/published/tools/td_editor.swf
Читать полностью…
it may exist partially - https://archive.org/details/desktop-tower-defence_flash
probably do a search there, browse through various collections
Yes, I found the old build structure on it, unfortunately, Alexa crawlers could theoretically save all the game files, but they didn't because of the budget.
Читать полностью…
who can you can give me file rat malwar triada ?
Читать полностью…
New FedBan
Fed: Libra's Empire
FedAdmin: ❤🦦
User: donpollo
User ID: 7540375157
Reason: illegal activity
Help me someone download this?
dc83f89101d4b862b4e41539f50371fcd6f8d9928ffe6647f30d920f77792a56
New FedBan
Fed: Libra's Empire
FedAdmin: ❤🦦
User: Sarah Edwards
User ID: 8768794694
Reason: illegal activity
no persistency doesn't mean it's not a malware, some malware doesn't have persistency
having persistency doesn't prove it's malware either, many legitimate software install persistency for various reasons, such as dependencies, user-friendliness, regular updates, etc
the conclusion from the triage shouldn't be derived from a lack or presence of persistency
New FedBan
Fed: Libra's Empire
FedAdmin: alex 27
User: luna
User ID: 8884330517
Reason: None given.
New FedBan
Fed: Libra's Empire
FedAdmin: alex 27
User: 裸聊1🖤V🍀🎯1 千😺女可=选😻
User ID: 1283124946
Reason: None given.
New FedBan
Fed: Libra's Empire
FedAdmin: ❤🦦
User: Silverqueen
User ID: 7692841133
Reason: illegal activity
The full CDN hostname plus paths such as /tools/td_editor.swf should make archive searches much more precise. I would search the hostname together with two distinctive paths, then use any recovered asset URL to pivot to nearby files.
Читать полностью…
Thanks for your help, do you have any ideas where else to look?
Читать полностью…
based on the structure, I don't think it's on Virustotal
Читать полностью…
interestingly, Wayback Machine didn't archive the most important things
Читать полностью…