Wireshark

Wireshark मैलवेयर विश्लेषण विवरण इस प्रयोगशाला में मैंने Log4J शोषण पर एक ज्ञात दुर्भावनापूर्ण पैकेट कैप्चर का विश्लेषण किया। मैंने अपनी जांच उसी खेल-योजना प्लेबुक से शुरू की जिसका उपयोग मैं पैकेट कैप्चर विश्लेषण के लिए करता हूं, जो आंकड़ों की जांच करना और यह देखना है कि कितने और कितने एंडपॉइंट...

RedLine-Stealer-C2-Defender-Bypass-Payload-Analysis

1. Connexion C2 – IP 198.46.86.63 L'analyse réseau révèle que RedLine Stealer établit une connexion vers l'adresse IP distante 198.46.86.63. Cette IP est probablement le serveur de commande et de contrôle C2 du maliciel, utilisé pour l'exfiltration de données et la livraison de commandes...

SOC-Investigation-CVE-2024-49138

🛡️ تقرير تحقيق مركز العمليات الأمنية SOC: استغلال CVE-2024-49138 📌 الملخص التنفيذي عنوان التنبيه: SOC335 - تم اكتشاف استغلال CVE-2024-49138 الخطورة: عالية المضيف المستهدف: Victor 172.16.17.207 نظام التشغيل: Windows 10 المستخدم الأساسي: letsdefend الحكم: إيجابي حقيقي تم تأكيد النشاط الخبيث 🔍 منهجية...

MAL-2024-11817 Malicious code in planweb-core-ui (npm)

This package contains code to download a second stage payload which establishes a C2 connection and persistence via registry keys. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acc967a53ff92a71f6b9518c692bf641aa3595a3b65f28cc403b471c0474b175 Any computer that has...

HZ Rat backdoor for macOS attacks users of China’s DingTalk and WeChat

In June 2024, we discovered a macOS version of the HZ Rat backdoor targeting users of the enterprise messenger DingTalk and the social network and messaging platform WeChat. The samples we found almost exactly replicate the functionality of the Windows version of the backdoor and differ only in t...

NamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation

This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotato. I faced...

Additional Analysis into the SUNBURST Backdoor | McAfee Blogs

ARCHIVED STORY Additional Analysis into the SUNBURST Backdoor Christiaan Beek · DEC 17, 2020 Executive Summary There has been considerable focus on the recent disclosures associated with SolarWinds, and while existing analysis on the broader campaign has resulted in detection against specific IoC...

PT-2018-6156

Name of the Vulnerable Software and Affected Versions: npm-script-demo affected versions not specified Description: The npm-script-demo package is a piece of malware that opens a connection to a command and control server and executes the instructions it is given. Any computer with this package...