LaZagneForensic

Le projet LaZagne !!! == Description Le projet LaZagne est de retour !!! LaZagne utilise une fonction interne de Windows appelée CryptUnprotectData pour déchiffrer les mots de passe des utilisateurs. Cette API doit être appelée depuis la session de l'utilisateur victime, sinon elle ne fonctionne...

Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack

On March 29, Crowdstrike published a report about a supply chain attack conducted via 3CXDesktopApp, a popular VoIP program. Since then, the security community has started analyzing the attack and sharing their findings. The following has been discovered so far: The infection is spread via...

LaZagneForensic - Decrypt Windows Credentials From Another Host

LaZagne uses an internal Windows API called CryptUnprotectData to decrypt user passwords. This API should be called on the victim user session, otherwise, it does not work. If the computer has not been started when the analysis is realized on an offline mounted disk, or if we do not want to drop ...