datadome-vm-internals

DataDome VM DataDome يضم آلة افتراضية مخصصة في حزمته لإخفاء ما يفعله بالفعل. أصبحت فضوليًا وفككتها. أشاركها هنا لمن يهتم بنفس النوع من ألغاز الهندسة العكسية. DataDome يرسل حزمة JavaScript مبهمة بشدة إلى متصفحك. بداخلها، توجد آلة افتراضية مخصصة — يقومون بتجميع منطق البصمات الفعلي الخاص بهم إلى تنس...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

XorStringsNET

XorStringsNET Uno strumento per la crittografia semplice e rapida delle stringhe basata su XOR per binari .NET XORStrings implementa un semplice cifrario basato su XOR, che chiamo RXOR. RXOR non solo crittografa la stringa ma ne inverte anche l'ordine dei caratteri. Ogni stringa viene crittografa...

LeetObfuscator

LeetObfuscator root@kitploit: ██╗ ███████╗███████╗████████╗ ██║ ██╔════╝██╔════╝╚══██╔══╝ ██║ █████╗ █████╗ ██║ ██║ ██╔══╝ ██╔══╝ ██║ ███████╗███████╗███████╗ ██║ ╚══════╝╚══════╝╚══════╝ ╚═╝ ██████╗ ██████╗ ███████╗██╗ ██╗███████╗ ██████╗ █████╗ ████████╗ ██████╗ ██████╗...

PT-2024-9958 · Ca · Ca Client Automation

Name of the Vulnerable Software and Affected Versions: CA Client Automation ITCM affected versions not specified Description: The issue is related to insecure privilege management in the CA Client Automation software, which allows non-admin or non-root users to encrypt strings using the CAF CLI a...

GuLoader: The NSIS Vantage Point

GuLoader: The NSIS Vantage Point By Nico Paulo Yturriaga · January 24, 2023 GuLoader is an advanced shellcode downloader infamous for using anti-analysis tricks to evade detection and obstruct reverse engineering. As of this writing, the GuLoader campaign is aggressively ongoing. Trellix’s...

CB Threat Analysis Unit: Technical Analysis of “Crosswalk”

The technical analysis is related to the TAU-TIN for the same malware which can be located in this post. FireEye recently reported on APT41, a Chinese state sponsored espionage group. The group has been documented as targeting healthcare, high-tech, and telecommunications companies for traditiona...

DanaBot Adds Ransomware to its Arsenal

A new sample of the DanaBot trojan spotted in a recent campaign reveals that operators behind the malware have now included a ransomware component into its code, along with new string encryption and communications protocols. The update, wrote Check Point researchers on Thursday, represents a...