739 matches found
rasputin
RASPutin Risorse e articoli relativi alle mie conferenze e al mio lavoro su unRASPs. Questo lavoro ĆØ in corso, per favore sii paziente : Non esitare a contribuire / contattarmi / fare PR! Conferenze Insomni'hack 2022 - Forgiare un martello d'oro contro le protezioni delle app Android Questo talk ...
BruteRatel-DetectionTools
BruteRatel-DetectionTools Eine Sammlung von Tools und Regeln zum Decodieren von Brute Ratel C4-Badgers Alle Tools und Regeln basieren auf Beispielen, die von PaloAlto in ihrem Bericht https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ identifiziert wurden. Yara-Regel Die Yara-Regel wurde...
Powershell-Tools
PSUnzipper - PowerShell-Entpacker Verwendet SharpZipLiB in .NET, zur Laufzeit geladen keine Datei auf der Festplatte - Ref. https://github.com/icsharpcode/SharpZipLib Kann mit Passwort verwendet werden Zip, Unzip Beide VerschlĆ¼sselungsmethoden AES und ZipCrypto werden unterstĆ¼tzt. Beim...
YARA-Performance-Guidelines
YARA-Leistungsrichtlinien Das Schreiben effizienter YARA-Regeln ist entscheidend, um eine schnelle und genaue Scan-Leistung zu gewƤhrleisten. Dieser Leitfaden enthƤlt wichtige Prinzipien und Best Practices, die Ihnen helfen, Ihre Regeln zu optimieren, unnƶtige Berechnungen zu reduzieren und hƤufi...
MemProcFS-Analyzer
MemProcFS-Analyzer MemProcFS-Analyzer.ps1 ĆØ uno script PowerShell utilizzato per semplificare l'utilizzo di MemProcFS e per ottimizzare il tuo flusso di lavoro di analisi della memoria. MemProcFS - The Memory Process File System di Ulf Frisk https://github.com/ufrisk/MemProcFS FunzionalitĆ : Anali...
ExploitKnowdledgebase
poc2detect Defense-first pipeline that discovers GitHub proof...
YARA-X 1.17.0
YARA-X is a re-incarnation of YARA, a pattern matching tool designed with malware researchers in mind. This new incarnation intends to be faster, safer and more user-friendly than its predecessor. The ultimate goal of YARA-X is replacing YARA as the default pattern matching tool for malware...
Anonymous YARA Rules Are Not Anonymous
YARA rules are widely shared across threat intelligence communities to enable collective defence against malware. This practice implicitly assumes that removing metadata e.g., author fields sufficiently protects the identity of contributing organisations. To assess the validity of this assumption...
A Large Language Model Approach to Generating Bypass Rules for Malware Evasion in Analysis Sandbox
Sandbox evasion remains a critical challenge for automated malware analysis, as modern malware employs environment checks to detect analysis platforms and suppress malicious behavior. Existing approaches rely on manually crafted bypass rules that require deep reverse engineering of each evasion...
CVE-2026-44216 vulnerabilities
Vulnerabilities for packages: wizer, yara-x...
GHSA-P8XM-42R7-89XG vulnerabilities
Vulnerabilities for packages: wizer, yara-x...
GHSA-P8XM-42R7-89XG vulnerabilities
Vulnerabilities for packages: wizer, yara-x...
CVE-2026-44216 vulnerabilities
Vulnerabilities for packages: wizer, yara-x...
YARA-X 1.16.0
YARA-X is a re-incarnation of YARA, a pattern matching tool designed with malware researchers in mind. This new incarnation intends to be faster, safer and more user-friendly than its predecessor. The ultimate goal of YARA-X is replacing YARA as the default pattern matching tool for malware...
Static Attribution of Android Residential Proxy Malware Using Graph Kernels
Android residential proxy applications represent a growing class of potentially-unwanted programs PUPs that covertly route third-party traffic through end-user devices, enabling ad fraud, credential abuse, and evasion of geolocation controls by sophisticated threat actors. Attributing an unknown...
TLSCheck 2.0: An Enhanced Memory Forensics Approach to Efficiently Detect TLS Callbacks
Memory analysis is a crucial technique in digital forensics that enables investigators to examine the runtime state of a system through physical memory dumps. While significant advances have been made in memory forensics, the detection and analysis of Thread Local Storage TLS callbacks remain...
YARA-X 1.15.0
YARA-X is a re-incarnation of YARA, a pattern matching tool designed with malware researchers in mind. This new incarnation intends to be faster, safer and more user-friendly than its predecessor. The ultimate goal of YARA-X is replacing YARA as the default pattern matching tool for malware...
Exploit for Race Condition in Canonical Ubuntu_Linux
Dillu-Analyzer š”ļø Dillu Analyzer ā A web-based universal malwa...
Malicious code in react-refresh-update (npm)
Package contains highly obfuscated code with dynamic execution using eval, a strong indicator of malicious intent. YARA rule matches confirm. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68cf0c0bd6ed2a8c07bc175b5c0cc7f86a49133e67dd5d8f68f37309c5f1a463 The...
Malicious code in spectral-corsair-my-backdoor (npm)
Malicious package detected. Suspicious preinstall script exfiltrates data to a remote server. Multiple YARA rules and LLM analysis confirm. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0826a28f7948e68cdddd6260a01c3653a7f04deb2c9368054243ed47713ee353 The packa...