Vidar-Stealer-Reverse-Engineering

Vidar Stealer 2.0 리버스 엔지니어링 분석 개요 이 분석은 탐지를 피하기 위해 고급 회피 기술을 사용하는 정교한 정보 탈취기인 Vidar Stealer 2.0 에 대한 심층적인 리버스 엔지니어링을 다룹니다. 주요 발견 사항은 다음과 같습니다: 작업 스케줄러 변조: 포렌식 분석을 회피하기 위해 시스템 작업 타임스탬프를 1999로 수정합니다. Explorer.exe 프로세스 할로잉: 합법적인 Windows Explorer 프로세스에 셸코드를 주입합니다. Microsoft Copilot 인젝션: 은밀한 실행을 위해 새로...

burner-net

BurnerNet ゼロトラスト、アンチフォレンジックHTTPクライアント。秘密を消去し、痕跡を断つ。ステルスタンクのCPR。👻 BurnerNetはC++20のアンチフォレンジックHTTPクライアント です。ローカルマシンを完全には信頼できないアプリケーション向けに、流暢なCPRライクなAPIを提供します。RAMから秘密を物理的に消去し、実行痕跡を断ち切ることで、スキャナやデバッガからロジックを隠します。...

CryKeX

Properties: Cross-platform Minimalism Simplicity Interactivity Compatibility/Portability Application Independable Process Wrapping Process Injection Dependencies: Unix - should work on any Unix-based OS BASH - the whole script root privileges optional Limitations: AES and RSA keys only Fails most...

usbkill

« usbkill » is an anti-forensic kill-switch that waits for a change on your USB ports and then immediately shuts down your computer. To run: root@kitploit: sudo python usbkill.py or root@kitploit: sudo python3 usbkill.py Related project; same idea, but implemented as a Linux driver:...

usbkill

« usbkill » は、USBポートの変化を監視し、変化を検出すると即座にコンピュータをシャットダウンする、アンチフォレンジック用キルスイッチです。 実行方法: root@kitploit: sudo python usbkill.py または root@kitploit: sudo python3 usbkill.py 関連プロジェクト（同じアイデアをLinuxドライバとして実装したもの）: https://github.com/NateBrune/silk-guardian なぜ使うのか? このツールを使用する理由:...

MAL-2026-10535 Malicious code in my-empty-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914ffc98ce1f6553e4f9655208318800d0d22663842eb4c9a3d0d51d4f143bdd package.json declares postinstall: node index.js. On npm install, index.js branches on os.platform and executes platform-specific shell commands:...

Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access

An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day at least two months before it was publicly disclosed, according to new findings from Google-owned Mandiant. The vulnerability, tracked as CVE-2026-20245 CVSS score: 7.8...

MAL-2026-6299 Malicious code in analysis-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1ab4349bcc1e8f4434817d242b136f6e6050d4acb234aa833d81ffd74942066 The package's postinstall hook install-hook.js, invoked via package.json scripts.postinstall fetches an opaque binary 'payload.bin' from...

MAL-2026-4393 Malicious code in @hanssoft/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063fa3a06df50a8c53c5eb05ac4d1214e6fa1edfb18d03c8484fa2014190659a Package name impersonates the well-known libsignal-node Signal Protocol library and ships a verbatim copy of its README, but the code is unrelated. O...

SHIELD: a Secure and Highly Enhanced Integrated Learning for Robust Deepfake Detection against Adversarial Attacks

Audio plays a crucial role in applications like speaker verification, voice-enabled smart devices, and audio conferencing. However, audio manipulations, such as deepfakes, pose significant risks by enabling the spread of misinformation. Our empirical analysis reveals that existing methods for...

Unallocated space analysis

TL;DR Unallocated space retains remnants of deleted files, metadata, logs, caches, and other artefacts. This is useful if a user attempts to cover their tracks, delete files, reformat drives, or use anti-forensic tools. These remnants can help reconstruct user actions exposing data exfiltration...

Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity

The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year. While the first attack in May 2022 entailed the use of a vulnerable version of a certificate software that's wide...

Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity

The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year. While the first attack in May 2022 entailed the use of a vulnerable version of a certificate software that's wide...

APT Hackers Targeting Industrial Control Systems with ShadowPad Backdoor

Entities located in Afghanistan, Malaysia, and Pakistan are in the crosshairs of an attack campaign that targets unpatched Microsoft Exchange Servers as an initial access vector to deploy the ShadowPad malware. Russian cybersecurity firm Kaspersky, which first detected the activity in mid-October...

Second New 'IsaacWiper' Data Wiper Targets Ukraine After Russian Invasion

A new data wiper malware has been observed deployed against an unnamed Ukrainian government network, a day after destructive cyber attacks struck multiple entities in the country preceding the start of Russia's military invasion. Slovak cybersecurity firm ESET dubbed the new malware "IsaacWiper,"...

Chinese Hackers Used a New Rootkit to Spy on Targeted Windows 10 Users

A formerly unknown Chinese-speaking threat actor has been linked to a long-standing evasive operation aimed at South East Asian targets as far back as July 2020 to deploy a kernel-mode rootkit on compromised Windows systems. Attacks mounted by the hacking group, dubbed GhostEmperor by Kaspersky,...

GhostEmperor: From ProxyLogon to kernel mode

Download GhostEmperors technical details PDF While investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. This cluster stood out for its usage of a formerly unknown Windows kernel mode...

Using Real-Time Events in Investigations

To understand what a threat actor did on a Windows system, analysts often turn to the tried and true sources of historical endpoint artifacts such as the Master File Table MFT, registry hives, and Application Compatibility Cache AppCompat. However, these evidence sources were not designed with...

Linux Memory Cryptographic Keys Extractor: CryKeX

Some work has been already published regarding the subject of cryptograhic keys security within DRAM. Basically, we need to find something that looks like a key entropic and specific length and then confirm its nature by analyzing the memory structure around it C data types. The idea is to dump...

Fileless Memory-Based Malware Plagues 140 Banks, Enterprises

Attackers have been using well-known, standard utilities to carry out attacks on organizations around the world, and covering their tracks by wiping their activity from the machine’s memory before its rebooted. The attackers, who may be connected to the GCMAN and Carbanak groups, aren’t using...