LaZagneForensic

¡El Proyecto LaZagne !!! Descripción ¡El proyecto LaZagne está de vuelta !!! LaZagne utiliza una función interna de Windows llamada CryptUnprotectData para descifrar las contraseñas de los usuarios. Esta API debe ser llamada en la sesión del usuario víctima, de lo contrario, no funciona. Si la...

Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack

On March 29, Crowdstrike published a report about a supply chain attack conducted via 3CXDesktopApp, a popular VoIP program. Since then, the security community has started analyzing the attack and sharing their findings. The following has been discovered so far: The infection is spread via...

LaZagneForensic - Decrypt Windows Credentials From Another Host

LaZagne uses an internal Windows API called CryptUnprotectData to decrypt user passwords. This API should be called on the victim user session, otherwise, it does not work. If the computer has not been started when the analysis is realized on an offline mounted disk, or if we do not want to drop ...