LaZagneForensic

Il Progetto LaZagne !!! Descrizione Il progetto LaZagne è tornato !!! LaZagne utilizza una funzione interna di Windows chiamata CryptUnprotectData per decifrare le password degli utenti. Questa API deve essere chiamata nella sessione dell'utente vittima, altrimenti non funziona. Se il computer no...

Not just an infostealer: Gopuram backdoor deployed through 3CX supply chain attack

On March 29, Crowdstrike published a report about a supply chain attack conducted via 3CXDesktopApp, a popular VoIP program. Since then, the security community has started analyzing the attack and sharing their findings. The following has been discovered so far: The infection is spread via...

LaZagneForensic - Decrypt Windows Credentials From Another Host

LaZagne uses an internal Windows API called CryptUnprotectData to decrypt user passwords. This API should be called on the victim user session, otherwise, it does not work. If the computer has not been started when the analysis is realized on an offline mounted disk, or if we do not want to drop ...