9 matches found
exch_CVE-2021-42321
exchCVE-2021-42321 This is the tool involved in the 7bits security team article "DotNet Security - CVE-2021-42321 Reproduction" Change the TypeConfuse chain to write to file, bypass Windows Defender to disable the w3wp.exe startup process. Overwrite the original ysoserial.net file with this file,...
yetAnotherObfuscator
yetAnotherObfuscator A C obfuscator tool that can bypass Windows Defender antivirus. I made this tool mainly as an excuse to learn more about C and how obfuscators function. This is an alpha release, so expect some nice bugs. Usage: Drag drop the C exe into yetAnotherObfuscator.exe Or provide the...
RedLine-Stealer-C2-Defender-Bypass-Payload-Analysis
1. C2 Connection – IP 198.46.86.63 Network analysis reveals that RedLine Stealer establishes a connection to the remote IP address 198.46.86.63. This IP is likely the malware's Command & Control C2 server, used for data exfiltration and command delivery. Key Observations: IP Address: 198.46.86.63...
MeterPwrShell
Inactive Tool - Reason : busy with something else root@kitploit: . . . / \ / | \ \ / /| | | | | | \ \ / \ / / \ / \ \ | / / | \ \ | | / | | | | / / / Y \ /| | \ /| | / | \ / | | / | Y \ /| || |/ \ | /\ | \ | || // || / /|| /\ /| \ / / / / / / / MeterPwrShell2 Automated Tool That...
MAL-2026-10064 Malicious code in multer-orm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb45c09aa7a237b2b9ff18ccf6426b76a4f46e5ea665c7747f35a345940e161 multer-orm is a typosquat of the widely used multer middleware. Its README is copied from multer, but the package adds a load-time dropper in...
Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners
A financially motivated operation codenamed REF1695 has been observed leveraging fake installers to deploy remote access trojans RATs and cryptocurrency miners since November 2023. "Beyond cryptomining, the threat actor monetizes infections through CPA Cost Per Action fraud, directing victims to...
CISA Adds Five Known Vulnerabilities to Catalog
CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-32046 Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability CVE-2023-32049 Microsoft Windows Defender SmartScreen Security Feature Bypass...
Threat Actors Adopt Havoc Framework for Post-Exploitation in Targeted Attacks
An open source command-and-control C2 framework known as Havoc is being adopted by threat actors as an alternative to other well-known legitimate toolkits like Cobalt Strike, Sliver, and Brute Ratel. Cybersecurity firm Zscaler said it observed a new campaign in the beginning of January 2023...
