pridelocker-analysis

PrideLocker ESX 加密器分析 此仓库包含与 PrideLocker 分析相关的资源，相关分析见这篇博客文章：https://www.synacktiv.com/publications/pridelocker-a-new-fork-of-babuk-esx-encryptor.html。 一个 IDA Python 脚本，用于对 PrideLocker 样本（未公开）中嵌入的字符串进行去混淆处理 以及一条用于检测其他 PrideLocker 样本的 YARA 规则 版权 2022 - Théo Letailleur, Synacktiv 许可证 此仓库的内容在 AGPL 许...

Supernova

Supernova シェルコード暗号化・難読化ツール。 説明 Supernovaは、ユーザーが生のシェルコードを安全に暗号化および/または難読化できるようにするオープンソースツールです。 -red?link=https%3A%2F%2Fgithub.com%2Fnickvourd%2FSupernova%2Freleases Supernovaは、一般的なシェルコード暗号化ツールに見られる機能を超えるさまざまな機能をサポートしています。詳細については、機能セクションを参照してください。 コマンドラインの使用法と例については、Wikiを参照してください。...

b4tm4n

B4TM4N PHP WEBSHELL Login Account Default Username : k4mpr3t Password : k4mpr3t Features 0 File Manager 1 Sec. Info 2 Simply Database 3 Interactive terminal 4 PHP Reverse Back Connect 5 Run PHP Code 6 Custom Toolz 7 Self Script Encryptor ! 8 Error Handler 9 Themes Self Script Encryptor Usage :...

b4tm4n

B4TM4N PHP WEBSHELL ログインアカウント デフォルト Username : k4mpr3t Password : k4mpr3t 機能 0 ファイルマネージャー 1 セキュリティ情報 2 シンプルデータベース 3 インタラクティブターミナル 4 PHP リバースバックコネクト 5 PHP コードの実行 6 カスタムツール 7 自己スクリプト暗号化 ! 8 エラーハンドラー 9 テーマ 自己スクリプト暗号化 Usage : http://website.com/shell.php?x=self-encryptor&name=shellencrypt.php...

xencrypt

Xencrypt PowerShell crypter v 1.0 作者 Xentropy @SamuelAnttila SecForce @SECFORCELTD このツールの設計思想や独自のcrypterの作り方について知りたい方は、私が書いた記事があります： Write a crypter in any language 注意...

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

In this article 1. Pre-encryption 2. Encryption 3. Post-encryption 4. Defending against DeadLock ransomware 5. Indicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure ...

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

In this article 1. Pre-encryption 2. Encryption 3. Post-encryption 4. Defending against DeadLock ransomware 5. Indicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure ...

Supernova v4.1

Supernova Shellcode encryptor & obfuscator. Description Supernova is an open-source tool that empowers users to securely encrypt and/or obfuscate their raw shellcode. -red?link=https%3A%2F%2Fgithub.com%2Fnickvourd%2FSupernova%2Freleases Supernova supports various features beyond those typically...

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

In this article 1. Pre-encryption 2. File encryption 3. Post-encryption 4. Defending against The Gentlemen ransomware 5. Microsoft Defender detections and hunting guidance 6. Indicators of compromise Ransomware that combines robust encryption with rapid lateral movement significantly increases th...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the managed authenticated encryptor while computing HMAC validation tag. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Note: Shared framework...

Timing Attack

Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Timing Attack via the password encryptor during the login process. An attacker can determine the existence of user accounts by analyzing differences in server...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the password encryptor during the login process. An attacker can determine the existence of user accounts by analyzing differences in server response times to crafted authentication requests. Remediation Upgrade...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the password encryptor during the login process. An attacker can determine the existence of user accounts by analyzing differences in server response times to crafted authentication requests. Remediation Upgrade...

Malware in keypair-encryptor

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-3297 Malicious code in keypair-encryptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c02f1145632762977fc8763c9f6ee3f5c9272b45196357654217a1bc1ce13bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keypair-encryptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c02f1145632762977fc8763c9f6ee3f5c9272b45196357654217a1bc1ce13bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Unwrapping the emerging Interlock ransomware attack

Cisco Talos Incident Response Talos IR recently observed an attacker conducting big-game hunting and double extortion attacks using the relatively new Interlock ransomware. Our analysis uncovered that the attacker used multiple components in the delivery chain including a Remote Access Tool RAT...

BlackByte Ransomware Exploits VMware ESXi Flaw in Latest Attack Wave

The threat actors behind the BlackByte ransomware group have been observed likely exploiting a recently patched security flaw impacting VMware ESXi hypervisors, while also leveraging various vulnerable drivers to disarm security protections. "The BlackByte ransomware group continues to leverage...

CVE-2023-49113

The Kiuwan Local Analyzer (KLA) Java scanning application contains multiple hard-coded secrets in plain text format within its JAR files. Specifically, the lib.engine/insight/optimyth-insight.jar file contains InsightServicesConfig.properties, which exposes valid GitHub credentials (insight.githu...

PT-2024-13679 · Github · Github

Name of the Vulnerable Software and Affected Versions: Kiuwan SAST: versions prior to the fixed version Kiuwan Local Analyzer KLA affected versions not specified Description: The Kiuwan Local Analyzer KLA Java scanning application contains several hard-coded secrets in plain text format,...