ios-malicious-bithunter

iOS Malicious Bit Hunter Abstract iOS Malicious Bit Hunter is a malicious plug-in detection engine for iOS applications. It can analyze the head of the macho file of the injected dylib dynamic library based on runtime, and can perform behavior analysis through interface input characteristics to...

GWTMap

설명 GWTMap은 Google Web ToolkitGWT 기반 애플리케이션의 공격 표면을 매핑하는 데 도움이 되는 도구입니다. 이 도구의 목적은 최신 GWT 애플리케이션의 난독화된 클라이언트 측 코드 내에 숨겨진 서비스 메서드 엔드포인트를 추출하고, 해당 엔드포인트와 상호 작용하기 위한 예제 GWT-RPC 요청 페이로드를 생성하는 것을 용이하게 하는 것입니다. 자세한 정보는 여기에서 확인할 수 있습니다:...

Fnord

Fnord Fnord는 난독화된 코드를 위한 패턴 추출기입니다. 설명 Fnord는 두 가지 주요 기능을 가지고 있습니다: 1. 바이트 시퀀스를 추출하고 일부 통계를 생성합니다. 2. 이 통계를 사용하여 길이, 발생 횟수, 유사성 및 키워드를 결합하여 YARA 규칙을 만듭니다. 1. 통계 Fnord는 파일을 다양한 크기의 슬라이딩 윈도우로 처리하여 최소 길이 -m X 기본값: 4부터 최대 길이 -x X 기본값: 40까지 모든 시퀀스를 추출합니다. 각 길이에 대해 Fnord는 가장 자주 발생하는 시퀀스 -t X 기본값: 3를...

CVE-2024-3094-info

CVE-2024-3094 정보 CVE-2024-3094 PoC 탐구 https://github.com/amlweems/xzbot https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin 답변 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

Krakatau

Krakatau는 Java 바이트코드를 위한 어셈블러와 디스어셈블러를 제공합니다. 이를 통해 바이너리 클래스파일을 사람이 읽을 수 있는 텍스트 형식으로 변환하고, 변경한 후 다시 클래스파일로 변환할 수 있으며, 난독화된 코드에서도 가능합니다. 또한 수동으로 바이트코드를 작성하여 처음부터 자신만의 클래스파일을 생성할 수 있으며, Java 바이너리의 저수준 세부 사항을 검토하고 비교할 수 있습니다. javap와 달리, Krakatau 디스어셈블러는 고도로 난독화된 코드도 처리할 수 있으며, 디스어셈블된 출력을 다시 클래스파일로...

Malicious code in dotenv-precheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e [email protected] is a credential-stealing package disguised as a dotenv preflight utility. package.json wires index.js as a postinstall script, ...

Malicious code in dotenv-preflight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e18dd97225f3e61274667a66297cee2224f99b7c3915e5a5f138028f5d0dd0 The npm package [email protected] presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily...

MAL-2026-17324 Malicious code in dotenv-preflight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e18dd97225f3e61274667a66297cee2224f99b7c3915e5a5f138028f5d0dd0 The npm package [email protected] presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily...

MAL-2026-16195 Malicious code in tailwind-forms-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f06c2ce29f04ce06cfb494996cb6ffde7aea02af92489abcacf10cbcb7beb2 tailwind-forms-styles ships a src/index.js that is fully obfuscated with obfuscator.io rotated 303-entry string array, hex-named identifiers,...

Malicious code in aitextutils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in pymem-win (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c611131ac135f4608698ce56eebd7dc89623b591510a050f2059369c9d51bbf Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package reusing its description, repository URL github.com/srounet/Pymem, and auth...

MAL-2026-16124 Malicious code in tailwindcss-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc68c81374c5b78e36fea2f599c5e0004ead6e56dfd02b40cec4f73c62193b30 The package presents itself as a Tailwind CSS forms plugin README, repository field, and installation docs are copied verbatim from @tailwindcss/form...

Malicious code in tsshare (PyPI)

The PyPI package tsshare is malicious. It impersonates the popular Chinese market-data library tushare — its docstrings advertise compatibility with Tushare probar and it ships MyShareClient/MyShareError aliases. tsshare/client.py conceals its default API endpoint by base64-decoding it at runtime...

Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

MAL-2026-15863 Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

MAL-2026-15673 Malicious code in fuels-versions (npm)

The package 'fuels-versions' was identified as containing malicious obfuscated code. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d9f8a553c586813518fefc4735aa6ee3416720489a27c83b8eff10c1a6a755 bin/cli.js contains a hardcoded out-of-band callback URL at...

Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

MAL-2026-15564 Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

MAL-2026-14545 Malicious code in pybitjs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5 The package's setuptools cmdclasses BuildPy, Develop invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing impor...

Malicious code in @syncraft-labs/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3986bd05347035d9263c22b871840f19dc42187d3e1719311cb67c6e1ef5cb9 dist/index.js the ESM entry resolved by default by modern bundlers such as Vite, Next.js, and Webpack contains a heavily obfuscated block using...