ThreatCheck

ThreatCheck Matterpreter의 DefenderCheck 수정 버전입니다. 디스크의 파일 또는 URL에서 바이너리를 입력으로 받아, 대상 엔진이 플래그를 지정할 정확한 바이트를 식별할 때까지 분할한 후 화면에 출력합니다. 이는 도구/페이로드에서 특정 문제 코드를 식별하는 데 유용할 수 있습니다. C:\ThreatCheck.exe --help -e, --engine Default: Defender Scanning engine. Options: Defender, AMSI -f, --file Analyze a file...

RedLine-Stealer-C2-Defender-Bypass-Payload-Analysis

1. C2 연결 – IP 198.46.86.63 네트워크 분석 결과 RedLine Stealer가 원격 IP 주소 198.46.86.63에 연결을 설정하는 것으로 나타났습니다. 이 IP는 데이터 유출 및 명령 전달에 사용되는 악성코드의 C2Command & Control 서버일 가능성이 높습니다. 주요 관찰 사항: IP 주소: 198.46.86.63 프로토콜: HTTP/HTTPS일 가능성이 높음일반적인 RedLine 동작 기반. 목적: 탈취한 데이터자격 증명, 쿠키, 암호화폐 지갑의 C2 통신. 중요성: C2 인프라: 이 IP...

Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery

ClickFix , the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise. The...

Malicious code in serverless-convention (npm)

The serverless-convention npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...

Operation Triangulation: iOS devices targeted with previously unknown malware

While monitoring the network traffic of our own corporate Wi-Fi network dedicated for mobile devices using the Kaspersky Unified Monitoring and Analysis Platform KUMA, we noticed suspicious activity that originated from several iOS-based phones. Since it is impossible to inspect modern iOS device...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228 DFIR-Notes Driving home I got my first message...

Attackers exploit CVE-2021-26084 for XMRig crypto mining on affected Confluence servers

Vulnerability Overview On August 25, 2021 a security advisory was released for a vulnerability identified in Confluence Server titled “CVE-2021-26084: Atlassian Confluence OGNL Injection”. The vulnerability allows an unauthenticated attacker to perform remote command execution by taking advantage...

Akamai Enhances Enterprise Threat Protector to Add Secure Web Gateway Capabilities

Today, Akamai announced that it has added secure web gateway SWG capabilities to its Enterprise Threat Protector ETP service to help enterprises further accelerate their transformation to a Zero Trust security architecture. So what are the SWG enhancements and what benefits will these deliver for...

Inspecting TLS Web Traffic - Part 1

In this series of blogs I'm going to talk about how the continued move towards all web traffic being encrypted has impacted enterprise security. In this blog I'm going to focus on the basics - what is encrypted web traffic and how can you proactively control this. TLS encryption is the de-facto...

New Golang brute forcer discovered amid rise in e-commerce attacks

E-commerce websites continue to be targeted by online criminals looking to steal personal and payment information directly from unaware shoppers. Recently, attacks have been conducted via skimmer, which is a piece of code that is either directly injected into a hacked site or referenced externall...

The Challenges of DIY Botnet Detection – and How to Overcome Them

Botnets have been around for over two decades, and with the rise of the Internet of Things IoT they have spread further to devices no one imagined they would - printers, webcams, and even toasters and fridges. Some botnets enlist infected devices to mine cryptocurrency or steal passwords from oth...

Fake browser update seeks to compromise more MikroTik routers

This blog post was authored by @hasherezade and Jérôme Segura. MikroTik, a Latvian company that makes routers and ISP wireless systems, has been dealing with several vulnerabilities affecting its products' operating system over the past few months. Ever since a critical flaw in RouterOS was...

Accelerating Your Zero Trust Security Transformation with Enterprise Threat Protector

The basic concepts of zero trust security are relatively simple: trust nothing, verify everything, and maintain consistent controls. But, for CISOs and CIOs charged with transforming their legacy moats and castles architecture to one that allows their enterprises to embrace all of the benefits of...

Newly Observed Ursnif Variant Employs Malicious TLS Callback Technique to Achieve Process Injection

Introduction TLS Thread Local Storage callbacks are provided by the Windows operating system to support additional initialization and termination for per-thread data structures. As previously reported, malicious TLS callbacks, as an anti-analysis trick, have been observed for quite some time and...

Threat Outbreak Alert RuleID30818: Email Messages Distributing Malicious Software on October 4, 2017

Medium Alert ID: 55511 First Published: 2017 October 4 19:15 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID30818 may contain the following files: Name |...

SambaCry exploit analysis-exploit warning-the black bar safety net

“2017 5 May 24, Samba released a 4. 6. 4 version, in the middle fix a serious remote code execution vulnerability, the vulnerability number CVE-2017-7494, the vulnerability affects Samba 3.5.0 after to 4. 6. 4/4. 5. 10/4. 4. 14 in the middle of all versions. SambaCry vulnerability is a scale spre...

Doing things the NTP----CVE-2016-7434 vulnerability analysis-vulnerability warning-the black bar safety net

The NTP Protocol Analysis with CVE-2016-7434 About the client and the NTP server, the NTP Protocol interaction, the synchronous time of process I is no longer described in detail, with a pair of figure can be a brief description of the time synchronization process, in this process, the data take...

java reverse sequence tool ysoserial analysis-vulnerability warning-the black bar safety net

About java deserialization vulnerability the principles of analysis, basic are is in the analysis of the use of the Apache Commons Collections library, causing deserialization problems. However, downloading foreigner ysoserial tool and carefully look after, I found many worthy of learning the...

Local file inclusion vulnerability detection tools – Burp the domestic plug-in LFI scanner checks-vulnerability warning-the black bar safety net

LFI scanner checks to myself to burp the lightweight scanner to do a detect a LFI vulnerability plug-ins, because burp is not an effective detection of the LFI feature, only to write yourself a plugin. Look at the following screenshot: ! To compare the following J2EESCAN inside the included LFI...

MS Windows (RPC DCOM) Remote Buffer Overflow Exploit

No description provided by source. include stdio.h include winsock2.h include windows.h include process.h include string.h include winbase.h pragma commentlib,"ws232" unsigned char bindstr= 0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,...