#anyrun — Public Fediverse posts

GUI ценой приватности: разбор вредоносного форка Zapret 2 GUI

Из за замедления YouTube, Discord и других популярных сервисов в РФ спровоцировало настоящий бум инструментов для обхода DPI. Флагманский проект zapret от @bol-van - мощное решение, но его консольный интерфейс пугает рядового пользователя. На этой почве выросли десятки GUI-оболочек «для домохозяек».. Однако за красивым интерфейсом и обещанием «обхода в один клик» может скрываться нечто большее, чем просто прокси-клиент. В этой статье я разберу форк «Zapret 2 GUI» (автор censorliber), который набрал сотни звезд на GitHub, но при детальном анализе оказался полноценным инструментом для шпионажа и компрометации системы..

https://habr.com/ru/articles/1015380/

#zapret #обход_блокировок #dpi #malware #trojan #mitm #аудит_кода #ANYRUN #reverse_engineering

How to Avoid Phishing Incidents in 2026: A CISO Guide https://hackread.com/how-to-avoid-phishing-incidents-2026-ciso-guide/ #Cybersecurity #PhishingScam #Security #Phishing #Sandbox #ANYRUN #CISO #Scam

Fixing a Slow SOC: Top 3 Solutions that Actually Work https://hackread.com/fixing-soc-top-3-solutions-that-work/ #ThreatIntelligence #Cybersecurity #Security #ANYRUN #SOC

How to Achieve Ultra-Fast Response Time in Your SOC https://hackread.com/how-to-achieve-ultra-fast-soc-response-time/ #ThreatIntelligence #ThreatDetection #ThreatAnalysis #Cybersecurity #Security #ANYRUN #SOC

Top 3 Malware Families in Q4: How to Keep Your SOC Ready https://hackread.com/top-3-malware-families-in-q4-how-to-keep-your-soc-ready/ #ThreatIntelligence #Cybersecurity #Vulnerability #LummaStealer #AgentTesla #Security #Malware #ANYRUN #XWorm #SOC

Top 3 Malware Families in Q4: How to Keep Your SOC Ready https://hackread.com/top-3-malware-families-in-q4-how-to-keep-your-soc-ready/ #ThreatIntelligence #Cybersecurity #Vulnerability #LummaStealer #AgentTesla #Security #Malware #ANYRUN #XWorm #SOC

Introduction to Network Threat Detection with @suricata by Lukas Sismis at @openalt in Brno.

Perfect start of the conference day with analysis of #pcap from #anyrun and @malware_traffic

#weekend #education #networkforensics #BlueTeam

How Top SOCs Stay Up-to-Date on Current Threat Landscape https://hackread.com/how-top-socs-up-to-date-current-threat-landscape/ #ThreatIntelligence #Cybersecurity #Security #ANYRUN #SOC

How Live Threat Intelligence Cuts Cybersecurity Expenses https://hackread.com/how-live-threat-intelligence-cut-cybersecurity-expenses/ #ThreatIntelligence #Cybersecurity #Security #ANYRUN #SOC

How Live Threat Intelligence Cuts Cybersecurity Expenses – Source:hackread.com https://ciso2ciso.com/how-live-threat-intelligence-cuts-cybersecurity-expenses-sourcehackread-com/ #1CyberSecurityNewsPost #ThreatIntelligence #CyberSecurityNews #cybersecurity #Hackread #security #ANYRUN #SOC

How to Automate Phishing Detection to Prevent Data Theft – Source:hackread.com https://ciso2ciso.com/how-to-automate-phishing-detection-to-prevent-data-theft-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #PhishingDetection #cybersecurity #PhishingKit #Automation #Hackread #Phishing #security #ANYRUN

How to Automate Phishing Detection to Prevent Data Theft – Source:hackread.com https://ciso2ciso.com/how-to-automate-phishing-detection-to-prevent-data-theft-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #PhishingDetection #cybersecurity #PhishingKit #Automation #Hackread #Phishing #security #ANYRUN

How to Automate Phishing Detection to Prevent Data Theft – Source:hackread.com https://ciso2ciso.com/how-to-automate-phishing-detection-to-prevent-data-theft-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #PhishingDetection #cybersecurity #PhishingKit #Automation #Hackread #Phishing #security #ANYRUN

How to Automate Phishing Detection to Prevent Data Theft – Source:hackread.com https://ciso2ciso.com/how-to-automate-phishing-detection-to-prevent-data-theft-sourcehackread-com/ #1CyberSecurityNewsPost #CyberSecurityNews #PhishingDetection #cybersecurity #PhishingKit #Automation #Hackread #Phishing #security #ANYRUN

How to Automate Phishing Detection to Prevent Data Theft https://hackread.com/how-to-automate-phishing-detection-prevent-data-theft/ #PhishingDetection #Cybersecurity #PhishingKit #Automation #Security #Phishing #ANYRUN

How to Automate Phishing Detection to Prevent Data Theft https://hackread.com/how-to-automate-phishing-detection-prevent-data-theft/ #PhishingDetection #Cybersecurity #PhishingKit #Automation #Security #Phishing #ANYRUN

How to Automate Phishing Detection to Prevent Data Theft https://hackread.com/how-to-automate-phishing-detection-prevent-data-theft/ #PhishingDetection #Cybersecurity #PhishingKit #Automation #Security #Phishing #ANYRUN

How to Automate Phishing Detection to Prevent Data Theft https://hackread.com/how-to-automate-phishing-detection-prevent-data-theft/ #PhishingDetection #Cybersecurity #PhishingKit #Automation #Security #Phishing #ANYRUN

How Top SOCs Defend Against Emerging Threats with Live Attack Data https://hackread.com/how-top-socs-defend-threats-with-live-attack-data/ #ThreatIntelligence #Cybersecurity #Vulnerability #Security #Sandbox #ANYRUN #Data #SOC

How Top SOCs Defend Against Emerging Threats with Live Attack Data – Source:hackread.com https://ciso2ciso.com/how-top-socs-defend-against-emerging-threats-with-live-attack-data-sourcehackread-com/ #1CyberSecurityNewsPost #ThreatIntelligence #CyberSecurityNews #cybersecurity #Vulnerability #Hackread #security #Sandbox #ANYRUN #Data #SOC

Analysis of #Koske #miner.

It is an AI-generated #Linux #malware which was hidden in images with pandas. It supports wide variety of coinminers for various cryptocurrencies and for GPU and different CPU architectures. Its another component, #rootkit #hideproc, tries to hide the Koske miner from file listings and processes.

https://malwarelab.eu/posts/koske-panda-ai/

Video from #anyrun analysis:

https://www.youtube.com/watch?v=1OSPp996XQ4

#koskeminer #coinminer #blueteam #cybersecurity #dfir #malwareanalysis #infosec #reverseengineering

Analysis of #Koske #miner.

It is an AI-generated #Linux #malware which was hidden in images with pandas. It supports wide variety of coinminers for various cryptocurrencies and for GPU and different CPU architectures. Its another component, #rootkit #hideproc, tries to hide the Koske miner from file listings and processes.

https://malwarelab.eu/posts/koske-panda-ai/

Video from #anyrun analysis:

https://www.youtube.com/watch?v=1OSPp996XQ4

#koskeminer #coinminer #blueteam #cybersecurity #dfir #malwareanalysis #infosec #reverseengineering

Analysis of #Koske #miner.

It is an AI-generated #Linux #malware which was hidden in images with pandas. It supports wide variety of coinminers for various cryptocurrencies and for GPU and different CPU architectures. Its another component, #rootkit #hideproc, tries to hide the Koske miner from file listings and processes.

https://malwarelab.eu/posts/koske-panda-ai/

Video from #anyrun analysis:

https://www.youtube.com/watch?v=1OSPp996XQ4

#koskeminer #coinminer #blueteam #cybersecurity #dfir #malwareanalysis #infosec #reverseengineering

Analysis of #Koske #miner.

It is an AI-generated #Linux #malware which was hidden in images with pandas. It supports wide variety of coinminers for various cryptocurrencies and for GPU and different CPU architectures. Its another component, #rootkit #hideproc, tries to hide the Koske miner from file listings and processes.

https://malwarelab.eu/posts/koske-panda-ai/

Video from #anyrun analysis:

https://www.youtube.com/watch?v=1OSPp996XQ4

#koskeminer #coinminer #blueteam #cybersecurity #dfir #malwareanalysis #infosec #reverseengineering

Analysis of #Koske #miner.

It is an AI-generated #Linux #malware which was hidden in images with pandas. It supports wide variety of coinminers for various cryptocurrencies and for GPU and different CPU architectures. Its another component, #rootkit #hideproc, tries to hide the Koske miner from file listings and processes.

https://malwarelab.eu/posts/koske-panda-ai/

Video from #anyrun analysis:

https://www.youtube.com/watch?v=1OSPp996XQ4

#koskeminer #coinminer #blueteam #cybersecurity #dfir #malwareanalysis #infosec #reverseengineering

Остерегайтесь «песочных террористов»

Представьте: вы разработчик коммерческого ПО. В один прекрасный день пользователи начинают сообщать, что популярный блокировщик uBlock Origin не дает скачать ваш продукт. Никакой рекламы или сторонних баннеров в приложении нет и никогда не было. Невозможно? Вчера мы столкнулись именно с такой целенаправленной атакой на репутацию. Под катом — интриги, расследование, анатомия атаки и выводы, которые могут спасти и ваш проект. больше чернухи

https://habr.com/ru/articles/917702/

#anyrun #антивирус #spamhaus #динамический_анализ_кода #песочница #malware #malware_analysis #атака_на_репутацию #antivirus

Остерегайтесь «песочных террористов»

Представьте: вы разработчик коммерческого ПО. В один прекрасный день пользователи начинают сообщать, что популярный блокировщик uBlock Origin не дает скачать ваш продукт. Никакой рекламы или сторонних баннеров в приложении нет и никогда не было. Невозможно? Вчера мы столкнулись именно с такой целенаправленной атакой на репутацию. Под катом — интриги, расследование, анатомия атаки и выводы, которые могут спасти и ваш проект. больше чернухи

https://habr.com/ru/articles/917702/

#anyrun #антивирус #spamhaus #динамический_анализ_кода #песочница #malware #malware_analysis #атака_на_репутацию #antivirus

Остерегайтесь «песочных террористов»

Представьте: вы разработчик коммерческого ПО. В один прекрасный день пользователи начинают сообщать, что популярный блокировщик uBlock Origin не дает скачать ваш продукт. Никакой рекламы или сторонних баннеров в приложении нет и никогда не было. Невозможно? Вчера мы столкнулись именно с такой целенаправленной атакой на репутацию. Под катом — интриги, расследование, анатомия атаки и выводы, которые могут спасти и ваш проект. больше чернухи

https://habr.com/ru/articles/917702/

#anyrun #антивирус #spamhaus #динамический_анализ_кода #песочница #malware #malware_analysis #атака_на_репутацию #antivirus

Остерегайтесь «песочных террористов»

Представьте: вы разработчик коммерческого ПО. В один прекрасный день пользователи начинают сообщать, что популярный блокировщик uBlock Origin не дает скачать ваш продукт. Никакой рекламы или сторонних баннеров в приложении нет и никогда не было. Невозможно? Вчера мы столкнулись именно с такой целенаправленной атакой на репутацию. Под катом — интриги, расследование, анатомия атаки и выводы, которые могут спасти и ваш проект. больше чернухи

https://habr.com/ru/articles/917702/

#anyrun #антивирус #spamhaus #динамический_анализ_кода #песочница #malware #malware_analysis #атака_на_репутацию #antivirus

🔥 1,700+ confidential documents leaked due to a Microsoft Defender XDR error. Discover the risks of automated threat detection gone wrong.

#SecurityLand #BusinessShield #anyrun #microsoft #defender #xdr #dataleak

https://www.security.land/how-a-microsoft-defender-xdr-error-triggered-a-massive-data-leak/

ANY.RUN Malware Sandbox Provider’s Employee Email Compromised https://thecyberexpress.com/any-run-employee-email-phishing/ #TheCyberExpressNews #CybersecurityNews #CyberattackNews #EmailCompromise #TheCyberExpress #FirewallDaily #Cyberattack #Phishing #ANYRUN

ANY.RUN Malware Sandbox Provider’s Employee Email Compromised https://thecyberexpress.com/any-run-employee-email-phishing/ #TheCyberExpressNews #CybersecurityNews #CyberattackNews #EmailCompromise #TheCyberExpress #FirewallDaily #Cyberattack #Phishing #ANYRUN

ANY.RUN Malware Sandbox Provider’s Employee Email Compromised https://thecyberexpress.com/any-run-employee-email-phishing/ #TheCyberExpressNews #CybersecurityNews #CyberattackNews #EmailCompromise #TheCyberExpress #FirewallDaily #Cyberattack #Phishing #ANYRUN

ANY.RUN Malware Sandbox Provider’s Employee Email Compromised https://thecyberexpress.com/any-run-employee-email-phishing/ #TheCyberExpressNews #CybersecurityNews #CyberattackNews #EmailCompromise #TheCyberExpress #FirewallDaily #Cyberattack #Phishing #ANYRUN

Malware Analysis Guide https://ciso2ciso.com/malware-analysis-guide/ #0CTSOCCSIRTOperationsMalware&Ransomware #CISO2CISONotepadSeries2 #ANYRUN

Recent #stegocampaign delivering #XWorm RAT #malware samples.
Quick review of #sandbox analysis reports reveal simple, yet interesting infection chain. It contains #VisualBasic script, #PowerShell scripts, picture with Base64-encoded executable and the #xwormrat itself. Those payloads have been downloaded from online hosting services such as #Pastebin and #Firebase.

My new article with #IOC and analysis https://malwarelab.eu/posts/stego-xworm/

#steganography #Steganoanalysis #anyrun #malwareanalysis #obfuscation #cyberchef

LNK file with "Copy" command used as simple downloader for #Xworm #RAT and #AsyncRAT The source argument of copy command is the network location in this case, which effectively means that the remote BAT file is downloaded to the victim computer.

LNK files are often used for malicious purposes. For example, they can be the delivered as email attachments and can run malicious PowerShell commands. However, this one is demonstration of KISS principle - simple and stupid (or actually smart) usage of essential utility.

Ref: https://app.any.run/tasks/1cbca783-8323-474e-aa6a-ca655ed6637e/

#malware #malwareanalysis #lolbin #sandbox #AnyRun

Analysis of #infostealer #malware pretending to be a hack for #roblox anticheat.

This week I delivered one lecture about cyber attacks and three 45-minutes malware analysis workshops with #anyrun and #cyberchef for high school students in #Roznava, #Slovakia.

#Education #CyberSecurity #blueteam #dfir #sandbox

https://infosec.exchange/@securitydungeon/111914649805730340

#mlget has been updated. Grab the latest copy from: https://github.com/xorhex/mlget/releases

Features Added:
- Downloaded file is hashed and compared against the hash requested. Hopefully this will help detect when APIs change.
- #URLScanIO source added! Making this the 16th source queried!!

Bug Fixes:
- #Malpedia works again

Breaking Changes:
- If using #JoeSandbox, delete and recreate the config entries as the URL was updated to be inline with how the rest of the URLs are formatted (/v2 was moved from the code to the config)

Other Changes:
- Fix minor typos and remove #AnyRun reference from the help menu as that option is not available yet.

#malware