#malwareanalysis — Public Fediverse posts

🚀 OhMyPCAP 4.0.0 is HERE!

The ultimate FOSS PCAP analyzer just got a massive upgrade for deeper file intelligence.

New in v4.0:
• Upgraded to YARA Forge Full ruleset — more comprehensive malware & threat detection
• Exiftool + rich file metadata analysis — get more file information even if there are no YARA matches

All the power you love is still here:
Suricata alerts, file alerts, Sankey diagrams, full-text search, ASCII transcripts, hexdumps, stream carving + single Docker/Podman container (perfect for air-gapped or quick spins).

Ideal for malware analysis, incident response, threat hunting, forensics & teaching.

Who’s pulling this version right now? Drop a ❤️+ reply with your main use case (malware samples? CTFs? real-world incidents? teaching?)

#PCAP #DFIR #Cybersecurity #Infosec #BlueTeam #ThreatHunting #Suricata #YARA #MalwareAnalysis

@chrissanders88 @lennyzeltser

🚀 OhMyPCAP 4.0.0 is HERE!

The ultimate FOSS PCAP analyzer just got a massive upgrade for deeper file intelligence.

New in v4.0:
• Upgraded to YARA Forge Full ruleset — more comprehensive malware & threat detection
• Exiftool + rich file metadata analysis — get more file information even if there are no YARA matches

All the power you love is still here:
Suricata alerts, file alerts, Sankey diagrams, full-text search, ASCII transcripts, hexdumps, stream carving + single Docker/Podman container (perfect for air-gapped or quick spins).

Ideal for malware analysis, incident response, threat hunting, forensics & teaching.

Who’s pulling this version right now? Drop a ❤️+ reply with your main use case (malware samples? CTFs? real-world incidents? teaching?)

#PCAP #DFIR #Cybersecurity #Infosec #BlueTeam #ThreatHunting #Suricata #YARA #MalwareAnalysis

@chrissanders88 @lennyzeltser

🚀 OhMyPCAP 4.0.0 is HERE!

The ultimate FOSS PCAP analyzer just got a massive upgrade for deeper file intelligence.

New in v4.0:
• Upgraded to YARA Forge Full ruleset — more comprehensive malware & threat detection
• Exiftool + rich file metadata analysis — get more file information even if there are no YARA matches

All the power you love is still here:
Suricata alerts, file alerts, Sankey diagrams, full-text search, ASCII transcripts, hexdumps, stream carving + single Docker/Podman container (perfect for air-gapped or quick spins).

Ideal for malware analysis, incident response, threat hunting, forensics & teaching.

Who’s pulling this version right now? Drop a ❤️+ reply with your main use case (malware samples? CTFs? real-world incidents? teaching?)

#PCAP #DFIR #Cybersecurity #Infosec #BlueTeam #ThreatHunting #Suricata #YARA #MalwareAnalysis

@chrissanders88 @lennyzeltser

732 octets. C'est tout ce qu'il a fallu pour escalader jusqu'à root via une erreur de copie mémoire. Parfois les vulnérabilités les plus élégantes sont aussi les plus minuscules — un détail oublié, une hypothèse incorrecte, et soudain le chemin est grand ouvert. La surface d'attaque se cache vraiment partout. 🔬 #infosec #MalwareAnalysis #exploit
https://malware.news/t/hunting-copy-fail-732-bytes-to-root/106616

Un "Guest Diary" sur le danger de Libredtail — un outil qui, selon l'analyse, peut glisser vers des usages malveillants selon la configuration. 🧐

C'est fascinant comme certains outils vivent dans un espace ambigu : légitimes dans un contexte, problématiques dans un autre. La frontière est souvent dans l'intention... et dans les logs. 📋

#infosec #MalwareAnalysis #BlueTeam
https://malware.news/t/danger-of-libredtail-guest-diary-wed-apr-29th/106534

We're excited to announce that the Call for Trainers is now OPEN for DEF CON Training Middle East!

Are you passionate about cybersecurity, hacking, and hands-on learning? Do you have expertise in emerging threats, defensive strategies, or cutting-edge security techniques? We want to hear from you!

Visit training.defcon.org to submit your trainer application for a two-day or three-day course by May 9, 2026.
https://training.defcon.org/pages/2026-middle-east-call-for-trainers

#DEFCON #DEFCONTraining #Cybersecurity #Training #Hacking #InfoSec #SecurityCommunity #DEFCONMiddleEast #AI #RedTeam #BlueTeam #DigitalForensics #CyberTalent #MalwareAnalysis

We're excited to announce that the Call for Trainers is now OPEN for DEF CON Training Middle East!

Are you passionate about cybersecurity, hacking, and hands-on learning? Do you have expertise in emerging threats, defensive strategies, or cutting-edge security techniques? We want to hear from you!

Visit training.defcon.org to submit your trainer application for a two-day or three-day course by May 9, 2026.
https://training.defcon.org/pages/2026-middle-east-call-for-trainers

#DEFCON #DEFCONTraining #Cybersecurity #Training #Hacking #InfoSec #SecurityCommunity #DEFCONMiddleEast #AI #RedTeam #BlueTeam #DigitalForensics #CyberTalent #MalwareAnalysis

We're excited to announce that the Call for Trainers is now OPEN for DEF CON Training Middle East!

Are you passionate about cybersecurity, hacking, and hands-on learning? Do you have expertise in emerging threats, defensive strategies, or cutting-edge security techniques? We want to hear from you!

Visit training.defcon.org to submit your trainer application for a two-day or three-day course by May 9, 2026.
https://training.defcon.org/pages/2026-middle-east-call-for-trainers

#DEFCON #DEFCONTraining #Cybersecurity #Training #Hacking #InfoSec #SecurityCommunity #DEFCONMiddleEast #AI #RedTeam #BlueTeam #DigitalForensics #CyberTalent #MalwareAnalysis

We're excited to announce that the Call for Trainers is now OPEN for DEF CON Training Middle East!

Are you passionate about cybersecurity, hacking, and hands-on learning? Do you have expertise in emerging threats, defensive strategies, or cutting-edge security techniques? We want to hear from you!

Visit training.defcon.org to submit your trainer application for a two-day or three-day course by May 9, 2026.
https://training.defcon.org/pages/2026-middle-east-call-for-trainers

#DEFCON #DEFCONTraining #Cybersecurity #Training #Hacking #InfoSec #SecurityCommunity #DEFCONMiddleEast #AI #RedTeam #BlueTeam #DigitalForensics #CyberTalent #MalwareAnalysis

We're excited to announce that the Call for Trainers is now OPEN for DEF CON Training Middle East!

Are you passionate about cybersecurity, hacking, and hands-on learning? Do you have expertise in emerging threats, defensive strategies, or cutting-edge security techniques? We want to hear from you!

Visit training.defcon.org to submit your trainer application for a two-day or three-day course by May 9, 2026.
https://training.defcon.org/pages/2026-middle-east-call-for-trainers

#DEFCON #DEFCONTraining #Cybersecurity #Training #Hacking #InfoSec #SecurityCommunity #DEFCONMiddleEast #AI #RedTeam #BlueTeam #DigitalForensics #CyberTalent #MalwareAnalysis

🧠 Agent Tesla Daily Report

⬇️ Trend: declining (28%)
📊 17 new samples
🌐 0 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/agent-tesla/reports/2026-04-21

#CyberSecurity #MalwareAnalysis #SOC

🧠 Formbook Daily Report

⬇️ Trend: declining (40%)
📊 8 new samples
🌐 55 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/formbook/reports/2026-04-19

#CyberSecurity #MalwareAnalysis #SOC

🧠 Formbook Daily Report

⬇️ Trend: declining (40%)
📊 8 new samples
🌐 55 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/formbook/reports/2026-04-19

#CyberSecurity #MalwareAnalysis #SOC

🧠 Formbook Daily Report

⬇️ Trend: declining (30%)
📊 9 new samples
🌐 55 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/formbook/reports/2026-04-18

#CyberSecurity #MalwareAnalysis #SOC

🧠 Vidar Daily Report

⬆️ Trend: rising (47%)
📊 16 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/vidar/reports/2026-04-18

#CyberSecurity #MalwareAnalysis #SOC

🧠 Vidar Daily Report

⬆️ Trend: rising (47%)
📊 16 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/vidar/reports/2026-04-18

#CyberSecurity #MalwareAnalysis #SOC

🧠 Vidar Daily Report

⬆️ Trend: rising (75%)
📊 16 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/vidar/reports/2026-04-17

#CyberSecurity #MalwareAnalysis #SOC

🧠 Formbook Daily Report

⬆️ Trend: rising (161%)
📊 28 new samples
🌐 55 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/formbook/reports/2026-04-16

#CyberSecurity #MalwareAnalysis #SOC

🧠 Formbook Daily Report

⬆️ Trend: rising (229%)
📊 24 new samples
🌐 55 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/formbook/reports/2026-04-15

#CyberSecurity #MalwareAnalysis #SOC

🧠 Formbook Daily Report

⬆️ Trend: rising (229%)
📊 24 new samples
🌐 55 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/formbook/reports/2026-04-15

#CyberSecurity #MalwareAnalysis #SOC

----------------

🛠️ Tool
===================

Opening: Malhaus is a self‑hosted malware static triage platform that aggregates outputs from established static analysis tools and interprets them via user‑selected LLMs to produce a structured triage report. The project targets analysts who need fast, explainable static assessments without relying on behavioral execution.

Key Features:
• Aggregates outputs from radare2, YARA, strings, objdump, oletools, floss, binwalk, exiftool and optional Ghidra headless decompilation for PE/ELF.
• Supports multiple LLM backends including Gemini, OpenAI, Azure AI Foundry, Claude, DeepSeek and OpenAI‑compatible servers (Ollama, vLLM, LM Studio).
• Produces a structured verdict with a confidence score, key reasoning points and full raw tool outputs.
• Exposes a REST API with bearer token authentication and per‑key rate limiting; includes an MCP server allowing AI agents to call analyze natively.
• Implements mathematical visualizations: entropy profile, compression curves, a 256×256 bigram matrix and an experimental byte‑trigram point cloud clustered with HDBSCAN.
• Caches results by SHA‑256 to make re‑submissions instant.

Technical Implementation:
• Pipeline design ingests the uploaded file, runs a configurable suite of static analyzers, computes byte‑sequence visualizations, and passes aggregated evidence to an LLM prompt template that returns a JSON‑structured verdict.
• Visualization outputs (entropy, compression ratios, bigram heatmap, PCA‑reduced trigram point cloud) are treated as evidence rather than classifiers; the LLM synthesizes these signals into human‑readable conclusions.
• Security controls include captcha‑protected web UI and tokenized API access; caching minimizes repeated heavy analysis.

Use Cases:
• Rapid triage of suspicious samples to determine priority for dynamic analysis.
• Augmenting human analysts with LLM‑summarized rationale and full tool outputs for auditability.
• Bulk triage workflows where SHA‑256 caching reduces redundant processing.

Limitations:
• The byte‑trigram visualization is experimental and not a validated classifier.
• LLM outputs are dependent on prompt design and model choice; false positives/negatives remain possible.
• Static triage cannot replace behavioral analysis for runtime behaviors, C2 activity or evasive techniques.

🔹 tool #malhaus #malwareanalysis #LLM #entropy

🔗 Source: https://github.com/toorandom/malhaus?tab=readme-ov-file

Ok this is a wild malware.

https://www.gendigital.com/blog/insights/research/chasing-an-angry-spark

#cybersecurity #infosec #malware #MalwareAnalysis #AngrySpark

🧠 Formbook Daily Report

⬆️ Trend: rising (69%)
📊 13 new samples
🌐 55 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/formbook/reports/2026-04-14

#CyberSecurity #MalwareAnalysis #SOC

🧠 Formbook Daily Report

⬆️ Trend: rising (69%)
📊 13 new samples
🌐 55 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/formbook/reports/2026-04-14

#CyberSecurity #MalwareAnalysis #SOC

🧠 QuasarRAT Daily Report

➡️ Trend: stable (4%)
📊 4 new samples
🌐 0 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/quasar-rat/reports/2026-04-13

#CyberSecurity #MalwareAnalysis #SOC

🧠 QuasarRAT Daily Report

➡️ Trend: stable (4%)
📊 4 new samples
🌐 0 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/quasar-rat/reports/2026-04-13

#CyberSecurity #MalwareAnalysis #SOC

🧠 AsyncRAT Daily Report

⬇️ Trend: declining (36%)
📊 4 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/async-rat/reports/2026-04-12

#CyberSecurity #MalwareAnalysis #SOC

🧠 AsyncRAT Daily Report

⬇️ Trend: declining (36%)
📊 4 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/async-rat/reports/2026-04-12

#CyberSecurity #MalwareAnalysis #SOC

🧠 AsyncRAT Daily Report

➡️ Trend: stable (2%)
📊 6 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/async-rat/reports/2026-04-11

#CyberSecurity #MalwareAnalysis #SOC

🧠 AsyncRAT Daily Report

➡️ Trend: stable (2%)
📊 6 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/async-rat/reports/2026-04-11

#CyberSecurity #MalwareAnalysis #SOC

🧠 AsyncRAT Daily Report

⬆️ Trend: rising (289%)
📊 15 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/async-rat/reports/2026-04-10

#CyberSecurity #MalwareAnalysis #SOC

🧠 AsyncRAT Daily Report

⬆️ Trend: rising (289%)
📊 15 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/async-rat/reports/2026-04-10

#CyberSecurity #MalwareAnalysis #SOC

🧠 Agent Tesla Daily Report

⬇️ Trend: declining (21%)
📊 9 new samples
🌐 0 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/agent-tesla/reports/2026-04-08

#CyberSecurity #MalwareAnalysis #SOC

🧠 Agent Tesla Daily Report

⬇️ Trend: declining (21%)
📊 9 new samples
🌐 0 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/agent-tesla/reports/2026-04-08

#CyberSecurity #MalwareAnalysis #SOC

🧠 Formbook Daily Report

➡️ Trend: stable (9%)
📊 8 new samples
🌐 55 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/formbook/reports/2026-04-07

#CyberSecurity #MalwareAnalysis #SOC

🧠 AsyncRAT Daily Report

⬇️ Trend: declining (62%)
📊 3 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/async-rat/reports/2026-04-06

#CyberSecurity #MalwareAnalysis #SOC

----------------

🎯 Threat Intelligence
===================

Executive summary: A 2.7 MB x86_64 ELF sample (MD5: f1403192ad7a762c235d670e13b703c3) with near-maximum entropy was flagged as APT41-linked Winnti. Analysis shows a custom code virtualizer, three typosquat C2 domains resolving to 43.99.48.196 (Alibaba Cloud, Singapore), and a capability to harvest cloud instance metadata across major providers. The implant uses SMTP (port 25) as a covert command channel and refuses connections that do not present the expected implant handshake.

Technical details / IoCs:
• MD5: f1403192ad7a762c235d670e13b703c3
• C2 domains: ai.qianxing.co, ns1.a1iyun.top, ai.aliyuncs.help
• C2 IP: 43.99.48.196 (Alibaba Cloud, SG)
• Observed C2 ports: 25 (SMTP), 443, 8088 (server only responds to valid handshake)
• Notable infrastructure: a1iyun.top has a Let's Encrypt wildcard cert from Aug 2023

Analysis:

The binary's high entropy and inline transformations indicate a custom code virtualizer or instruction-level obfuscation that defeats standard static analysis. Intezer and other vendors link code reuse across six years of Winnti lineage (PWNLNX, RedXOR, AzazelFork, SprySOCKS, Melofee), indicating continued evolution rather than a one-off commodity trojan. The typosquatting strategy targets human triage processes: domains visually mimic Alibaba-related hostnames (a1iyun vs aliyun) and use ai. subdomains to exploit contemporary expectations of AI-related traffic.

The implant's use of the link-local cloud metadata endpoint (169.254.169.254) is operationally significant: it can retrieve temporary credentials, instance identity documents, managed identity tokens, and service account tokens from AWS, GCP, Azure, and Alibaba Cloud, enabling potential lateral movement and account takeover when permissions permit.

Detection considerations:

Observed artifacts suitable for detection include DNS queries for the listed typosquat domains, network connections to 43.99.48.196 that exhibit SMTP protocol exchanges without standard mail service responses, and processes attempting access to http://169.254.169.254 from unexpected workloads. The C2's refusal to respond to scans means detection should focus on endpoint telemetry and DNS/log analysis rather than relying on internet-wide scanning results.

Limitations & open questions:

Public analysis is constrained by heavy obfuscation; static indicators inside the binary are limited. The exact command encoding used over SMTP and the full set of post-exploitation modules were not fully disclosed in the source report.

🔹 APT41 #Winnti #cloud #malwareanalysis

🔗 Source: https://intel.breakglass.tech/post/apt41-winnti-elf-backdoor-cloud-credential-harvester-alibaba-typosquat

🧠 QuasarRAT Daily Report

⬇️ Trend: declining (46%)
📊 5 new samples
🌐 0 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/quasar-rat/reports/2026-04-04

#CyberSecurity #MalwareAnalysis #SOC

🧠 Agent Tesla Daily Report

⬇️ Trend: declining (54%)
📊 10 new samples
🌐 0 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/agent-tesla/reports/2026-04-04

#CyberSecurity #MalwareAnalysis #SOC

🧠 Vidar Daily Report

⬇️ Trend: declining (39%)
📊 19 new samples
🌐 100 C2 servers

Full analysis, IOCs, and hashes:
https://www.yazoul.net/malware/vidar/reports/2026-04-03

#CyberSecurity #MalwareAnalysis #SOC

Tried to book a bar. Ended up reverse engineering a malware campaign instead.

A fake "Cloudflare verify" page copied an obfuscated PowerShell loader to my clipboard. So I broke it down:

XOR-obfuscated script
Payload delivery
RedCap infostealer analysis
REMnux, Ghidra & Hybrid Analysis

Also watched the infrastructure get taken down mid-write-up.

First time doing any RE

https://blog.michaelrbparker.com/post/17

(Still haven't booked that drink.)

#CyberSecurity #MalwareAnalysis #ThreatAnalysis

Tried to book a bar. Ended up reverse engineering a malware campaign instead.

A fake "Cloudflare verify" page copied an obfuscated PowerShell loader to my clipboard. So I broke it down:

XOR-obfuscated script
Payload delivery
RedCap infostealer analysis
REMnux, Ghidra & Hybrid Analysis

Also watched the infrastructure get taken down mid-write-up.

First time doing any RE

https://blog.michaelrbparker.com/post/17

(Still haven't booked that drink.)

#CyberSecurity #MalwareAnalysis #ThreatAnalysis

Tried to book a bar. Ended up reverse engineering a malware campaign instead.

A fake "Cloudflare verify" page copied an obfuscated PowerShell loader to my clipboard. So I broke it down:

XOR-obfuscated script
Payload delivery
RedCap infostealer analysis
REMnux, Ghidra & Hybrid Analysis

Also watched the infrastructure get taken down mid-write-up.

First time doing any RE

https://blog.michaelrbparker.com/post/17

(Still haven't booked that drink.)

#CyberSecurity #MalwareAnalysis #ThreatAnalysis

🚀 Just released smali-lsp!

A Language Server for Smali with:
• Goto definition
• Cross-references
• Symbols & hover
• Works with any IDE (minimal setup)

Also includes an MCP server → plug into AI agents for faster APK analysis 🤖

🔗 https://github.com/Surendrajat/smali-lsp

#AndroidDev #ReverseEngineering #MalwareAnalysis #LSP #InfoSec #RE #security #dalvik

🚀 Just released smali-lsp!

A Language Server for Smali with:
• Goto definition
• Cross-references
• Symbols & hover
• Works with any IDE (minimal setup)

Also includes an MCP server → plug into AI agents for faster APK analysis 🤖

🔗 https://github.com/Surendrajat/smali-lsp

#AndroidDev #ReverseEngineering #MalwareAnalysis #LSP #InfoSec #RE #security #dalvik

🚀 Just released smali-lsp!

A Language Server for Smali with:
• Goto definition
• Cross-references
• Symbols & hover
• Works with any IDE (minimal setup)

Also includes an MCP server → plug into AI agents for faster APK analysis 🤖

🔗 https://github.com/Surendrajat/smali-lsp

#AndroidDev #ReverseEngineering #MalwareAnalysis #LSP #InfoSec #RE #security #dalvik