v0lundr @v0lundr_

Clicking on traffic lights, buses and fire hydrants in my spare time! Joined November 2015

Tweets

668
Followers

146
Following

898
Likes

4K

alden @birchb0y

3 weeks ago

reversing dprk malware 🇰🇵: hehe its all in this file! you're so welcome! have fun! 🥰 reversing cn malware 🇨🇳: actually go fuck yourself my malware has 2342749852984 files on disk and you def didn't collect all of them

6 38 571 24K 97

SttyK✨💉👩‍⚕️(ｽﾃｨｯｷｰ) @SttyK

3 weeks ago

Someone just dropped almost 1.4k email address list used by North Korean IT workers. gofile.io/d/mh6DUE

9 79 432 65K 269

LaurieWired @lauriewired

6 months ago

Just built an MCP for Ghidra. Now basically any LLM (Claude, Gemini, local...) can Reverse Engineer malware for you. With the right prompting, it automates a *ton* of tedious tasks. One-shot markups of entire binaries with just a click. Open source, on Github now.

84 804 5K 275K 3K

Download Video

Mohit Mishra @chessMan786

9 months ago

Advice From The Creator of C++

6 254 2K 78K 994

Download Video

0xmh1 @0xmh1

9 months ago

🇰🇵Catching DPRK with Korean Linguistic Traits🇰🇵 Recently I have been approached by a few people on how to identify and attribute malware to DPRK. Everyone of us in the CTI field knows how difficult attribution is, and while I cant provide you with something like: "Because the bad…

2 33 138 26K 103

Validin @ValidinLLC

a year ago

Hunting Lazarus: Expanding indicators with historic DNS and host responses in Validin to find 29 previously unreported domains likely associated with Lazarus Group. validin.com/blog/hunting-l…

1 22 83 6K 29

v0lundr @v0lundr_

a year ago

#chisel + #sliver combo someone? Sure !!! #opendir @ 139.162.7.28:8000

2 0 1 341 0

Download Image

v0lundr @v0lundr_

a year ago

#WaterHydra APT (a.k.a. #DarkCasino) hxxps://detentia.ro/guides/Scalping.pdf (.lnk) hxxp://185.236.228.85/webdav/ -> Fetches 7z.exe + b.cmd + leader[.]zip -> rundll32.exe lead.ocx (DarkMe Loader) SHA256: 0d63b8611ec1642053bf4dd52774736785f5086e195c4e4a450fef2db70bcb4c

0 0 1 330 0

Download Image

Germán Fernández @1ZRR4H

a year ago

🚩 #WaterHydra APT (aka DarkCasino) distributing #DarkMe malware targeting Trading/Finance/Crypto related people and platforms. Decoy website mediabluesky[.]com abuses Microsoft search/search-ms URI protocol to open a remote WebDAV server and initiate the infection chain via LNK…

3 11 19 4K 5

Download Image

vx-underground @vxunderground

a year ago

😭😭😭 which one of you nerds did this

32 945 9K 422K 607

Download Image

v0lundr @v0lundr_

2 years ago

#redline #stealer exploits CVE-2023-32046, and dropped from 77.105.132[.]118:80/file/adobe.exe. Lures: "pdf Scan creditcard and id.pdf.url" "identification card_bankcard.pdf.url" 095352afd4a0b05da86a2aadf53a94fa7f90834e25846dc3bf54108a34d72d0e

0 0 1 474 0

v0lundr @v0lundr_

2 years ago

#opendir on opuspac[.]com exploiting CVE-2023-38831 and dropping PS script from drive.google.com with a nice Serbian/Croatian set of an alias "ubijtaskoveidodajeksluzne" for the Invoke-Expression (Translation: Kill Tasks and add exclusions) xD

0 0 1 415 0

Download Image

v0lundr @v0lundr_

2 years ago

89.23.96[.]110:80/file/pdf.exe dropping #Redline #Stealer and exfils to 91.215.85.23

0 0 0 337 0

Download Image

Matthew @embee_research

3 years ago

Setting up an analysis VM for reverse engineering? Here are a few good tools (with short demos) that I recommend after running the Mandiant/FLARE script, (which installs 99% of tooling for you) 🔥 TLDR: Garbageman, SpeakEasy, BlobRunner, Dumpulator #Malware #RE #Analysis

4 200 656 79K 413

Matthew @embee_research

3 years ago

Quick trick to analyse #obfuscated .NET #malware. Assembly name -> right click -> go to entry point. Set a breakpoint, then step over/into functions and watch values appear in the local window. You'll quickly obtain plaintext values without de-obfuscating any code.

5 79 286 0 81

Download Image

v0lundr @v0lundr_

2 years ago

#AveMaria #Warzone #RAT on http://petme[.]ru/wordpress/wp-content/plugins/5702bb78a76e4f08934e49f148b5d211/xt/mmd/shell/macbeige2.1.exe C2: innomac.duckdns[.]org:5122