Malware dude, DFIR, Power-Response, former US Army cavalry scout, all thoughts and opinions are my own
Joined July 2018
- Tweets194
- Following138
- Followers83
- Likes94
Drew Schmitt retweeted
#ESXiArgs ransomware decompiled 🔦👀
github.com/CronUp/EnAnalisis…
🚨 Right now, at least 115 VMware ESXi servers (and counting) are compromised with this aggressive #Ransomware campaign. Beware!!! 👇
beta.shodan.io/search?query=…
/cc @ValeryMarchive @LawrenceAbrams @a_bermingham @JRoosen
Drew Schmitt retweeted
If you are looking for #IDA plugin/script list, @fr0gger_ has a great list 😊👍
github.com/fr0gger/awesome-i…
But here are some of my personal best I am using and I would like to recommend:
Drew Schmitt retweeted
"Malware development tricks. Download and inject logic. C++ example."
#infosec #pentest #redteam
cocomelonc.github.io/tutoria…
Drew Schmitt retweeted
"Shell Code Injector with AES Encryption - EDR Bypass"
#infosec #redteam #pentest
san3ncrypt3d.com/2022/03/24/…
Drew Schmitt retweeted
REvil ransomware group has ransomed Chinese electrical manufacturer Midea Group. Midea Group has an estimated annual revenue of ¥343,400,000,000 or approx. $49,000,000,000.
REvil is continuing its big game hunting.
Drew Schmitt retweeted
Leaked documents online show the purchase (and documentation of) an $8,000,000 iOS Remote Code Execution 0day exploit
Drew Schmitt retweeted
Lockbit ransomware group has put out a statement regarding the Entrust breach and subsequent DDoS attack they are (still) under. Lockbit states they are changing their operation practices to combat DDoS attacks
*Intel via @S0ufi4n3
*Image: Lockbit message translated into English
Drew Schmitt retweeted
Unpacked Bumblebee loader performing some anti analysis checks, this technique was copied from open source project called "al-khaser" :=)
Drew Schmitt retweeted
#systemBC #malware Targeting various #Mexico corp/enterprise network
#Mexico Victim List (1145) : pastebin.com/raw/DYx0fGqW
cc: @vxunderground @b3ard3dav3ng3r
Drew Schmitt retweeted
This is the source code to Thanos Ransomware Builder. It is password protected.
share.vx-underground.org/
Drew Schmitt retweeted
Lockbit has informed us that this is "normal behavior" and this report from @malvuln is the result of an incorrect password.
"[the] binary file can't decrypt without[sic] wrong password. It's not bug"
.@malvuln found an exploit in Lockbit 3 (Lockbit Black). Lockbit does not verify the length of the Execution Key - resulting in a Buffer Overflow.
Lockbit, are you going to pay out like your site says you will?
#lockbit #bugbounty
Details: malvuln.com/advisory/3874553…
Drew Schmitt retweeted
Destroying #Bitter #APT's #ZxxZ #Backdoor
✅ #Exploit+#Shellcode Analysis
✅ Building it's C2 Server to Execute a #Meterpreter Payload
✅ YARA/Suricata/Sigma
✅ #Ghidra Project
✅ #Malware Reverse Engineering
✅ Config Extraction
c3rb3ru5d3d53c.github.io/mal…
youtube.com/watch?v=m3jrWoQK…
ALT Overview of C2 behavior.
ALT Execution of payload.
ALT Gaining execution of our payload, with zxxz under our full control.
ALT Bitter APT ZxxZ backdoor configuration extraction utility.
Drew Schmitt retweeted
Lockbit Black 3.0 can yeet the Windows Defender and Event logs of it. Look at the Enabled key, it's set to 0 by Ransomware at the start.
@vxunderground @malwrhunterteam
Drew Schmitt retweeted
.@malvuln found an exploit in Lockbit 3 (Lockbit Black). Lockbit does not verify the length of the Execution Key - resulting in a Buffer Overflow.
Lockbit, are you going to pay out like your site says you will?
#lockbit #bugbounty
Details: malvuln.com/advisory/3874553…
Drew Schmitt retweeted
This obfuscator for Go binaries replaces values with exactly 8 byte long random chars, which we can use to create a YARA rule to detect that obfuscation 🥳
Drew Schmitt retweeted
Yanluowang ransomware groups claims to have ransomed Walmart - a United States-based multi-national grocery store with an est. annual revenue of $572,800,000,000.
*We are unable to confirm the legitimacy of these claims
*Information and photograph via @BrettCallow
