Hatching (@hatching_io) header
Hatching (@hatching_io) profile picture

Hatching

@hatching_io

Cybersecurity specialists focused on malware sandboxing. Hatching Triage Unlimited, free, and state-of-the-art sandboxing at https://nitter.cf/t.co/Z0pc40OMYO

 The Netherlands
hatching.io/
Joined May 2018
  • Tweets785
  • Following55
  • Followers6.1K
308Media
Photo by Hatching (@hatching_io)Photo by Hatching (@hatching_io)Photo by Hatching (@hatching_io)Photo by Hatching (@hatching_io)Photo by Hatching (@hatching_io)Photo by Hatching (@hatching_io)Photo by Hatching (@hatching_io)Photo by Hatching (@hatching_io)Photo by Hatching (@hatching_io)Photo by Hatching (@hatching_io)
amazing training course🤩! also cool to see Triage here xD
Axelle Ap. @cryptax @mastodon.social (@cryptax) profile pictureAxelle Ap. @cryptax @mastodon.social@cryptax23 Jan 2024
Android Reverse Engineering training in less than a month at @_ringzer0 ! If you're interested, ask for a discount code ;) ringzer0.training/trainings/… What's in it? LIEF, Medusa, Java and Native Frida hooks, JEB scripts, lots of unpacking and de-obfuscation and more!
1
2
8
1,434
Inspired by @hasherezade's pe_unmapper, I published a small python tool to unmap PE memory dumps. I also added a quick check to handle @hatching_io's Triage memdumps. github.com/n1ght-w0lf/pe-unm…
GitHub - n1ght-w0lf/pe-unmapper: A small tool to unmap PE memory dumps.

GitHub - n1ght-w0lf/pe-unmapper: A small tool to unmap PE memory dumps.

A small tool to unmap PE memory dumps. Contribute to n1ght-w0lf/pe-unmapper development by creating an account on GitHub.

github.com
19
65
8,856
Thrilled with @RecordedFuture and @hatching_io joining forces. I want to emphasize that tria.ge, the free version of the Hatching Cloud Sandbox will continue to be freely available forever. Try out your malicious file samples at tria.ge. Enjoy!
22
1
77
Thrilled to announce that @RecordedFuture has acquired @hatching_io, the world's leading malware sandbox. Planning to massively extend the malware part of the Recorded Future Intelligence Cloud and @skier_t and his team are the masters! Welcome Hatching! recordedfuture.com/press-rel…

Recorded Future Acquires Hatching to Extend Intelligence Cloud Coverage with Malware Analysis |...

With Hatching, Recorded Future extends its intelligence coverage with high-performance malware analysis, giving clients better visibility into active malware campaigns in the wild, improved attribu...

recordedfuture.com
3
34
4
111
My first Android malware analysis at Hatching🥳 keep doing great Android malware analysis here Please send lots of Android malware to Triage, and let me know if anything could be better!
Hatching (@hatching_io) profile pictureHatching@hatching_io16 Jun 2022
It's Thursday, and that means new updates! The focus is on new families across Windows, Linux and Android this week but we've also made some tweaks for existing detections including #Emotet and #PandaStealer Check out our latest blogpost here: hatching.io/blog/tt-2022-06-…
Image from Hatching (@hatching_io)
2
8
37
We have submitted over 800,000 unique malware samples to @hatching_io. We are not even close to submitting everything.
Image from vx-underground (@vxunderground)
4
7
2
110
Hatching retweeted
ET Labs (@ET_Labs) profile picture
ET Labs@ET_Labs22 Apr 2022
Replying to @3xp0rtblog
Thanks for the share! It took way to long to get network traffic out of this sample, but finally got a good run with @hatching_io ❤️ Checkin happens via Discord. Got a rule for decrypted traffic coming out today. tria.ge/220422-r4x2wadaf8/
Image from ET Labs (@ET_Labs)
2
6
When #emotet submissions reach that magic number Thanks @hatching_io for churning it all! 💪
Image from Cryptolaemus (@Cryptolaemus1)
2
4
63
This #CobaltStrike C2 is using a @Cloudflare certificate for *.hmgo[.]pw. Sample hash: b5525108912ee8d5f1519f1b552723e8 Cert hash: f04a9dc5f3c173c1b83fc05cee2de6ba4c47fa2d tria.ge/220324-p4dl5adghn
Certificate used by Cobalt Strike C2 X.509 hash: f04a9dc5f3c173c1b83fc05cee2de6ba4c47fa2d C2 domain: *.hmgo[.]pw

ALT Certificate used by Cobalt Strike C2 X.509 hash: f04a9dc5f3c173c1b83fc05cee2de6ba4c47fa2d C2 domain: *.hmgo[.]pw

Certificate used by Cobalt Strike C2 X.509 hash: f04a9dc5f3c173c1b83fc05cee2de6ba4c47fa2d C2 domain: *.hmgo[.]pw

ALT Certificate used by Cobalt Strike C2 X.509 hash: f04a9dc5f3c173c1b83fc05cee2de6ba4c47fa2d C2 domain: *.hmgo[.]pw

CERT-UA (@_CERT_UA) profile pictureCERT-UA@_CERT_UA23 Mar 2022
Cyberattack on state organizations of Ukraine using the malicious program #CobaltStrike. Malicious activity is related to #UAC0051 #UNC1151 #GhostWriter You can learn more at the link: cert.gov.ua/article/38155
CERT-UA

CERT-UA

Урядова команда реагування на комп’ютерні надзвичайні події України, яка функціонує в складі Державної служби спеціального зв’язку та захисту інформації України.

cert.gov.ua
1
9
1
9
@hatching_io's sandbox is doing an excellent job with extracting the Cobalt Strike configs!
Image from 𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 (@netresec)
2
16
Wondering when these are going to get some hits. #remcos delivered via #Babadeda. ~2 months, 5 scans, 0 VT hits. C2 - 193.56.29[.]242 nice detection though @hatching_io tria.ge/220218-j5f6radbep #FUD
Image from Arnold Osipov (@osipov_ar)
Image from Arnold Osipov (@osipov_ar)
Image from Arnold Osipov (@osipov_ar)
2
11
18
Hatching retweeted
craig (@leabhart) profile picture
craig@leabhart5 Nov 2021
Replying to @s1lva_lucas
For the macros? I find @hatching_io Triage does a really great job of extracting the macros. If you have another tool for xlm4.0 macros I'd love to know what you use.
2
Year 3 on tria.ge started today ^^ thanks @hatching_io for the continuous improvements and all the new features! 🥳🥳🥳
1
19
Hatching retweeted
ZeroFox (@ZeroFox) profile picture
ZeroFox
@ZeroFox24 Sep 2021
FLASH REPORT: ZeroFox Threat Research has discovered a variant of ransomware called Colossus that affects machines running Microsoft Windows operating systems. Read on for more details plus recommendations for security teams. zerofox.com/blog/flash-repor…
9
9
Hatching retweeted
Finch (@finch_mw) profile picture
Finch@finch_mw14 Sep 2021
Replying to @hatching_io
Related: nitter.cf/Finch39487976/status/1… @Ledtech3
Finch (@finch_mw) profile pictureFinch@finch_mw3 Sep 2021
Replying to @finch_mw @Ledtech3 @James_inthe_box @pmelson
Hosts: dwdtte4wjfk8ds5[.]hopto[.]org,cch2dw3sdsmcs[.]hopto[.]org,dv7ddw4sds8ds8[.]hopto[.]org,dwdtte4wfjs0ds5[.]hopto[.]org,cch2dw8oisnxss[.]hopto[.]org,dv7lv4sds8ds5[.]hopto[.]org,gv7lv454sds8ds5[.]hopto[.]org Version: NonEuclidRat Black Port: 8848
1
3
Version 1.5-stable of my Java API client for @hatching_io's Triage sandbox has been published! It contains several breaking changes, new features, and improved documentation! You can read about it here: maxkersten.nl/2021/08/29/hat…
Image from Max 'Libra' Kersten (@Libranalysis)
1
1
Hatching retweeted
WP (@wepIV) profile picture
WP@wepIV24 Aug 2021
Replying to @chenxiwang @ReversingLabs @hatching_io
we break malware analysis (broadly) into 3 areas static analysis, dynamic analysis and reverse engineering. @hatching_io, @ReversingLabs and @virustotal all have the features you mention to varying degrees and that's what our enterprise clients use.
1
1
3
Replying to @hatching_io
Death is hereditary but preventing ModiLoader is easier with @hatching_io, thanks! #threatintel
1
2
Hatching retweeted
Jan Kopriva (@jk0pr) profile picture
Jan Kopriva@jk0pr4 Aug 2021
Since the online #malware #sandbox landscape has changed somewhat over the last six months, I have updated my list of most useful sandboxes to reflect these changes. One improvement that deserves a special mention was significant increase in no. supported OSs by @hatching_io...
Image from Jan Kopriva (@jk0pr)
2
34
1
85
BazarCall to Conti Ransomware via Trickbot and Cobalt Strike ➡️Initial Access: maldoc (#BazarCall) ➡️Discovery: AdFind, BloodHound, etc. ➡️Credential Access: ProcDump & Ntdsutil ➡️Lateral Movement: WMIC & SMB ➡️C2: #Trickbot & #CobaltStrike thedfirreport.com/2021/08/01…
Image from The DFIR Report (@TheDFIRReport)
Image from The DFIR Report (@TheDFIRReport)
Image from The DFIR Report (@TheDFIRReport)
Image from The DFIR Report (@TheDFIRReport)
4
108
8
209
Load more