@malware_owl
Account based inSingapore
About this account
- Account based in
- Singapore
- Connected via
- Singapore App Store
Account-level information from X, not a live location or the device used for a specific post.
Entered the world of Malware (◎▼◎) since Aug '22. Opinions expressed are my own and not those of my employer. Security Researcher @ Kaspersky GReAT
Joined September 2022
- Tweets387
- Following341
- Followers1.2K
- Likes497
Pinned Tweet
YaraXGUI Improvements
HexEditor, Yara Match Table to show all matches found. It supports more tab, yara formatting fixed as well. We can browse for rules and filter files that we want to scan this time. Hex editor is added with the goal to make it more hassle free.
Within the hexeditor, we can also apply changes, do basic diffing, mark multiple regions and send to YARA editor. Also included a way to select multiple regions and gaps within each regions can be set a wildcard so we do not need to calculate each size.
Can now do disassembly of selected region (capstone), draw basic CFG to do quick checks (maybe for certain obfuscation technique or unique code blocks). Simple parsing for PE and ELF file.
Added a wonky and (not-so-reliable) autocomplete (NOT based off parser) but good enough I guess for my workflow).
To try the new version: github.com/Owl4444/YaraXGUI/…
Day 2 of #bluehatasia @MSFTBlueHat has ended. Equally informative and inspiring. Seeing the thought process of these stacked researchers was sensational, leaving me a target to set for myself, even in this AI period. Seeing from start to end of copilot privesc in the presentation got me the goosebumps it so deserved.
@rm_rf_chumy’s research on SharePoint reinforces the point that reading of others peoples past research can prove to be useful, also the most meme loaded presentation with humour made it just as engaging XD. Meeting with Seung Chan and listening to his stories and background as well gives me new found motivations for sure!
Splendid day :]. Thankful for this opportunity and @61ack1ynx for approving!
Day 1 #BlueHatAsia 2026 has ended. @MSFTBlueHat has really high quality talks, and no, I dont think i will ever look at XSS bugs the same way anymore T.T Its really interesting because of the joint presentation between MVR and MSRC representative to show the bug + the side of the triagers.
Also thanks to @spaceraccoonsec ‘s super entertaining bug which I and @ultimat3hg can definitely relate too!
Also, reconnected with others including the GOAT @scwuaptx which we met some time back in Korea :D
Talking to MSRC personnels definitely changed my perspective on triaging, and they were super helpful in resolving some issues. Looking forward to Day 2!
This has got to be the best read of the week for me :0 Its long but I was hooked till the end. Amazing piece of article starting from an infection in the authors host to uncovering intent and opportunity of the operator(s) :0
好久没有发文章啦，今天想分享的文章，实在是有些尴尬，我上个月遭遇了一次入侵。当然，我反击了回去，过程中揭露了一个潜在的新兴信息窃取组织，画像了他们的运营与行为模式，并揪出了一个与该组织有关联的美国居民。文章：winslow1984.com/books/threat…
malware Owl retweeted
Super excited to see WESP land in public preview. I spent the past couple of days reverse engineering wesp.sys and espclient.dll, along with building a consumer POC.
Here is a writeup on my initial analysis: jonny-jhnson.dev/blog/a-firs…
GitHub POC: github.com/jonny-jhnson/Wesp…
malware Owl retweeted
had a quick look at this. The userspace counterpart is espclient.dll. Kernel hot path is rust-heavy (own arc/nt_types, hashbrown, a BDD rule engine plus a string trie) sitting on a fltmgr minifilter with ps/ob/cm callbacks, and it also ties into ELAM and the AM/MpPreCreate path. The driver is not monitoring-only: clients register rules/filters, and the pre-op result maps to FLT_PREOP_COMPLETE/PENDING/DISALLOW_* (the DISALLOW_* ones via the AM/Mp path) and can even rewrite desired access. Notifications themselves are async as expected. Key caller verification is done through WESP://Permission token security attribute off the calling process's primary token at connect, and full-trust callers must be PPL+AM signed. There are also per-message capability checks. Anyways, lot of things to unpack here, really interesting stuff.
malware Owl retweeted
Time to share the detail write-up, I would love to share it. Enjoy yourself!
Link write-up: hackmd.io/@nhh/Hy6Oem7_Me
malware Owl retweeted
Been a long time since I made a post. I updated KasperskyHook because a friend of mine asked me about its state, so I felt like sharing here as well: github.com/iPower/KasperskyH…
Also: cool things coming soon heh
malware Owl retweeted
Year after year, @TheSAScon continues to be one of the best conferences I've attended! If you've been thinking about submitting your research, now's the perfect time - the CFP is still open.
This is the bug:
wiz.io/blog/github-rce-vulne…
malware Owl retweeted
A new module in the sophisticated cyberespionage framework, Project CAV3RN, is hiding C2 commands inside Outlook calendar events scheduled for 2050 via Microsoft Graph. Details: kas.pr/v9r9
malware Owl retweeted
WinFsp CVE-2026-7162 got released a few days ago :)
i'll be holding out for a few more days for my blog post
@malware_owl and i are still cooking...
kind of a funny story that led to this
@malware_owl and i cooked up a little something...
malware Owl retweeted
Woah!
- Step 1: Blind the EDR agent
- Step 2: Use Heavener to see what detections are firing
- Step 3: Profit?!!
Prediction: EDRs will have to stop shipping early indicators with the local agent soon😂
web.archive.org/web/20260627…
malware Owl retweeted
Our latest analysis of The Gentlemen RaaS operation uncovered a Go-based backdoor with command execution and pivoting capabilities, a Windows-specific C-based ransomware implant still under development, multiple defense evasion techniques — including BYOVD — and several additional TTPs.
Learn more: securelist.com/the-gentlemen…
malware Owl retweeted
Hello, this is Hackyboiz!
Following up on our Wipeload project announcement since returning to this account, Step 2 is finally live!
This post covers the V8 Heap Sandbox introduced in Chrome 123, along with two distinct bypass methods.
Feel free to check out the full breakdown on our blog! 👇
hackyboiz.github.io/2026/06/…
#Hackyboiz #BrowserExploit #Chrome
malware Owl retweeted
i love this exploit! universal SELinux bypass still works to this day. I released it for Qualcomm based processors and just realized I never released the Exynos version so here it is unprivated: github.com/chompie1337/s8_20…
"Android kernel exploitation bypassing DAC, SELinux, and Knox" - I don't see this? @chompie writes that io_uring exploits could be potentially used for SELinux bypass, is that what you mean?
malware Owl retweeted
kind of a funny story that led to this
@malware_owl and i cooked up a little something...
Last week @ultimat3hg and I decided to try looking for bugs with the help of Prof. Claude and we did find a little something. Reported it and waiting :D