Pinned Tweet
Learn how to reverse engineer malware: training.invokere.com/course/imbt
YouTube: youtube.com/@InvokeReversi…
Twitch: twitch.tv/invokereversing
Mastodon: infosec.exchange/@invokereversi…
GitHub: github.com/invoke-re
YouTube: youtube.com/@InvokeReversi…
Twitch: twitch.tv/invokereversing
Mastodon: infosec.exchange/@invokereversi…
GitHub: github.com/invoke-re
1
10
40
9,564
Join us for a special Halloween Stream! We'll be reversing spooky scareware, join if you dare! twitch.tv/invokereversing
0
1
4
523
Join us on Friday October 30th for a halloween live stream at 1PM EST! We'll be reversing spooky scareware, come if you dare!
0
6
16
862
We've uploaded our live stream from October 16th where we analyzed a Rust loader that uses indirect syscall resolution, AES decryption, ETW patching and multiple unpacking steps to load and execute NWHStealer. Enjoy!
1
13
30
1,318
Come hang out for some Rust reversing in IDA. Potentially a new loader? 🕵️♂️ twitch.tv/InvokeReversing
0
0
14
774
We're also seeing fake "RDP OfficeX Manager" and "PLClean Master" as a part of the same campaign. IOCs (including 2FA apps):
052a2258a185f4c858326ff1a5754b2c4c2bf680c12ebf30a3c2b2b9c1af8f68
0bcf272d8f22fa30d327d7c0233b7eae7d50df1ebd95472aae59aef19c8e23bf
1b2432c99b877ac71a37d505ca7165f8d46cb4fc9a98762d54c529c7aef26d71
73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed
e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3
C2s:
get[.]calo44[.]net
ftp[.]mawar180[.]org
pub[.]futsalbandung[.]org
052a2258a185f4c858326ff1a5754b2c4c2bf680c12ebf30a3c2b2b9c1af8f68
0bcf272d8f22fa30d327d7c0233b7eae7d50df1ebd95472aae59aef19c8e23bf
1b2432c99b877ac71a37d505ca7165f8d46cb4fc9a98762d54c529c7aef26d71
73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed
e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3
C2s:
get[.]calo44[.]net
ftp[.]mawar180[.]org
pub[.]futsalbandung[.]org
Analysts @HuntressLabs have been seeing an uptick of malicious MFA apps from the Microsoft Store the last few days. In some cases, they're being delivered via tech support scams through Teams, in others via malvertizing.
We've been digging into it, and hopefully we'll have more info soon.
0
2
11
1,176
We've uploaded our live stream from late September where we explored Detection Engineering with Yara using Assemblyline, CAPEv2, bindiff and mquery. We go over packer detection, unpacked file detection and writing dependable rules that will outlast changes by the malware author oy!
1
10
51
1,215
Invoke RE retweeted
It was an honour to speak with Pablo on the debut episode of the Polo Cyber podcast. We spoke about my early beginnings, career, reverse engineering, malware analysis and Invoke RE. Hope you enjoy it!
New Polo Cyber YouTube channel is up! First video with @InvokeReversing founder and former colleague of mine @JershMagersh
youtu.be/g9MIGhR318k
0
3
11
414
Invoke RE retweeted
New Polo Cyber YouTube channel is up! First video with @InvokeReversing founder and former colleague of mine @JershMagersh
youtu.be/g9MIGhR318k
youtu.be/g9MIGhR318k
0
1
4
821
Check out these new testamonials from students completing the Advanced Malware Binary Triage course! 🤩
0
4
9
642
We are now seeing version 4.3.8-alpha2 of ACRStealer: 64773e9b66825e3e3d653b730f2994eac6635d8166707d076371bb2ff2f7f434
C2: sync[.]canyonmere[.]cc
Botnet: f1575b64-8492-4e8b-b102-4d26e8c70371
C2: sync[.]canyonmere[.]cc
Botnet: f1575b64-8492-4e8b-b102-4d26e8c70371
🦠ACRStealer remains under active development, with new versions appearing almost weekly. The latest variant by identified by ThreatLabz is 4.3.7-alpha2.
IOCS are listed below.
SHA256 hash:
769d06b54576c6beab2d33c7d4c05b679156c051652a843d6cc61de2cc9c58f9
CNCs:
https://stream[.]echovale[.]cc
https://145[.]249.109.147
DDR: https://telegra[.]ph/C-Introduction-08-21
1
7
18
1,674
Come hang out while we do some detection engineering with Yara! twitch.tv/InvokeReversing
1
3
10
980
Join us at 1PM EST today for a special Friday stream on detection engineering! twitch.tv/InvokeReversing
0
1
3
322
