Cyber Arnaque

The reason many of you are seeing me discuss malware reverse engineering lately is because I've t...

alware, has been malware development. I love writing malware. However, the past couple of months-ish I felt kind of bored with malware development. I was just kind of burned out. From the recommendations of the people living inside my computer, I decided to shift to malware defense. If anyone remembers, I spent awhile studying the internals of YARA and built my own YARA scanner thingie. Anyway, it's been a lot of fun bonking malware with a stick. It's given me better perspective on what does, and what does not, work offensively. Thank you everyone for giving me malware you find in the wild. It is better to bonk random malware, versus malware already bonked, because there is no "cheat sheet" of someone else's research or notes. I'm going in completely blind and it's fun.

t.me26 juil.

In all seriousness seriousness, you should do this anyway whenever you accidentally malware your ...

ll your credentials, if you don't care then whatever, do your thing

t.me26 juil.

Bro, I got a DM from some dude who thinks he infected his computer with malware. He shows me the ...

ing about a few days ago (RevStealer). Hahahahahaha, he says, "should I be worried?" Fuck yes you should be worried, dawg. Your credentials, your cookies and sessions, your banking information, all of that shit is gone-gone, like, they are 100%, without a doubt in my soul, going to use your credentials for stuff. You need to orbital nuke all of your credentials like, yesterday, and kill all of your sessions on all applications. Anyway, I'm just being silly and trying to be funny, ... but in all seriousness this is a SERIOUS problem and you need to take action immediately. I'm sorry this happened to you.

t.me26 juil.

🍞BAKING 🍞 I had a ton of people ask me about the super cool and badass malware sample my belov...

What does it do? It's an Information Stealer, but it's super fancy 2. Does it have a name? Yes, as of like, last Tuesday (I have no idea when it was named, I'm just talking shit). It's officially called RevStealer by my peers. There is limited information it at the moment. 3. How long have you been bonking it? I invested about 4 hours over the time span of a few days, I think. I wish I had more free time for bonkings, but I don't 4. Can you share it? Yes, I am sharing it now. I'm pushing it to prod now. It's under /Samples/Families/RevStealer. I encourage you to bonk it too. It's really cool and fun to explore. I haven't had enough time to explore it and appreciate it, but I enjoyed it. 5. Can you share hashes? Initial .zip: 251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d Stage 1 (packer, stager): d23b9609b06ab23243543ee0d8ff0d4c1966530576fa37bb2ecde97309ebbc9e Stage 2 (in-memory payload): 724b400afcec2064a3477abd9a117103abfb51f7f7c8acd9c429fcdabd656ffc Decoy (maybe?): 851383fb22dcb1d16367839178271eef6504199b8ca60405e1698879696e49d4 6. Who is it attributed to? I have no idea. My colleagues have speculations, but nothing is solid yet. Pic unrelated (or maybe it is).

t.me25 juil.

Claude Agent Évasion, Chick-fil-A Breach, Notepad++ Malware

TLDR Data24 juil.

This super ultra mega rare fuck off ultra malware my colleague sent me has a really fancy schmanc...

ck, sifting through dummy and decoy data, I figured out how they evaded my VM, RecordedFuture Triage, AnyRun, and VirusTotal. They made a really fancy entropy thingie by collecting a bunch of data and doing fancy math. I respect it. https://gist.github.com/vxunderground/b8accc6e05d956889e0282e1926a6feb

t.me24 juil.

Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process

The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN.

> wake up > take a shit > get out of bed > remember colleagues hardcore malware thingie > downloa...

e of it is the same .exe > .exe has itself inside of itself > only small difference > cant tell difference > confusion_intensifies.mp5 > has anti-vm code > cant get to work in emulation > written using delphi > delphi tform GUI thingy > weird af de-compilation > 16,000 functions present > most do basic stuff, like add or subtract > staticly links a bunch of random libraries > LOLWTF WHO WROTE THIS > bonk with really big stick > eventually find some good goop > new .exe randomly appears in-memory > ??? > grab from memory > c++ .exe, staticly linked > 500 functions > heavily obfuscated > has anti-code tampering in place > ??? > this in-memory .exe references 1st .exe goop > ask colleague about goop > "We discovered this Threat Actor likely created their own custom .exe encryptor and decryptor" I've been bonking this…

t.me23 juil.

> check supposed hardcore malware thingie > regular .exe > looks normal > look inside > unusual P...

> small pieces scattered across .exe > dont understand some weird stuff seeing > completely evades all emulation attempts > successfully evaded every VM > evaded with no API calls > i dont know how or why > bonk with stick > written in delphi > compiled with weird ass compiler > decompilation weird lmfao wtf is this shit. this is fucking cool af wtf

t.me23 juil.

Overview of Chaos ransomware

Cisco Talos Incident Response (Talos IR) recently observed attacks by Chaos, a relatively new ransomware-as-a-service (RaaS) group conducting big-game hunting and double extortion attacks.

I keep having noobs message me and call me a hacker and ask about computer exploitation Dawg, I ...

h sticks. But, if you asked me to move laterally in a network it would take me 6000 hours. Likewise, I know nothing about web exploitation. I couldn't compromise a website if you gave me the username and password I'm just stinky malware man, I am not cool and badass hacker man.

t.me23 juil.

Had a lovely conversation with a Threat Actor from South America. It turns out, one of the malwa...

to me in private it was primarily written using ChatGPT. We had a cool conversation though, last week bro made about $54,000 from his various malware campaigns he spreads on Discord. He was not lying about his "income". Crimes does indeed pay. He also has a pretty nice computer setup. We also made small talk about how to illegally immigrate into the United States for as low as $400, problems with money-mules and credit card fraud, and his opinions on other South American countries (he doesn't like Colombia, he says they're not good people). Overall, bro was pretty chill, despite the large scale identify theft, extortion, money laundering, tax evasion and possibly illegal immigration he does.

t.me23 juil.

A colleague of mine notified me of actual super rare mega fuck off ultra malware identified in th...

lt to reverse engineer. He asked if I felt like trying to bonk it with a stick. Chat, can I bonk the sophisticated Threat Actor malware with a stick? This malware is believed to originate from a well-known and very active Threat Group, which has posed a significant threat to vendors and consumers, for quite some period of time. Their new malware strain is believed to be augmented by AI, hence improving their malware development lifecycle and introducing enhanced capabilities. I guess we'll find out later tonight, or tomorrow, when I get a chance to look at it. We'll review it and see if the hype is real, or if it's just malware goop.

t.me23 juil.

> get DM > "i think i found malware" > look inside > fake raonfit (???) website? > clickfix > goo...

present > ai slop > all in korean idk wtf is going on but this is janky af

t.me22 juil.

more verbose stuff https://malwaresourcecode.com/home/my-projects/malware-reversing-shorts/2026-...

t.me22 juil.

> get dm > "i got malwared, me stuff no good" > ok send > sends link > look inside > python scrip...

dot-py > ??? > look inside > drops stuff called "nig" > drops xmr miner > drops more python scripts > obfuscated with pyarmor (again) > bonk with stick > spits out more goop > over 10 files > all the files do p much the same stuff > ??? > use ai slop machine and tools to get original src > look inside > repetitive code > notes in code > debug print statements > sniff sniff > ai slop Chat, this is yet another Threat Actor using AI to slop up some malware. The only difference is this Threat Actor used professional level tools (although trial version) and put slightly more effort into the C2 and masquerading stuff. If you'd like to see the source code I've reconstructed (and slightly more verbose writing), see post below this one.

t.me22 juil.

Yesterday I was experimenting with using X articles for sharing malware bonkings. People wanted m...

nderstand, the X algorithm doesn't do much for highlighting articles. I was under the impression they wanted people to write articles. When I used their article thingie my engagement was through the floor. I don't understand how any of this works. Regardless, with X articles it isolates the homies on Telegram (they're probably all criminals, I don't know, Telegram nerds are schizos). Moving forward I'll probably just link to my goofy ass blog. It'll also make it easier for people to find it in the future (if they even care). I'm aiming to make them short, entertaining, and (hopefully) educational. Thank you to the people who continue to send me free malware. It is cool and badass.

t.me21 juil.

I'm pretty impressed. The past four malware goopies people sent me were partially AI slop. Despi...

noobs, imagine how much it's augmenting the actual skilled Threat Actors

t.me21 juil.