269 Followers
139 Following
588 Posts

_security_researcher
_founder_ @barghest

{ disrupting APT, authoritarian gov, surveillance, privacy violations & corporate injustice }

Websitehttps://0x0v1.com
BARGHESThttps://Barghest.asia
Marc Andreessen, proving again that people with Zero Introspection, should have Zero Power.
Interesting technique. Obfuscates its string decoder inside android namespace "com .google .android .material .timepicker". That helper XOR-decodes which then concatenates into the C2: http://95.164.86[.]148/dash/index[.]php. #kimsuky
The Coruna loader performs environment validation including kernel build checks and CPU family gating using XNU CPUFAMILY constants (A15/A16 visible in snippet). So execution is restricted to specific Apple SoC generations. The sample I have appears to be a staged loader that validates the device environment before transferring control to a secondary payload. This architecture resembles similarity to Operation Triangulation (iVerify and Google referenced this already), though in OT hardware exploitation logic resides in later stages rather than the initial loader...

iVerify outsource blog post research such as https://iverify.io/blog/meet-cellik---a-new-android-rat-with-play-store-integration to a UK based cyber security content firm called https://www.cyberou.com.

In some examples, the owner of Cyberou is listed as a 'iVerify fellow'.

For me content is an extension of expertise and integrity; if you chose to outsource it, just builds less trust.

How does that work
instructSOCIETY | Malware digraphs & modelling // part 1

The visualization of malware has been a widely discussed topic over the years, though it hasn't garnered as much attention in the last decade. Nearly ten years ago, infosec experts like Chris Domas (TED talk linked below) highlighted the potential of malware visualization as a powerful tool for analysts to

[0x0v1]

Introducing instructSOCIETY

https://www.0x0v1.com/instructsociety/

I'm introducing the project and also issuing it with a two part tutorial.

Part 1: Malware digraphs & modelling https://www.0x0v1.com/instructsociety-visualizing-malware/

Part 2: Visual programming of malware tutorial & project files https://www.0x0v1.com/instructsociety-2/

Available now on my website.

#

APT37: ROKRAT ROKRAT, a sophisticated remote access trojan utilized by North Korean state-sponsored hackers, infiltrates systems through targeted spear-phishing attacks, enabling extensive surveillance capabilities including keylogging and data exfiltration. ROKRAT dramatically impacts the security and privacy of journalists, activists, defectors and NGOs in South Korea. North Korea uses ROKRAT malware

[0x0v1]

These models are created using ROKRAT malware

instructSOCIETY
https://www.0x0v1.com/instructsociety/

#

APT37: ROKRAT ROKRAT, a sophisticated remote access trojan utilized by North Korean state-sponsored hackers, infiltrates systems through targeted spear-phishing attacks, enabling extensive surveillance capabilities including keylogging and data exfiltration. ROKRAT dramatically impacts the security and privacy of journalists, activists, defectors and NGOs in South Korea. North Korea uses ROKRAT malware

[0x0v1]

Launching my new project instructSOCIETY: https://www.0x0v1.com/instructsociety/

This is an art project called instructSOCIETY which is an interactive digital experiment exploring visualization & artistic representations of malware that impact human rights.

It it's first iteration, I'm covering ROKRAT malware. A technological human rights issue developed by North Korean state-sponsored hackers.

#

APT37: ROKRAT ROKRAT, a sophisticated remote access trojan utilized by North Korean state-sponsored hackers, infiltrates systems through targeted spear-phishing attacks, enabling extensive surveillance capabilities including keylogging and data exfiltration. ROKRAT dramatically impacts the security and privacy of journalists, activists, defectors and NGOs in South Korea. North Korea uses ROKRAT malware

[0x0v1]