@krypt3ia I have this shirt in white on black. Gets lots of comments, but zero folks have actually recognized it yet. 😂
| https://twitter.com/pmelson | |
| GitHub | https://github.com/pmelson |
| Pronouns | He/Him |
Paul Melson
- 542 Followers
- 114 Following
- 154 Posts
Blue Team by day, Blue Team by night. Opinions, typos, and awful code do not represent my employer. Author/Operator of https://infosec.exchange/@ScumBots
@james_inthe_box Just using the name, or..?
Ugh, why does this work?! (I mean, I know how it works, but what was the thought process behind what’s essentially executing the stdout of a command? We’ve come so far and learned so little from our past mistakes.)
@SwiftOnSecurity Imma let you finish, but in 2014 Lazarus Group made the best ransom note of all time. Of all time!
RE: https://infosec.exchange/@ScumBots/115850383845467081
This Meterpreter reverse shell was part of an intrusion set tied to an actor claiming to be a KeyGroup777 member and this HiddenTear ransomware payload: https://www.virustotal.com/gui/file/62ecd3ec595452e7f01a9eeab6ae619f61648e5b6cb01c23c5ca2c03f59ec778/summary
@jernej__s @Ichinin I was unaware that ‘wget’ is an alias for IWR. What version(s) of PowerShell does that work for?
@jernej__s Also, despite the comments, it’s not dropping BTC miners
If you’re not alreadyalerting on
CONHOST.EXE spawning CMD.EXE spawning WGET.EXE
or
CONHOST.EXE spawning CONHOST.EXE spawning CONHOST.EXE
you’re gonna want to close that gap today.