14 Followers
42 Following
7 Posts

Here are my notes on using a Python virtual environment with IDA Pro:

https://williballenthin.com/post/using-a-virtualenv-for-idapython/

#idapro

Using a virtualenv for IDAPython

Willi Ballenthin

A new version of #Latrodectus is out ๐Ÿ“ฃ๐Ÿ”ฅ

Version: 1.9
Campaign: Mimikast

The corresponding botnet C2s have been caught earlier today by @r0ny_123 ๐ŸŽฃ
๐Ÿ“กhttps://threatfox.abuse.ch/browse/malware/win.latrodectus/

The relevant malware sample is available on MalwareBazaar:
๐Ÿ“„ https://bazaar.abuse.ch/sample/762d06bfa27f703890e9eda2ba03189518c87c85826621126545cf4c78f4194c/

ThreatFox | Latrodectus

Indicators of compromise (IOCs) associated with Latrodectus (aka BLACKWIDOW / IceNova / Latrodectus / Lotus)

Revisiting 2 of the 5 docs from the Snowden leaks that mention 'cookies'.

GCHQ 2009 on 'target detection identifiers':
https://snowden.glendon.yorku.ca/items/show/188/

NSA 2011 on 'selector types':
https://snowden.glendon.yorku.ca/items/show/172

...featuring cookie/browser IDs from Google/Doubleclick, Facebook, Microsoft and many more.

It's breathtaking how the surveillance marketing industry has still managed to claim for many years that unique personal identifiers processed in the web browser are 'anonymous', and sometimes still does.

Target Detection Identifiers ยท Snowden Archive

Drafting an #idaplugin to add a few extra features to #ida

Customized IDA Exports screen to make it easier to find exports that are not just the single instruction `retn`

Check it out at: https://github.com/xorhex/IDAExtras

GitHub - xorhex/IDAExtras

Contribute to xorhex/IDAExtras development by creating an account on GitHub.

GitHub