Sabitlenmiş Tweet
Karan
5.1K posts

Karan
@0xDISREL
CTI Analyst & Malware Researcher | Staff at @vxunderground | PTC
Canada Katılım Ağustos 2020
668 Takip Edilen2.9K Takipçiler

@NotNordgaren @dodo_sec No longer ship with the OS iirc. Idea was 2027.
Not sure why this page is 403 rn.
web.archive.org/web/2025112315…
English

@NotNordgaren @dodo_sec I think yes, vbscript.dll, RIP an era tho it’s getting phased out by MSFT soon
English

@dodo_sec @NotNordgaren VBScript is arguably even more annoying than VBA DEADASS
Betting 5 dollars you will be expert at navigating MSDN by the end of your payload 🫡
English

@NotNordgaren Pinging @0xDISREL for his experience with ungodly VBA shit
English
Karan retweetledi

When Joe Burrow injured his wrist in 2023, Chiefs fans rallied together to donate money to both his foundation and his hunger relief, using $9 donations.
With Patrick Mahomes now having to battle through an injury as well, I think #Bengals fans should look to donate to his own foundation, 15 and the Mahomies. Here’s the link: 15andthemahomies.org/donate/
Get well soon, Pat!

English
Karan retweetledi
Karan retweetledi

IT'S TIME TO #PROBOWLVOTE
1️⃣ RT = 1️⃣ VOTE
#ProBowlVote + Ja'Marr Chase
#ProBowlVote + Joe Burrow
#ProBowlVote + Evan McPherson
#ProBowlVote + Tee Higgins
#ProBowlVote + Chase Brown
#ProBowlVote + Ryan Rekhow
#ProBowlVote + DJ Turner II

English
Karan retweetledi

If you want to learn more about malware the easiest method is learning malware TTPs (Threats Tactics and Procedures). Basically, understand some of the techniques employed by malware authors to do stuff
Some malware techniques are simple and old
Some malware techniques are incredibly sophisticated
What you'll notice though with malware TTPs is each TTP is a "stepping stone". For example, the most advanced evasion techniques often stem from the most basic of evasion techniques.
Research and improvements on malware don't come from nowhere. Each technique comes from standing (metaphorically) on the work of others.
Malware TTPs are broken down kind of subjectively. They're hard to categorize. MITRE is the industry standard for malware TTPs, but even then there is some debate on the effectiveness of it.
By effectiveness I mean, if you have a simple malware technique that is slightly modified, is it the same malware technique? Is it a whole new category? How many "modifications" until it has its own entry? It's just debating classification.
For Windows malware however malware is defined as something along the lines of:
1. How was it delivered to the machine?
2. How many "chains" or "stages" or "redirects" were performed until the payload was detonated?
3. How was the payload detonated?
4. Is the payload persistent?
5. What was the objective of the malware?
On missiles and stuff, the part that explodes is the payload. It is the same concept with malware. The actual malicious code that does the malicious stuff is the payload.
With chains, or redirects, or stages, ... modern malware is often not as simple as someone double clicking a .exe the payload detonates. While this is true for common malware, more sophisticated malware will often jump through a series of hoops until the actual payload is detonated.
For example, more sophisticated malware may send a malicious email attachment that is a .Lnk file (shortcut file). When the user double clicks the .Lnk file the .Lnk file may download a .zip file. The . Lnk file will extract the .zip which will contain a malicious .JS file. The .Lnk file will execute the .JS file.
The .JS file will delete the .Lnk and .zip. The .JS file with then generate a .PS1 script and execute it. The .PS1 file will delete the .JS file and download a .exe file. The .exe file then will download a .dll file. The .DLL is the payload.
1. Lnk downloads .zip
2. Lnk extracts zip
3. Lnk runs .JS
4. JS deletes .Lnk
5. JS deletes .zip
6. JS makes .ps1
7. ps1 downloads .exe
8. ps1 deletes .JS
9. .exe downloads .DLL
10. .exe runs .DLL payload
The reason malware does this is because it makes it difficult for anti virus software to identify the final payload. Researchers will need to reconstruct the series of events which lead to the payload delivery. Additionally, malware authors may modify the chaining at any given moment to make detection much more difficult.
Okay, that's enough schizo ranting for now.

English
Karan retweetledi
Karan retweetledi

Gay ass take, gay ass soft team. Never thought i would be pro steelers yet here we are
ZIM@zimwhodey
Worse than Burfict’s graze shoulder on AB.
English
Karan retweetledi

@ZooL_Smith Valve doesn’t have the R&D like Apple, and they would need to build a translation layer like Rosetta to actually make it viable + make PC games compatible.
Once they capitalize on the market they could debate moving and forcing game dev industry to develop ARM native.
English












