Hacker of code Moved to Mastodon @rmceoin@infosec.exchange
California
Joined April 2009
- Tweets167
- Following237
- Followers76
- Likes1.8K
I've moved over to Mastodon and can now be found here infosec[.]exchange/@rmceoin (remove the [])
#TwitterMigration
1
311
Had to use the brackets since Twitter now blocks Mastodon links. So here's spacekaren.sucks/o3f22 which is a shortener for the same URL.
301
Anybody else seeing suspicious JS across these sites? They're connected in some way.
Came from a heavily obfuscated hxxps://tg.bookingbargains[.com/Sites/BookingBargains/Scripts/license.23.js
Figured it out. It's PopUnderJS. popunderjs.com/
These sites use this paid tool for popunders and the tool feels the need to obfuscate, no doubt to attempt to bypass adblockers.
bookingwiz.]com
smartfares.]com
cheapflightnow.]com
lowcostairlines.]com
travelation.]com
compareyourfare.]com
hotelwiz.]com
cheapfaresnow.]com
bookingbargains.]com
boletos.]com
jetupfront.]com
alltravel.]com
carwiz.]com
bookingbutler.]com
ptcong.]com
popunderjs.]com
Randy McEoin retweeted
Great (free!) resources for #SOC analysts of all experience levels:
Learn pcap analysis:
malware-traffic-analysis.net…
TA tactics:
cobaltstrike.com/training
Malware RE 101: malwareunicorn.org/workshops…
AWS CTF:
flaws.cloud/
SANs holiday hack challenges: sans.org/mlp/holiday-hack-ch…
Randy McEoin retweeted
Alright, folks, let's talk about Cobalt Strike!
mandiant.com/resources/defin…
(Sorry, red team pals. This one is for my defense buddies!) 🧵
Randy McEoin retweeted
Quick 🧵of some of the insights and actions we're sharing with our customers based on Q2 '21 incident data.
TL;DR:
- #BEC in O365 is a huge problem. MFA everywhere, disable legacy protocols.
- We’re 👀 more ransomware attacks. Reduce/control the self-install attack surface.
Malware analysis of a VBScript trojan loader that arrived via a phish.
rmceoin.github.io/malware-an…
Reversed a recent VBS Ursnif/Gozi malware that was sent via a phishing email.
rmceoin.github.io/malware-an…
@osipov_ar you might find this sample interesting. Found your analysis after I had already broken this one down.
1
1
Randy McEoin retweeted
Let's discuss the environmental cost of bitcoin. Because despite all the push for sustainable and green investment in the tech sector, there's a giant smoldering Chernobyl sitting at the heart of Silicon Valley which a lot of investors would prefer you remain quiet about. 🧵 (1/)
Wrote up how the standard Linux command umount was used to hide a setuid shell runner. #malware
rmceoin.github.io/malware-an…
1
Randy McEoin retweeted
When you've almost opened a malicious attachment, but a coworker pops in and says "hey, did you get executive-bonus.xls too? I opened it and my computer crashed!"
Took my first pass at documenting an Excel malware reverse engineering. This one leverages really old Excel 4.0 Macros to attempt to download and register a DLL.
rmceoin.github.io/malware-an…
