vp (@veeeeep) header
vp (@veeeeep) profile picture

vp

@veeeeep
 FINLAND
Joined October 2010
  • Tweets950
  • Following416
  • Followers391
99Media
Photo by vp (@veeeeep)Photo by vp (@veeeeep)Photo by vp (@veeeeep)Photo by vp (@veeeeep)Photo by vp (@veeeeep)Photo by vp (@veeeeep)Photo by vp (@veeeeep)Photo by vp (@veeeeep)Photo by vp (@veeeeep)Photo by vp (@veeeeep)
Replying to @ossij
@ossij Moi! Kuluttaja-lehden tilaajana olen ollut oikein tyytyväinen monipuoliseen sisältöön, mutta nuo teidät nettisivut on todella hitaat laitteesta riippumatta. Saisikohan asialle tehtyä jotain? Ollut hitaat siitä lähtien, kun lehden tilasin eli muutaman kuukauden.
Image from vp (@veeeeep)
1
36
Estonian email provider mail.ee was exploited to target a small number of email accounts according to The Estonian Internal Security Service. Sounds like it was an XSS vulnerability that can be very powerful if wisely used. kapo.ee/sites/default/files/…
Image from vp (@veeeeep)
1
"Hallintomies" 👀
Vitali Kremez (@VK_Intel) profile pictureVitali Kremez@VK_Intel12 Oct 2019
Replying to @VK_Intel @malwrhunterteam
🤔It is kind of interesting how TB 'networkDll' collects domain controller information: "List of domains:"; dns_var = "dNSHostName"; "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" Checking for LDAP Admin in lang 🇬🇧🇫🇷🇮🇪🇮🇹🇭🇺🇸🇰🇨🇿🇮🇸🇱🇹🇫🇮🇸🇪🇪🇪🇪🇸🇹🇷
Image from Vitali Kremez (@VK_Intel)
Probably the first relevant post in Twitter when it comes to the POC of CVE-2019-0708.
mj0011 (@mj0011sec) profile picturemj0011@mj0011sec20 May 2019
CVE-2019-0708 remote scan tool by 360Vulcan team. Detect the recent RDP bug via RDP packet behavior, without trigger the final bug path(no BSOD or any side effect on the target system), ask for it to scan your network by sending mail to cert at 360.cn
Image from mj0011 (@mj0011sec)
Image from mj0011 (@mj0011sec)
1
Interesting #malware sample: "Цэргийн багийн 8 ээлж ашиглагдах утасны дугаарын жагсаалт.doc" (VT 5/59). With help of EQ editor exploit, it drops Word add-in "cls.wll" that is loaded next time Word is started. (1/2)
Image from vp (@veeeeep)
1
11
1
24
Signed file "IntelGraphicsController.exe" and malicious file "RasTls.dll" (cls.wll) are dropped, the latter DLL sideloaded. Persistance added under "CurrentVersion/Run", connects to "217.69.8[.]255". Doc hash: 853136f00e87a1ab3e2fc3acb309573e (2/2)
2
6
Painottaisin tätä, jos meinaat lähettää tiedostoja Virustotaliin: "Yhteisön jäsenet voivat myös ladata itselleen Virustotaliin lähetettyjä tiedostoja tutkiakseen niitä tarkemmin." Lataaminen tosin vaatii maksullisen käyttäjätilin, toisin kuin artikkeli antaa ymmärtää.
Helsingin Sanomat (@hsfi) profile pictureHelsingin Sanomat@hsfi17 Apr 2019
Epäilyttääkö tiedoston tai nettisivun avaaminen? Näin voit testata maksuttomalla ohjelmalla, sisältävätkö ne viruksia ja muita haittaohjelmia hs.fi/teknologia/art-2000006…
1
Replying to @EsaMakinen
@EsaMakinen Moi! Eroaako HS:n tilaajan ja ei-tilaajan näkemä mainostus mitenkään mobiilisovelluksessa? Esimerkiksi mainosten näyttötiheydessä tjms.
1
I was eager to report abuse to Leaseweb, but not anymore after seeing the terms. #leaseweb #abuse
Image from vp (@veeeeep)
1
Rahanpesun selvittelykeskuksen vuosikertomus 2018 poliisi.fi/instancedata/prim… #krp
Image from vp (@veeeeep)
"Exclusive_Pictures_destruction_of_Jaish_Camp_and_dead_bodies_of_terrorists.doc", created today. MD5: 41b70737fa8dda75d5e95c82699c2e9b Pings to 216.176.190[.]98:3386
Image from vp (@veeeeep)
1
1
Dropped EXE file: 2eb4469c76f5230c66626a6918c7664f
Hieman huolestuttavaa, että pankin työntekijän sähköpostiin on pääsy suoraan internetistä ja oletettavasti ilman kaksivaiheista tunnistautumista. is.fi/digitoday/tietoturva/a… #phishing #aktia
1
How safe and easy.
Image from vp (@veeeeep)
1
Interesting xls file (VT 3/57) - Loops over all shortcuts on the desktop. If Chrome, Firefox or IE is found, then add powershell code to the target path of the shortcut. - When the shortcut is clicked, the real application is started normally, powershell code is run and...
Image from vp (@veeeeep)
1
5
1
2
...the target path is restored back to normal. - if date is le 20181001, something is executed from 'http://82.1.4.102/HJAdKXY.xml'. The content isn't available anymore. 🧐
1
Joku sankari grepannut "poliisi" vuosia vanhasta hetudumpista ja laittanut laudalle. Helposti tuli mediahuomiota 🤦‍♂️
Marko Aho (@mt_aho) profile pictureMarko Aho@mt_aho21 Oct 2018
Poliisien yksityisiä tietoja päätyi runsaasti pimeään verkkoon – levittäjä uhkaa julkaista lisää ja pyytää lunnaita. #poliisi #henkilötiedot #tietovuoto #kiristys #darknet #Suomi #Finland aamulehti.fi/a/201263555?c=1…
1
Dassault Rafale fighter jet related lure doc "rafale_art.docx" (dfad7d4a7ecb2eed6d69abfbfb5f94c9) by #SideWinder #APT group.
Image from vp (@veeeeep)
6
11
Leetmx, campaign targeting Latin America, seems to be still active. File: Curriculum Vitae Actualizado Maria Elizabeth Hernandez Vasquez.doc MD5: 516498ff378128770b006b681943c00c Nicely obfuscated, downloads #remcos. Reuses the domains mentioned here: clearskysec.com/leetmx/
Image from vp (@veeeeep)
1
1
A couple of more samples from this month: 074c54b052c444159f3b345712a980680925edc9d6475812e2c5bebb61c28b16 8e57808957b37cf1cf6a946152608ef3cb2f37f2315a7e4827e742e09c180576
1
The article has interesting details how Maersk recovered from NotPetya attack. Worth to read.
WIRED (@WIRED) profile pictureWIRED
@WIRED22 Aug 2018
NEW ISSUE: On June 27, 2017, a piece of malware called NotPetya infected computers across the globe. It crippled ports, paralyzed corporations, and froze government agencies. This is the untold story of the most devastating cyberattack in history wired.trib.al/i8kUrFT
Oracle is taking these opt-outs to the next level. #GDPR
Image from vp (@veeeeep)
1
4
1
4
"Predict what's next after Singapore summit" #SANNY #APT File name: article.doc MD5: 468f0d5e987430384e4e8220df2e8584 Pretty much the same stuff for the initial infection that is seen in FireEye's blog post: fireeye.com/blog/threat-rese… ghostbin.com/paste/kv355
"The Truth about Tibet.doc" (e3613fcc307b306cef1391872e772e13), exploits Equalition Editor vulnerabilities (CVE-2017-11882 & CVE-2018-0802). Drops #winnti backdoor that is signed with an expired certificate. #apt
Image from vp (@veeeeep)
1
7
10

No more items