Alex @cryptogramfan

Joined May 2019

Tweets

43
Followers

298
Following

543
Likes

98

HP Wolf Security @hpsecurity

4 years ago

We’ve just published YARA rules and Python scripts to our GitHub that detects and extracts #IcedID and #BazaLoader malware from Excel add-in (#XLL) files.

2 19 46 0 9

View Details

New #PurpleFox EK campaign spotted in the wild. An IE Exploit was hosted on this domain: hxxps://feneffecsdoteteat.aixgedbubirtsabkhotsswse[.]shop C2 (registered on 25/07/2021): hxxps://8ze[.]me/u.php?id=1

0 13 27 0 1

View Details

HP Wolf Security @hpsecurity

5 years ago

We’re super excited to share our research into #opendir malware hunting and announce a new framework at #VBLOCALHOST @virusbtn this October! Hope to see many of you there.

0 5 12 0 1

View Details

HP Wolf Security @hpsecurity

5 years ago

#PurpleFox EK now exploits CVE-2021-26411, demonstrating a short PoC-to-ITW time. On 12 April we isolated a sample from a HP Sure Click Enterprise customer in the Middle East. More details in our write-up by @stoerchl on the HP Threat Research blog. threatresearch.ext.hp.com/purple-fox-exp…

0 20 30 0 2

View Details

HP Wolf Security @hpsecurity

5 years ago

We saw high volumes of #Dridex malspam last week, showing up as three groups when clustering samples by filename similarity.

0 5 14 0 0

View Details

Virus Bulletin @virusbtn

5 years ago

Bromium's Patrick Schläpfer explains how to extract payload URLs from Dridex samples and provides a python script to do that threatresearch.ext.hp.com/dridex-malicio…

0 10 18 0 3

View Details

HP Wolf Security @hpsecurity

6 years ago

We're pleased to share the HP-Bromium Threat Insights Report for July 2020. Highlights include a look at the top document malware file types and office exploits we've seen in 2020 so far, and insights into recent #Aggah, #QakBot and #WannaMine campaigns. threatresearch.ext.hp.com/hp-bromium-thr…

0 2 4 0 1

View Details

Alex @cryptogramfan

6 years ago

Here's my write-up on changes to the #Aggah malspam campaign which looks at their mail infrastructure, lures, targets, PowerPoint Add-In dropper and Bitcoin stealer.

HP Wolf Security @hpsecurity

6 years ago

In May, the attackers behind the #Aggah malicious spam campaign impersonated B2B companies in Europe, the Middle East and Asia to compromise businesses. They also adopted a PowerPoint dropper and cryptocurrency stealer. threatresearch.ext.hp.com/aggah-campaign…

1 3 5 0 1

0 4 11 0 3

View Details

BSides Bristol @bsidesbristol

6 years ago

At present we still intend to run the event at the end of July. We are monitoring the situation and will make a final call over the coming month.

0 7 10 0 0

View Details

Alex @cryptogramfan

6 years ago

A closer visualisation of the #Nemty campaign that targeted APAC organisations in February 2020.

0 1 2 0 1

View Details

Alex @cryptogramfan

6 years ago

I've been seeing a lot of #Nemty malspam activity lately.

0 0 4 0 1

View Details

BSides Bristol @bsidesbristol

6 years ago

SPONSORS. We need your support. See our Sponsor Information Pack and levels available on our website. bsidesbristol.org.uk/sponsorship/ Let's make this happen!

0 10 7 0 1

View Details

OWASP Cambridge UK @OwaspCambs

6 years ago

Extremely informative overview of reverse engineering of “Ransomware as a Service” #Buran by @cryptogramfan @bromium for Joint @BcsForensics @owasp @owaspCambs @ARUCyberRes “Aspects Of Digital Forensics” Workshop @AngliaRuskin @aru_fse #cambridge on Wednesday 19th Feb

0 7 10 0 0

View Details

Alex @cryptogramfan

6 years ago

The CfP for #bsidesbristol is officially open. This year we're accepting shorter talks (20 mins) as well as regular presentations (45 mins, including Q&A). If it's your first time presenting, we also have friendly mentors on hand to give advice and feedback.

BSides Bristol @bsidesbristol

6 years ago

Save the date... 29th and 30th July 2020 BSides Bristol is back! And our Call for Presentations is now open - get submitting! bsidesbristol.org.uk/call-for-prese…

3 19 42 0 1

0 4 6 0 0

View Details

Alex @cryptogramfan

6 years ago

Direct link to script: github.com/cryptogramfan/…

0 1 7 0 1

View Details

Alex @cryptogramfan

6 years ago

Here's my write-up on how to use perceptual hash algorithms to track malware campaigns that use visually similar maldocs (e.g. #Emotet, #QakBot, #Ursnif). Also released graph_similar_document_images.py that will graph out visually similar maldocs. bromium.com/spot-the-diffe…

2 43 96 0 9

View Details

Alex @cryptogramfan

6 years ago

#Emotet malspam activity resumed on 13 January 2020. This festive period its actors took a 21 day break, compared with 23 days in 2018/19. cc @Cryptolaemus1 @abuse_ch

0 2 4 0 1

View Details

Alex @cryptogramfan

7 years ago

If you're interested in malware analysis & RE, I highly recommend the #Zero2Hero course by @VK_Intel and @0verfl0w_. Props to @SentinelOne for releasing ~7 hrs of content for free. It's community contributions like these that close the gap between defensive & offensive capability

0 23 68 0 13

View Details

Alex @cryptogramfan

7 years ago

@QW5kcmV3 My sources suggest the term has military origins. Earliest reference I could find is R. E. Conley: Military Command and Control (c2) (Signal, Vol 33 No 4, Jan 1979, p 14). The Joint Doctrine for Command and Control Warfare (C2W) from 1996 also uses it: iwar.org.uk/rma/resources/…