English

Posts with #DOSfuscation

#DOSfuscation

Public posts on X that use #DOSfuscation.

Related hashtags

  1. Nick Carr✓@ItsReallyNick
    Well that's certainly one way to launch mshta! 🧐 Please enjoy this "tasteful" cmd.exe obfuscation before @danielhbohannon melts minds in exactly 24 hours with #DOSfuscation at Black Hat Asia. Malicious CSV 🔥 uploaded today. h/t @TekDefense 0/56 on VT:
    Download
    6133236
  2. Nick Carr✓@ItsReallyNick
    DOSfuscation: Exploring the Depths of Cmd.exe Obfuscation and Detection Techniques 👀 @danielhbohannon unveils 4 never-before-seen input obfuscations for cmd.exe's command line 📃 #DOSfuscation whitepaper: 💾 Invoke-DOSfuscation:
    Download
    177111
  4. David Ledbetter@Ledtech3
    @DidierStevens
    @DidierStevens It looks like it is setting a bunch of variables and then putting them back together in a certain order.
    100
  8. Nick Carr✓@ItsReallyNick
    When the batch obfuscation is this advanced, surely you have found the APT. "S418754363.bat": Hurry! We still have time to pull down the 2nd stage* while they are watching @danielhbohannon videos! *hxxp://adberinger.ddns[.]net/main10/p.txt
    Download
    41847
  10. Nick Carr✓@ItsReallyNick
    @danielhbohannon
    @danielhbohannon Is there a skid version of Invoke-#DOSfuscation that obfuscates all the wrong parts? The only thing worth hiding is in plaintext and I love it.
    Nick Carr @ItsReallyNick
    LOL this one was actually hosted and delivered in-the-wild. 🙈 "DOC 17.07.2018P.bat": Go go poweringer! hxxp://poweringer.hopto[.]org/main12/p.txt
    102
  11. Nick Carr✓@ItsReallyNick
    @ItsReallyNick
    LOL this one was actually hosted and delivered in-the-wild. 🙈 "DOC 17.07.2018P.bat": Go go poweringer! hxxp://poweringer.hopto[.]org/main12/p.txt
    Download
    3210
  15. Malwrologist✓@DissectMalware
    #batch #obfuscation cmd /v:on -> !var! also will be expanded set L1=STH set L2=L1 set L3=L2 %L1% is !L1! -> STH (expected) %!L2!% -> %L1% but !%L2%! --> STH (new?) ^%L2^% -> %L2% but ^!L2^! -> L1 (caret (^) escapes % but not ! in this case) (new?) @danielhbohannon
    Download
    21333
  17. Malwrologist✓@DissectMalware
    @DissectMalware
    note: !var! is used in #DOSfuscation I am trying to deobfuscate its output so tested a few combination to have a better understanding of how it works
    003
  18. Nick Carr✓@ItsReallyNick
    @ItsReallyNick
    When DBO says never-seen-before, he knows & has been looking. He shares many in-the-wild techniques (including revealing some new methods) in use by targeted attackers. DBO has logged thousands of hours on this work. Every minute shows in his research:
    Daniel Bohannon @danielhbohannon
    After 9 months Invoke-DOSfuscation is finally released!! There is a lot of information for detection in the white paper, and the Invoke-DosTestHarness function is exactly what I used for detection dev & tuning. Code: White paper:
    2512
  19. Daniel Bohannon@danielhbohannon
    After 9 months Invoke-DOSfuscation is finally released!! There is a lot of information for detection in the white paper, and the Invoke-DosTestHarness function is exactly what I used for detection dev & tuning. Code: White paper:
    27444721
  20. Nick Carr✓@ItsReallyNick
    @ItsReallyNick
    Just 24 hours after release and #DOSfuscation is already fulfilling my end-of-year Nostradosmus prediction:
    Nick Carr @ItsReallyNick
    2018 infosec prediction: @danielhbohannon's DOSfuscation will challenge assumptions, be quickly adopted by a range of attackers, immensely frustrate defenders while helping them improve, and melt minds. 🤯
    005
  21. Nick Carr✓@ItsReallyNick
    2018 infosec prediction: @danielhbohannon's DOSfuscation will challenge assumptions, be quickly adopted by a range of attackers, immensely frustrate defenders while helping them improve, and melt minds. 🤯
    1216
  26. Sam King@Sam0rai
    Thank U, @lennyzeltser, for a well thought-of and riveting lecture on the use of evasive #malware in the wild: from string replacement to packing to #DOSfuscation and #VBA-Stomping. The lecture - and the lunch chit-chat after - were truly a delight!
    Download
    003
  32. Malwrologist✓@DissectMalware
    @DissectMalware
    I should also thank @danielhbohannon as I got the idea of padding commands from his #DOSfuscation tool. * the techniques are new (at least to the best of my knowledge). Some of them can be used in batch as well like and or operators
    004
  33. Show more posts