Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2022-04-14Medium (@DCSO_CyTec)DCSO CyTec
@online{cytec:20220414:404:a7dc53d, author = {DCSO CyTec}, title = {{404 — File still found}}, date = {2022-04-14}, organization = {Medium (@DCSO_CyTec)}, url = {https://medium.com/@DCSO_CyTec/404-file-still-found-d52c3834084c}, language = {English}, urldate = {2022-05-31} } 404 — File still found
SideWinder
2022-04-04The DFIR Report@0xtornado, @yatinwad, @MettalicHack, @_pete_0
@online{0xtornado:20220404:stolen:3df91a7, author = {@0xtornado and @yatinwad and @MettalicHack and @_pete_0}, title = {{Stolen Images Campaign Ends in Conti Ransomware}}, date = {2022-04-04}, organization = {The DFIR Report}, url = {https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/}, language = {English}, urldate = {2022-04-04} } Stolen Images Campaign Ends in Conti Ransomware
Conti IcedID
2022-03-12Twitter (@ET_Labs)ET Labs
@online{labs:20220312:quick:ef9cb00, author = {ET Labs}, title = {{A quick thread examining the network artifacts of the HermeticWizard spreading}}, date = {2022-03-12}, organization = {Twitter (@ET_Labs)}, url = {https://twitter.com/ET_Labs/status/1502494650640351236}, language = {English}, urldate = {2022-03-28} } A quick thread examining the network artifacts of the HermeticWizard spreading
HermeticWizard
2022-03-10Twitter (@teamcymru_S2)Team Cymru
@online{cymru:20220310:crimson:a646aac, author = {Team Cymru}, title = {{Tweet on Crimson RAT infrastructure used by APT36}}, date = {2022-03-10}, organization = {Twitter (@teamcymru_S2)}, url = {https://twitter.com/teamcymru_S2/status/1501955802025836546}, language = {English}, urldate = {2022-03-14} } Tweet on Crimson RAT infrastructure used by APT36
Crimson RAT
2022-02-28Twitter (@M_haggis)The Haag
@online{haag:20220228:parsing:7eb8f68, author = {The Haag}, title = {{Tweet on parsing Daxin driver metadata using powershell}}, date = {2022-02-28}, organization = {Twitter (@M_haggis)}, url = {https://twitter.com/M_haggis/status/1498399791276912640}, language = {English}, urldate = {2022-03-07} } Tweet on parsing Daxin driver metadata using powershell
Daxin
2022-02-26Atomic Matryoshkaz3r0day_504
@online{z3r0day504:20220226:infographic:7bb195e, author = {z3r0day_504}, title = {{Infographic: APTs in South America}}, date = {2022-02-26}, organization = {Atomic Matryoshka}, url = {https://www.atomicmatryoshka.com/post/infographic-apts-in-south-america}, language = {English}, urldate = {2022-03-01} } Infographic: APTs in South America
Imminent Monitor RAT Machete
2022-02-21Atomic Matryoshkaz3r0day_504
@online{z3r0day504:20220221:ousaban:38cdf0b, author = {z3r0day_504}, title = {{Ousaban MSI Installer Analysis}}, date = {2022-02-21}, organization = {Atomic Matryoshka}, url = {https://www.atomicmatryoshka.com/post/ousaban-msi-installer-analysis}, language = {English}, urldate = {2022-02-26} } Ousaban MSI Installer Analysis
Ousaban
2022-02-17Twitter (@Honeymoon_IoC)Gi7w0rm
@online{gi7w0rm:20220217:tweets:a96e458, author = {Gi7w0rm}, title = {{Tweets on win.prometei caught via Cowrie}}, date = {2022-02-17}, organization = {Twitter (@Honeymoon_IoC)}, url = {https://twitter.com/honeymoon_ioc/status/1494311182550904840}, language = {English}, urldate = {2022-02-17} } Tweets on win.prometei caught via Cowrie
Prometei
2022-01-28Atomic Matryoshkaz3r0day_504
@online{z3r0day504:20220128:malware:3628b1b, author = {z3r0day_504}, title = {{Malware Headliners: LokiBot}}, date = {2022-01-28}, organization = {Atomic Matryoshka}, url = {https://www.atomicmatryoshka.com/post/malware-headliners-lokibot}, language = {English}, urldate = {2022-02-01} } Malware Headliners: LokiBot
Loki Password Stealer (PWS)
2022-01-24Twitter (@_icebre4ker_)_icebre4ker_
@online{icebre4ker:20220124:vultur:3eda891, author = {_icebre4ker_}, title = {{Vultur Dropper on Google Play Store}}, date = {2022-01-24}, organization = {Twitter (@_icebre4ker_)}, url = {https://twitter.com/_icebre4ker_/status/1485651238175846400}, language = {English}, urldate = {2022-02-02} } Vultur Dropper on Google Play Store
Vultur
2022-01-22Atomic Matryoshkaz3r0day_504
@online{z3r0day504:20220122:malware:1ec08ef, author = {z3r0day_504}, title = {{Malware Headliners: Emotet}}, date = {2022-01-22}, organization = {Atomic Matryoshka}, url = {https://www.atomicmatryoshka.com/post/malware-headliners-emotet}, language = {English}, urldate = {2022-02-01} } Malware Headliners: Emotet
Emotet
2022-01-21Twitter (@_CPResearch_)Check Point Research
@online{research:20220121:whitelambert:e5581c9, author = {Check Point Research}, title = {{Tweet on WhiteLambert malware}}, date = {2022-01-21}, organization = {Twitter (@_CPResearch_)}, url = {https://twitter.com/_CPResearch_/status/1484502090068242433}, language = {English}, urldate = {2022-01-25} } Tweet on WhiteLambert malware
Lambert
2022-01-20CybleincCyble
@online{cyble:20220120:deep:e172620, author = {Cyble}, title = {{Deep Dive Into Ragnar_locker Ransomware Gang}}, date = {2022-01-20}, organization = {Cybleinc}, url = {https://blog.cyble.com/2022/01/20/deep-dive-into-ragnar-locker-ransomware-gang/}, language = {English}, urldate = {2022-01-25} } Deep Dive Into Ragnar_locker Ransomware Gang
RagnarLocker
2022-01-15Atomic Matryoshkaz3r0day_504
@online{z3r0day504:20220115:malware:ce94f8c, author = {z3r0day_504}, title = {{Malware Headliners: Qakbot}}, date = {2022-01-15}, organization = {Atomic Matryoshka}, url = {https://www.atomicmatryoshka.com/post/malware-headliners-qakbot}, language = {English}, urldate = {2022-02-01} } Malware Headliners: Qakbot
QakBot
2022-01-13Twitter (@8th_grey_owl)8thGreyOwl
@online{8thgreyowl:20220113:selfmake:b0e52ab, author = {8thGreyOwl}, title = {{Tweet on SelfMake Loader}}, date = {2022-01-13}, organization = {Twitter (@8th_grey_owl)}, url = {https://twitter.com/8th_grey_owl/status/1481433481485844483}, language = {English}, urldate = {2022-01-19} } Tweet on SelfMake Loader
SelfMake Loader
2022-01-09Atomic Matryoshkaz3r0day_504
@online{z3r0day504:20220109:malware:81e38aa, author = {z3r0day_504}, title = {{Malware Headliners: Dridex}}, date = {2022-01-09}, organization = {Atomic Matryoshka}, url = {https://www.atomicmatryoshka.com/post/malware-headliners-dridex}, language = {English}, urldate = {2022-02-01} } Malware Headliners: Dridex
Dridex
2022-01-02Atomic Matryoshkaz3r0day_504
@online{z3r0day504:20220102:cracking:0315ea6, author = {z3r0day_504}, title = {{"Cracking Open the Malware Piñata" Series: Intro to Dynamic Analysis with RedLineStealer}}, date = {2022-01-02}, organization = {Atomic Matryoshka}, url = {https://www.atomicmatryoshka.com/post/cracking-open-the-malware-pi%C3%B1ata-series-intro-to-dynamic-analysis-with-redlinestealer}, language = {English}, urldate = {2022-05-29} } "Cracking Open the Malware Piñata" Series: Intro to Dynamic Analysis with RedLineStealer
RedLine Stealer
2021-11-17Twitter (@Unit42_Intel)Unit 42
@online{42:20211117:matanbuchus:9e3556c, author = {Unit 42}, title = {{Tweet on Matanbuchus Loader used to deliver Qakbot (tag obama128b) and follow-up CobaltStrike}}, date = {2021-11-17}, organization = {Twitter (@Unit42_Intel)}, url = {https://twitter.com/Unit42_Intel/status/1461004489234829320}, language = {English}, urldate = {2021-11-25} } Tweet on Matanbuchus Loader used to deliver Qakbot (tag obama128b) and follow-up CobaltStrike
Cobalt Strike QakBot
2021-11-16Twitter (@_icebre4ker_)Fr4
@online{fr4:20211116:about:7000822, author = {Fr4}, title = {{Tweet about Aberebot source code put up for sale by the developer}}, date = {2021-11-16}, organization = {Twitter (@_icebre4ker_)}, url = {https://twitter.com/_icebre4ker_/status/1460527428544176128}, language = {English}, urldate = {2021-11-19} } Tweet about Aberebot source code put up for sale by the developer
Aberebot
2021-11-16Twitter (@_CPResearch_)Check Point Research
@online{research:20211116:32bit:f9aff89, author = {Check Point Research}, title = {{Tweet on 32bit version of CVE-2021-1732 exploited by BITTER group}}, date = {2021-11-16}, organization = {Twitter (@_CPResearch_)}, url = {https://twitter.com/_CPResearch_/status/1460643735952318474}, language = {English}, urldate = {2021-11-19} } Tweet on 32bit version of CVE-2021-1732 exploited by BITTER group