Lexsek @Lexsek_

Reverse Engineer | Malware Research | Forensics | Proud dad of a Belgian Sheperd Malinois Joined June 2017

Tweets

309
Followers

401
Following

246
Likes

489

CERT Orange Cyberdefense @CERTCyberdef

9 months ago

New variant of #Emmenhtal loader actively distributed since early December and leading to #Lumma #DarkGate and/or #SectopRAT. 🚩#Emmenhtalv2 adopts new obfuscation features and is currently not well detected by AV solutions. Initial access: fake CAPTCHA, #ClickFix, phishing.

2 8 14 2K 3

CERT Orange Cyberdefense @CERTCyberdef

a year ago

Our CTI analysts @Mar_Pich and @Lexsek_ just released their investigation into #Emmenhtal 🪼🧀, a loader which has been distributing +10 different infostealers since early 2024. This research is based on real-life incidents from our #CyberSOC. 🔗tinyurl.com/2kxua23r

1 13 21 3K 5

Download Image

Jl_N_ @Jl_N_

a year ago

Nous recrutons dans notre équipe. Si vous avez des compétences en RE, souhaitez travailler au profit de la Gendarmerie en tant qu'expert judiciaire et manager une équipe de passionnés : …stereinterieur-career.talent-soft.com/Pages/Offre/de… (rt apprécié)

0 12 5 1K 1

Dreg @therealdreg

2 years ago

Understanding Windows x64 Assembly sonictk.github.io/asm_tutorial/

2 87 285 20K 165

Download Image

Lexsek @Lexsek_

2 years ago

Look what I just received 😊. Thanks a lot @DarkCoderSc @fr0gger_ for the kind message and this beautiful coin, really appreciate the gesture. Does the Ronflex Pokemon's card mean I need to take some rest and sleep more ? 😅

2 0 3 786 0

Download Image

Check Point Research @_CPResearch_

2 years ago

Let's explore the link between #Rhadamanthys stealer and #HiddenBee coin miner! In our latest blog, @hasherezade walks you through the custom executable formats, evolution, and features of this interesting, multilayer malware toolkit. research.checkpoint.com/2023/from-hidd…

5 77 175 120K 48

Daniel Lunghi @thehellu

2 years ago

The slides botconf.eu/wp-content/upl… and video youtube.com/watch?v=713Csm… of my #Botconf talk about #IronTiger TTPs are online. I discuss recent infection vectors (supply chain attack), the evolution of their malware toolkit and targeting, and our attribution methodology #APT #APT27

2 49 102 16K 26

Download Image

Alexandre Borges @ale_sp_brazil

2 years ago

So far I've written 559 pages to help the security community: 1. exploitreversing.com/2021/12/03/mal… 2. exploitreversing.com/2022/02/03/mal… 3. exploitreversing.com/2022/05/05/mal… 4. exploitreversing.com/2022/05/12/mal… 5. exploitreversing.com/2022/09/14/mal… 6. exploitreversing.com/2022/11/24/mal… 7. exploitreversing.com/2023/01/05/mal… 8. exploitreversing.com/2023/04/11/exp…

34 399 1K 100K 661

CERT Orange Cyberdefense @CERTCyberdef

2 years ago

We are at @Botconf ! Our teammates Jeremie and @Lexsek_ present this morning an incident response case related to RansomCartel 🙌 #ransomware #raas #botconf23

0 5 16 2K 0

Download Image

hasherezade @hasherezade

3 years ago

New release: #TinyTracer v2.3 : github.com/hasherezade/ti… - with improved syscalls tracing support - now syscalls are automatically mapped to corresponding functions names

7 161 491 74K 86

Download Image

Thomas Roccia 🤘 @fr0gger_

3 years ago

🧵Thread: 10 underestimated resources about malware techniques. This is a list of various resources to learn more about malware techniques, how to analyse them and how to improve your detection! 🤓 #infosec #malware #threatintel #malwareanalysis #cybersecurity

8 119 315 0 214

Download Gif

Check Point Research @_CPResearch_

3 years ago

For a reverse engineer, the ability to directly call a function from the analyzed binary can be a shortcut that bypasses a lot of grief. In this article, we explore and compare 3 ways of invoking functions: IDA Appcall, Dumpulator, and Unicorn Engine. research.checkpoint.com/2022/native-fu…

0 123 327 0 78

Synacktiv @Synacktiv

3 years ago

At the crossroads between pentest and incident response, we wondered what traces attackers really leave when they lateralize. Our latest blogpost tries to answer the question on Windows systems. synacktiv.com/publications/t… #DFIR

0 31 53 0 11

5pider @C5pider

3 years ago

90% of my Twitter DMs are asking me about how to start getting into Malware development. Well, I love answering them but it's easier to write a small thread about it so here we go. 1/12

114 901 3K 0 2K

Ivan Kwiatkowski @JusticeRage

3 years ago

New blog post about an UEFI firmware bootkit! securelist.com/cosmicstrand-u… Research was led by our dearly missed @_marklech_

1 124 254 0 56

Thomas Roccia 🤘 @fr0gger_

3 years ago

After a few months of work, we are pleased to announce the new version of Unprotect: your catalog of malware evasion techniques!🤩🧵👇 #unprotectproject #infosec #malware #cybersecurity @DarkCoderSc unprotect.it

8 111 223 0 58

Download Image

Thomas Roccia 🤘 @fr0gger_

3 years ago

New technique added into #UnprotectProject by @Lexsek_ "FLIRT Signatures Evasion", interesting technique to hide malicious code inside function that would be recognised as a legitimate library!🤩 #infosec #malware #threathunting cf:@DarkCoderSc unprotect.it/technique/flir…

2 18 41 0 3

HyperDbg @HyperDbg

3 years ago

Here are 11 reasons why we should use #HyperDbg, the differences between HyperDbg and #WinDbg, and how HyperDbg will change our debugging/reversing journey. A thread (24 tweets) 🧵:

13 100 331 0 87

Sylvain Peyrefitte @citronneur

3 years ago

Time Travel Debugging for #IDA !!! github.com/airbus-cert/tt… #SSTIC. Thanks @commial !!!

3 101 238 0 27

Alexandre Borges @ale_sp_brazil

3 years ago

The third article in the Malware Analysis Series (MAS) is available for reading on: exploitreversing.com/2022/05/05/mal… Next week I'll release the fourth article. Have an excellent day. #malwareanalysis #reverseengineering #reversing #programming