Squiblydoo

@SquiblydooBlog

Malware Analysis Creator of Debloat, certReport, and http://CertCentral.org Want to chat? Join the Debloat discord: http://discord.gg/dvGXKaY5qr

Joined November 2020

74Following

4KFollowers

Pinned

Squiblydoo@SquiblydooBlog · Oct 27, 2021

Why, hello there, #solarmarker. virustotal.com/gui/file/1e791…

113

Squiblydoo@SquiblydooBlog · Jul 25

Most folk who follow me have seen me chat about Malcat. If you aren't familiar: It is a fairly inexpensive tool for malware analysis and RE that is super powerful. My favorite tool by far. The developer is doing a stream next week, something well worth catching.

IInvoke RE@InvokeReversing · Jul 25

Join us on Tuesday, July 29th, at 14:00 EST for a special live stream with Renaud Tabary from @malcat4ever where we will explore and perform live malware triage with Malcat! twitch.tv/InvokeReversing

2.0K

Squiblydoo@SquiblydooBlog · Jul 17

Low detection #bumblebee Distributed disguised as NetSetMan.msi "LLC Onixgroup" -- I don't post every cert we report. But if you want to see what gets reported, use Cert Central or the Cert Central API. certcentral[.]org

518

Squiblydoo@SquiblydooBlog · Jul 16

#bumblebee signed "LLC Ugurmana" Distributed disguised as Advanced IP Scanner and NetSetMan https://bazaar.abuse[.]ch/sample/a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2/ https://tria[.]ge/250716-nltd7avzcy/behavioral2 h/t @g0njxa @JAMESWT_WT

2.0K

Squiblydoo@SquiblydooBlog · Jul 12

Thats the way I like my libssl.dll: signed by a Indian company that makes nutrients for livestock "GAUAMRIT NUTRICARE PRIVATE LIMITED" MD5: ae0912ba4a5bff3f3543f5f393446adb https://bazaar.abuse[.]ch/browse.php?search=serial_number:737c5c461d3864ac4f089e26 h/t @g0njxa

SquiblydooBlog's tweet image. Thats the way I like my libssl.dll: signed by a Indian company that makes nutrients for livestock "GAUAMRIT NUTRICARE PRIVATE LIMITED"

MD5: ae0912ba4a5bff3f3543f5f393446adb

https://bazaar.abuse[.]ch/browse.php?search=serial_number:737c5c461d3864ac4f089e26
h/t @g0njxa

1.0K

Squiblydoo@SquiblydooBlog · Jul 11

Fake DBeaver signed by "LLC Vtorsintez" 🇷🇺 MD5: 4fa9f678df14a33e2e5480d63604f811 (Too big for MalwareBazaar) https://tria[.]ge/250711-n4tsnst1fs/behavioral1 Anti-analysis: wmic memorychip get Capacity -> exits h/t @g0njxa @JAMESWT_WT

SquiblydooBlog's tweet image. Fake DBeaver signed by "LLC Vtorsintez" 🇷🇺
MD5: 4fa9f678df14a33e2e5480d63604f811
(Too big for MalwareBazaar)

https://tria[.]ge/250711-n4tsnst1fs/behavioral1

Anti-analysis: wmic memorychip get Capacity -&gt; exits
h/t @g0njxa
@JAMESWT_WT

2.0K