"DFIR Team Support" (2024, colorized) https://t.co/on05AfnVfB
— Florian Roth (@cyb3rops) Jan 29, 2024
#100DaysofYara Day 7 and Day 8: Going a little easy this time... For these two days, we will cover the rules for #IllyrianStealer (another mundane .NET stealer) and the most recent version of #RaccoonStealer (v2.3.1.1) IllyrianStealer: https://t.co/RIJ8wmyO5A RaccoonStealer:… https://t.co/u9e6SOIR8x https://t.co/5zGBzZtIhu
— RussianPanda 🐼 🇺🇦 (@AnFam17) Jan 8, 2024
Happy New Year! I have for you a new #PEbear (v0.6.7) with some of the requested features, such as strings, and patterns searching. Plus other improvements & bugfixes. Check it out! https://t.co/AsAbJGR9nb 🐻💙 https://t.co/fuPQoqANva
— hasherezade (@hasherezade) Jan 8, 2024
Update https://t.co/4XVNgNrxgr https://t.co/cZkh63HFpZ
— Ange (@angealbertini) May 5, 2023
Most PE executables only have a DOS stub, but Robert Xiao combined DOOM Dos and Windows executables into a single universal file. Advanced merge of genuine Dos headers, relocations, DOS4/GW headers and PE file. https://t.co/RfMejxAJK4 https://t.co/lR5IILcyKs
— Ange (@angealbertini) Dec 19, 2023
#100DaysOfYara Day 6: Yara can be used to access specific data at a given position. 👇 This feature is often used to identify Magic Numbers (used to determine the file format) to match your rule against a specific file type, such as a PE (0x4D5A), for example. Today, no… https://t.co/6O7Ld9iLce https://t.co/ST0vIJc1q4
— Thomas Roccia 🤘 (@fr0gger_) Jan 6, 2024
