Anas @ZeroMemoryEx

Cyber Security Consultant | Security Researcher hackandhide.com Joined December 2019

Tweets

282
Followers

2K
Following

528
Likes

1K

Anas @ZeroMemoryEx

5 days ago

@liquidstate_1 @osint_based Yeah, I know that, but in the context of the post, I don’t think it applies. Even if you have the session key/cookies, you still wouldn’t have permission to transfer funds since you’d need 2FA as well.

2 0 0 39 0

View Details

Anas @ZeroMemoryEx

5 days ago

@osint_based Yeah, that’s the closest pattern, I guess. He has a bunch of stealer logs, and he probably runs automated drainer software on them which automatically drains funds from extensions, seed phrases ...

0 0 5 309 0

View Details

Anas @ZeroMemoryEx

a month ago

@DeanLo66 @NulliusResearch @UK_Daniel_Card Yeah, the guardrails were what confused me, because all those circles have them, while the image you posted doesn’t. but glad it was that close!

0 0 0 13 0

View Details

Anas @ZeroMemoryEx

a month ago

@MagnusH2 @DailyDarkWeb Those keys can be used to make a bot that watches for any transaction and sweeps the tokens as soon as they land in any of those addresses. I’ve seen a guy who did this in 2017 and swept many bitcoins using this.

0 0 1 13 0

View Details

Anas @ZeroMemoryEx

2 months ago

@tdatwja this DLL : d265fcf18b14b98e55aa9fffd6b64b39de84304a1796854e72eef35bc6dca2c6 TencentVideoReporterPC.dll

0 0 1 72 0

View Details

Anas @ZeroMemoryEx

2 months ago

@tdatwja interesting It abuses a ZEON signed program to perform DLL sideloading of a hidden DLL.

1 0 4 226 1

View Details

Anas @ZeroMemoryEx

3 months ago

@medusa_0xf besides the csrf style attack with it, you can also chain CSPT with an open redirect to get xss or leak csrf tokens.

1 0 3 195 0

View Details

Anas @ZeroMemoryEx

3 months ago

@eversinc33 The easiest way to get blacklisted on literally every website that uses Akamai is by visiting this page🤣. akamai.com/q=<script>alert("XSS")</script>

0 0 3 616 1

View Details

Anas @ZeroMemoryEx

4 months ago

@0xmadvise 🔥🔥

0 0 1 273 0

View Details

Anas @ZeroMemoryEx

5 months ago

@Haus3c Unfortunately, you can’t!

0 0 2 371 0

View Details

Anas @ZeroMemoryEx

5 months ago

@Haus3c You need to check the certificate details to see if you can use it to dump PPL processes.

0 0 3 387 0

View Details

Anas @ZeroMemoryEx

6 months ago

@Salsa12__ what do you mean by help disable PPL/PP by manipulating links ?

2 0 1 253 0

View Details

Anas @ZeroMemoryEx

7 months ago

@smakosh @yezz123 We can go even lower kfta dyal djaj : 300dh lma dyal bir : free internet : 50dh mchrok m3a bzf nas khbz karm: 10dh ( 7to f ma bach yrtab ) srdine : laknti 9rib b7ar sydo kra : camping tent

2 0 8 501 1

View Details

Anas @ZeroMemoryEx

8 months ago

@rustdesk @ESET @anydesk @TeamViewer beside that i also found that it was used by several cybercriminal groups, including BlackBasta, as early as 2022.

1 0 0 321 0

View Details

Anas @ZeroMemoryEx

8 months ago

@rustdesk @ESET @anydesk @TeamViewer No idea, but from my point of view, a threat actor can easily deploy it stealthily, while other remote desktop apps are harder due to the message box that appears when someone tries to connect.

1 0 1 2K 0

View Details

Anas @ZeroMemoryEx

8 months ago

I published a blog post explaining the features of Chaos-Rootkit and how each one works internally. hackandhide.com/chaos-rootkit-…

0 10 41 3K 26

View Details

Anas @ZeroMemoryEx

9 months ago

@0x_alibabas Thanks. didn’t try BaitAndSwitch. when I suggested a redirect policy, it wasn’t an option they said it was incompatible with their SDK. It also took a long time for them to implement a fix, so I gave up testing.

0 0 0 146 0

View Details

Anas @ZeroMemoryEx

9 months ago

I’ve released a PoC and a technical write-up for a local privilege escalation vulnerability I discovered last year and reported to Lenovo PSIRT, affecting many gaming laptop brands, including Lenovo, MSI, Thunderobot, and others. github.com/ZeroMemoryEx/C…