Johannes Bader
LightNews LightNews
banner
viql.bsky.social
Johannes Bader
@viql.bsky.social
41 followers 3 following 1 posts
Reverse engineer / malware analyst. On the hunt for domain generation algorithms.
Posts Replies Media Videos
viql.bsky.social
Today, I'm releasing the first version of a small web 🚀: rosti.bin.re

It provides IOCs and YARA rules collected semi-automatically from public blog posts and reports of almost 200 cybersecurity sites.

I hope it proves useful to some of you ... 🙏✨ #CyberSecurity #ThreatIntel
Screenshot of the "reports" section of Rösti. The page displays multiple reports in a grid format, each with a card-like design. Each card includes information such as the report title, author, publication date, associated threat indicators (IOCs and YARA rules), and source organization. A screenshot of the home page of Rösti, a web application providing Repackaged Open Source Threat Intelligence. The logo "RÖSTI" is prominently displayed in blue. Below the logo, the description states that the platform gathers Indicators of Compromise (IOCs) from public reports, available in formats such as MISP, STIX, and ECS. There are two buttons: "Feeds" and "Reports." At the bottom, statistics are shown: 217,399 IOCs and 440 YARA rules extracted from 2,288 reports of 183 sources. A footer highlights "New parsers" added on January 28, 2025, listing CERT-FR and Netlab360 as new sources. A link to view the full changelog is in the bottom-right corner. Screenshot of the "reports" section of Rösti in dark mode. The page displays multiple reports in a grid format, each with a card-like design. Each card includes information such as the report title, author, publication date, associated threat indicators (IOCs and YARA rules), and source organization.
January 30, 2025 at 2:16 PM
Reposted by Johannes Bader
threatcat-ch.bsky.social
We published a new blog post about a malware sample with an encrypted payload using an interesting technique: threatcat.ch/blog/encrypt...
Screenshot of the function that calculates the decryption key.
December 7, 2023 at 3:39 PM