BSides Cairo 2019: Insight Into TTPs Of A Middle Eastern Threat Actor - J. Horejsi and D. Lunghi

[Music]

[Music]

[Music]

[Music]

[Music]

[Music]

[Music]

[Music]

[Music]

for four months and let me show you with [Music] email no try to take a sample image which is

[Music]

drive that's asking for some subtitle [Music] distasteful like frightened thank you sent by someone from Syria for Israel you can see this company to be little one and write one article skeleton public garden organizations always have to be civil style for my estimation the right one is infrared operator person area is like one thing if you know is Mexican ancestry office office systems this model of McNally that it's like there were there only

[Music]

[Music]

[Music]

so all the natural documents which we have seen since months like what about fear every guy in started a troll that is a crop circle and it depends when it was first version acronyms in basic script and partial file which later was executed during the North Star in class movie February receivers the two computational and with like little strip read file for this population in the file and also files like we transcribe later like some Asian they contain things for March last year and try to not be a little spice or small difference in I also like to say something a bit developer last year and we are seeing our showgirls computer it and started dangers the wall cloud

storage for she instrumentation and the beginning of this year another property which is like that and LP updates like ignore that is all this is here so this is not beginning touches you can never teach me chosen and our betrothal on three different files and we die you can see that there are like some function and everybody function and some others and you can step on it involved in all the lanes and all the particles are complicit in friendly be kind of visuals the same electron energy functions and two numbers for different way of obfuscation group of people usually recognize it so this happened very little babies like to hide not perfume if you want to make a -

suffers and a lot of people did something like that so this matter differently the first case from fun of the visual basic strengths you can see this region in the middle which is somehow I confiscated visual that is great this is amazing screen execute in the second column will publish a file and it look like this it was like in mode of execution does not make 64 in contrast density so the second type of information

[Music]

[Music]

and inside definitely support optional which is roughly twice so the first case [Music] I can started in Malaysia terrible commenced at this time don't rinse water before I actually have like a lollipop - like the government this type of very small group desalinate something from internal executive and second you should drop sugar file while which does not reach people the name also the ability and then interacted linked with the Ellison's has rabies one that one of the operation of this it was how they imagined there was like well for Iran and nature of this course officer sherry the correct version of third sweet like a fantasy to this file without this that everything like the

perp Walter chop-chop and then you will be twist emergency is hope apply this so again I mentioned before then like three files and some suspicious nature and extensions and also this very to find a place in Chicago and South Beach which is this takes fifty psychodynamic I'm discovering so the host feels like another so I'm alga nothing to base with it by building folks many of you were all you know is facing six people they think only like very difficult for everyone for this trajectory know this is difficult it which if they were seen before on everyone music it so when we were searching on internet not like what chamber the nation in Pineville close by

with a Spanish we should probably be style based in this ensemble so it means there should be 52 leather burn a lot of all the portable is this thing is missing and people Bernie this is like my house I would separate out of it which we have like fifty validation from being outside and is not wearing this top of it it started black bracket letters to this problem lipsmack that ready ASCII characters from this one that one and this is how these electronic loose so this is the basically this concert so this ticket thing works this is like somehow you go to the devil too much in detail but every type of our takes like

drink light so takes every time takes three characters then it does some computation is specifically characters and then it computes obviously return soon / glance for every treatment issue two characters in my hospital so this is the way of the law particles like zero zero weight which is like you are making there be more base included it goes in another part 13 one year he published by my blog post and he mentions makeup using basically the same and then this new article be few more encodings face multi factors things for the end thanks 14 so it seems that they are ridiculous writing on them and they change standard there - zookeeper before Facebook before 45 people this is a given starting

starting the electric age 45 of them in this case take aways take five characters place 45 and these 5 characters produce three character philosophy so this is like that I get like something example to computation and here is it hope we shave the macros for the same conditions okay now it was phenomenal recording and a lot little bit about the negative so the main regular things for most of last year I'll set back by government anything like people straight already so this is most polling confiscated heavy like there is this high office kitchen it's a pretty funky now some people reply asking one researcher and eat it like some food creating a powerful energy use the same portable

device so this is this confiscation which later this subtle easily flat basis before suitable question Expo among freshmen they like your model is asleep it option which is both formats a freshman so they take this tray put it in three places - time and they just record rated they like the nd state is effective corrector receiver go they randomized actually there's multiple position like this so for access which researchers if you have the obligation I always try to find three things what I do next people expression then replaces this rivals command HL top it to file and repeat the process so sometimes every like three four five players I think about suppose like 30 layers is what pays for those

service also sometimes like if you see vertical this phase is also like a building of this place to basically take some vertical play or it'll take like follow 36 and characters which are can I be eggs they just use it for trouble okay completely in this limit so what does the show that your new soap this basically points a consistent information so it takes like information of what Israel did I write and sew it together senses to GCS seven the couple's many of the compounds are had staggered tangle of interbreeding shuttle routes columns normal it some versions of this disgruntled flee and it was like rebuilding all the files from trifle scalp like my big these work

amazing all data companies some commands look like this one like excelled in creating the instance of excel education we are bio it from these metals and in April maybe it issue a nice calm and executed the context of this process of all these goals like it's excellent race it seems like if right appeal itself is an actual any making of some some research projects I'm sorry sir just publish its publishing alive and for these metals this life but when you search for it this is for these pieces of this goal you can find like alignment on this like shoulder shop there obviously is not execute to call provided by pacified mistake something like that these are

digital Commons of Radiology revision use and of tomorrow's album but it says it was nothing to do with outdoor girls like able to hold traditional fishermen to for fishing credentials to get these to be not so they try to really study things as possible like something for every or for taking control of running running colonic interesting koalas life of muddy muddy water because of this entities come out to take some tasty gold and pickles is a drum roll hello pcs communication so some other things are saying these white spots they take like each of these predators it has a coded in RSA just be very stubborn because we're because that it is out is the example of a company so they assign

a baby occasionally there's and originally what you go population passage a competent the same for a company I get settlement so all this simplification so you can see here the distinct top is injected for model and you can might be bred console messages like front of the society action token is for elections very be perfect like it's registered originally mention speech all persons

[Music]

[Music]

[Applause] [Music]

[Music] [Music]

[Music]

so the compromise on what was within and we later annexed like 30 finalists so did the detector 5 1850 can you say so commands with great nutrition so we also come on number one over typical size order aah nevertheless contact your doctor to check for diabetes people especially commands for taste anything on a regular basis technical people change outside come on expecting these particular machine is really compete on one side simply connect to the PI can see it see so from that's right amazing so are you ready no way no the biopsy c7 so this ticker modify the basis we call it forward loan and subtle little overhead the difference here is that communicates felt with are optimized for different

size known by indirectly Delta value [Music] absolutely enjoyed of this filter the provider here and the rest of it and babies are coming in [Music]

[Music]

[Music]

[Music]

[Music]

whenever

[Music]

[Music]

[Music]

[Music]

[Music]

[Music]

so

[Music]

[Music]

[Music]

[Music]

did you pass a physical product or definition so they are finding the difficult a legacy so before next videos on identification and she was what it was Leda specific technical Chinese which would our tourism we also curate embedding these publications which evils and instead [Music]

[Music]

[Music]

[Music] [Music]

[Music]

our Chinese so the detection of all this type of check guide so the world that we go and also the result records this is attack from China already much more television with

[Music]

[Music]

[Music] LM ready for final gypsies website so this shoulder detective Adam tryna be on pretty girl bar like healthy aging for the hospital service provider receive domination ants five-minute television providers also lazy we managed to bicycle country the server site committed the bucket protectors of the server side - what about this high quality that several real job so much GHC for power all right on the terraces - so you kill us all with the same attendance another important change under the portal targets abilities completely suspends of what we are running out of rifles were justified enemies so this is the target of a disability severity

[Music]

[Music]

[Music]

[Music]

and this was a penny what I shouldn't even so I have no idea why is that you're mistaken side difficulties there are the same texture to that Commission

but if you look closely at here well then let's see if at least first for apologies magic to the metadata on the vanishing the one creator so we'll definitely take my pizza right at the end of four enemies it does even early

[Music]

[Music] yeah patient zero so the errantly it won't fit for that purpose so in the videos we can only access people provided target many reasons for that are targeted and people that once so what we should nobody is actually anything because the first behavior of this over mind of people that share with other people any questions [Applause]