Skip to content

CyberSIXT Search

GitHub - GhostPack/SafetyKatz: SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader

By HarmJ0y

Read the original on github.com (new tab)

Excerpt

First, the MiniDumpWriteDump Win32 API call is used to create a minidump of LSASS to C:\Windows\Temp\debug.bin. Then @subtee's PELoader is used to load a customized version of Mimikatz that runs sekurlsa::logonpasswords and sekurlsa::ekeys on the minidump file, removing the file after execution is complete.

Modifications

@subtee's PE Loader was slightly modified so some of the pointer arithmetic worked better on .NET 3.5 @gen…

The opening of the report, shown for reference. The full report, with its figures and indicators, is published by GitHub on github.com.

Mentioned in the excerpt

More from GitHub49

How-to-use-msfvenomGitHub · Added 19 Oct
GitHub - FallenAstaroth/stink: the cutest python-native infostealerGitHub · Added 18 Oct
cti/runster/readme.md at main · cert-orangecyberdefense/ctiGitHub · Added 16 Oct
GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.GitHub · Added 10 Oct

All 50 reports from GitHub

On the same topics

Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun