New Detections: Spotlight on Fingerprinting, Tofsee Configs & RansomHub-Linked Loaders
Source: YouTube · VMRay · published Jul 29, 2025 · 36:29
The July detection highlights webinar covers new discovery-focused WTIs, Yara rules for threats like Darcula AI phishing kit and SharePoint webshells, and config extractors for Golish and Toiy 1:37.
Key Takeaways:
• The session provides a focused snapshot of updates—WTIs, Yara rules, and config extractors—rather than an exhaustive release list 1:50.
• New WTIs target discovery behaviors: extended OS registry profiling, domain join checks via NetGetJoinInformation, and indirect systeminfo.exe execution linked to living-off-the-land techniques 2:00.
• Yara and config extractor additions cover Salad Stealer, Modlooader, Darcula AI phishing kit, SharePoint webshells, Golish (fake updates), and Toiy Trojan, with demos showing recursive analysis and Defender integration 2:18.
These updates improve visibility into profiling behaviors, LOLBin abuse, and second-stage payload delivery to keep detection teams ahead of evolving adversary tactics.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hey everyone. Um let's wait a minute or so so that people will join. I think we can start. Hello everyone. Um, welcome to the July edition of our detection highlights webinar. Great to have you with us. Um as well if this is your first time joining uh quick quick intro uh to what this is all about uh every month we put together a snapshot of the latest detection updates uh from our sandbox uh platform from our labs team uh it's about new VMRA thread identifiers WTI the abbreviation for that the Yara rules uh config extractors and we are going to share some context around the thread activity we are seeing behind them. So the goal here isn't to really overwhelm with everything we have shipped but to give you a focused look at what's new and how it can actually um help in detection workflows …