ghidra-nativeaot

Reported Context (2)

To pull useful metadata back out of the NativeAOT samples, we ported Washi’s Ghidra NativeAOT plugin (ghidra-nativeaot; write-up: Recovering Metadata from .NET Native AOT Binaries) to IDA Pro. Check Point Details Cavern Manticore’s Modular C2 Framework and Intrusions
The process of mapping the hydrated data was achieved using the ghidra-nativeaot plugin. Volexity Details VerdantBamboo Breach Using BRICKSTORM on Edge Appliances

Malware (8)

People (1)

Threat Actors (7)

MITRE ATT&CK (43)

Vendors (7)

Products (16)

Tools (11)

Industries (4)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.