In this Twitch stream we take a close look at an email stealer that has been flying under the radar for years and expose a small e-crime operation in the process!
Due to your positive f...
2023-05-26 17:39:33 +0000 UTC View Post
This is the first in a four-part series on PE parsing from a reverse engineering perspective. In this tutorial we walk through the PE headers and demonstrate how to mark up code that is parsing the...
2023-05-24 23:53:18 +0000 UTC View Post
This is the second in a four-part series on PE parsing from a reverse engineering perspective. In this tutorial we take a deep dive into the PE section table and discuss the difference between mapp...
2023-05-24 23:53:07 +0000 UTC View Post
This is the third in a four-part series on PE parsing from a reverse engineering perspective. In this tutorial we explore parsing the PE import table. We also introduce a new structure PE_BASE to h...
2023-05-24 23:52:50 +0000 UTC View Post
This is the final tutorial in our four-part series on PE parsing from a reverse engineering perspective. In this tutorial we explore parsing the PE export table. We conclude the tutorial with a com...
2023-05-24 23:52:21 +0000 UTC View Post
This Twitch stream is a little chaotic... you aren't hearing voices... anyone from the Discord and Patreon is free to join in the conversation as we test a new interactive RE concept.
The voi...
2023-05-23 17:27:48 +0000 UTC View Post
This is the first in a short two-part series on the Process Environment Block (PEB) and the Thread Environment Block (TEB). In this tutorial we introduce the PEB and the TEB and provide some backgr...
2023-05-23 00:40:35 +0000 UTC View Post
This is the second in a short two-part series on the Process Environment Block (PEB) and the Thread Environment Block (TEB). In this tutorial we focus on how a processes’ modules (DLLs) can be ac...
2023-05-23 00:40:27 +0000 UTC View Post
In this Twitch live stream we unpack in2al5dp3in4er loader which is using CreateDXGIFactory to detect sandboxes based on their lack of graphics card and triage its payload Aurora Stealer.
In this Twitch stream we take a look at CryptNET ransomware a ransomware written in .NET and protected with .NET Reactor.
In this Twitch stream we build an automated strings decryptor for the .NET XORStringsNet cryptor adopted by AgentTesla, Redline, and others.
In this Twitch stream we analyze a version of Chaos Ransomware builder that has been backdoored with Quasar RAT!
In this Twitch stream we investigate the difference between IcedID's older photo loader and newer gzip loader.
In this Twitch stream we have some fun reverse engineering all the stages in AresLoader.
This VOD is a little wilder than our usual streams, I decided to leave in some more of the bante...
2023-04-11 00:22:24 +0000 UTC View Post
In this Twitch lives stream we reverse engineer the 3CX software backdoor and associated downloader chain.
In this Twitch stream we complete our 3-part research series on emulating VBScript with a fully emulated VBScript running on Dumpulator.
Note: This is a research stream so it...
2023-03-29 07:37:27 +0000 UTC View Post
In this Twitch stream we continue our 3-part research series on emulating VBScript with a deep dive into the vbscript.dll.
Note: This is a research stream so it is long and p...
2023-03-29 06:21:56 +0000 UTC View Post
In this Twitch stream we start our 3-part research series on emulating VBScript by looking at the new Emotet OneNote docs being used to execute WScript malware.
The first part of the stream w...
2023-03-29 04:57:00 +0000 UTC View Post
In this Twitch stream we triage CryptBot a C++ INFOSTEALER that has been in operation since 2019.
The main focus of the stream is building a decent config extractor and a good yara rule for t...
2023-03-19 01:01:09 +0000 UTC View Post
In this Twitch stream we take a look at QVoid Stealer an open source .NET INFOSTEALER that has been dropped along with RedLine.
Set your expectations low for this one... really F-Tier stealer...
2023-03-19 00:57:06 +0000 UTC View Post
In this Twitch stream we complete our analysis of PikaBot and write a static config extractor to pull out the PS loader code and C2.
In this Twitch stream we complete our analysis of the PikaBot loader. We use Dumpulator and some IDA scripting to reso...
2023-03-12 17:57:07 +0000 UTC View Post
In this Twitch stream we take a look at a new loader called PikaBot! This stream is dedicated to the preparation of the binary for analysis, decrypting strings, resolving dynamic imports etc.
In this Twitch stream we work through the process of triaging a bad Yara rule and disambiguating the relationship between SoulSearcher Malware and a mystery worm!
Fo this Twitch stream we are joined by special guest @dr4k0nia for a deep dive into .NET reverse engineering! 2023-02-21 21:54:33 +0000 UTC View Post
Special guest @fwosar gives us a live tutorial covering ransomware cryptography, and takes us through an example breaking ransomwa...
2023-02-12 23:27:09 +0000 UTC View Post
In this twitch stream we complete our config extractor for the final stage of the Rhadamanthys loader.
Surprisingly most of the work can be done statically but we do use 2023-02-07 03:56:14 +0000 UTC View Post
In this twitch stream we take a look at Stage 3 of Rhadamanthys. This is the final stage of the loader. This stage is also position independent shell code and we spend the entirety of the stream ma...
2023-01-30 19:56:59 +0000 UTC View Post
In this twitch stream we take a look at Stage 2 of Rhadamanthys and use Dumpulator to create a simple unpacker.
We spend the first hour marking up the Stage 2 shell code, the emulation ...
2023-01-30 19:47:42 +0000 UTC View Post
In this twitch stream we take a look at Rhadamanthys, a stealer malware that uses multiples stages of shell code to protect its payload.
We start out unpacking the first stage but end u...
2023-01-26 19:25:16 +0000 UTC View Post