This is the second part of our SmokeLoader analysis. We finish cleaning up the obfuscation in Stage 2 and locate the API hashing algorithm, we also locate the encrypted Stage 3 payloads...
2022-09-03 04:29:58 +0000 UTC View Post
This is our first look at SmokeLoader, we begin with analysis of Stage 2 (unpacked automatically). The binary is obfuscated using a mixture of simple opaque predicates, and encrypted functions that...
2022-09-03 04:14:02 +0000 UTC View Post
In this tutorial we will setup a free, safe, Windows 11 virtual machine (VM) that can be use...
2022-08-08 05:45:26 +0000 UTC View Post
Our final steam on Lockbit 3.0 ransomware! We complete our analysis of the third embedded binary. This is a tricky one, we need to use some debugging to decrypt the binary before we can begin our a...
2022-08-03 06:36:40 +0000 UTC View Post
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We add another hashing algorithm to HashDB and complete our analysis of the 2nd binary!
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We begin analysis of the second embedded binary...
Lockbit Ransomware: 2022-07-25 00:25:47 +0000 UTC View Post
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We complete our analysis of the first binary, and move on to look at the second binary...
In this twitch stream we start analyzing the binaries embedded in Lockbit 3.0 ransomware. We take a look at the first binary which requires the development of a new HashDB algorithm, and some strin...
2022-07-25 00:18:51 +0000 UTC View Post
In this twitch stream we continue our analysis of the new Lockbit 3.0 ransomware and complete our config extractor. We extract the ransom note along with many en...
2022-07-12 05:30:00 +0000 UTC View Post
In this twitch stream we take a look at the new Lockbit 3.0 ransomware and realize it is just a ripoff of BlackMatter! We resolve the dynamic imports then take a look at extracting the config... th...
2022-07-09 17:44:59 +0000 UTC View Post
In this twitch stream we take a final look at the Matanbuchus loader malware. We focus on an older version of the payload that uses a different type of string encryption.
This stream is...
2022-07-09 17:35:58 +0000 UTC View Post
This is the first in a short three-part series on pointers; how they work in memory, and what they look like in assembly. In this tutorial we look at the basics, what is a pointer, how is a pointer...
2022-07-06 04:28:04 +0000 UTC View Post
This is the second in a short three-part series on pointers. In this tutorial we take a look at VOID pointers, VOID*, PVOID, PVOID* etc. We also discuss casting and briefly touch on memory allocati...
2022-07-06 04:27:35 +0000 UTC View Post
This is the last part of a short three-part series on pointers. In this tutorial we look at what happens when an argument is passed by reference. What actually occurs in memory and in the compiled ...
2022-07-06 04:27:07 +0000 UTC View Post
In this twitch stream we take a second look at the Matanbuchus loader malware. We tighten our Yara rule, and refine our config extractor to work on all the samples we have collected, except one...&...
2022-06-28 03:47:36 +0000 UTC View Post
In this twitch stream we begin our triage of the Matanbuchus loader malware. First, we resolve the API hashes, and decrypt the strings, then we attempt to build a Yara rule and and automated config...
2022-06-24 03:03:30 +0000 UTC View Post
In this twitch stream we analyze a loader associated with FIN7 called DICELOADER. During our analysis we build and test a Yara rule as well as a config extractor.
Sample: 2022-06-21 04:53:31 +0000 UTC View Post
In this twitch stream we triage two simple malware downloaders and look for common characteristics that we can use to automatically detect them. One loader turns out to be a Cobalt Strike loader an...
2022-06-13 04:14:19 +0000 UTC View Post
In this twitch stream we take a look at various forms of Cobalt Strike Beacon and how their config can be extracted. We also triage a sample that is packed using Syscalls.
Notes (incl...
2022-06-10 18:24:17 +0000 UTC View Post
In this twitch stream we triage an Amadey Loader malware sample and write a config extractor in Python.
Packed Sample:
2022-06-08 03:58:58 +0000 UTC
View Post
In this twitch stream we walk through the triage of a packed loader and discuss some of techniques that can help save time when triaging unknown malware.
Packed Sample:
In this twitch stream we look at the recently updated emotet that is using obfuscation to hide its config and we use emulation to build a config extractor.
Sample:
In this twitch stream we take a look at the new Bumblebee loader malware. First we unpack it using x64dbg, then begin our triage work with IDA, and end up extracting the encrypted "config".
<...
2022-05-13 04:06:18 +0000 UTC View Post
In this twitch stream we investigate some quick ways to statically reverse engineer samples that rely on Syscalls. The sample we are looking at is Magniber ransomware.
Sample: 2022-05-10 00:33:05 +0000 UTC View Post
In this twitch stream we take a look at the new 64-bit version of Emotet. We use dumpulator and python to extract the ...
2022-05-05 04:58:47 +0000 UTC View Post
In this Twitch stream we create a binary patching script using IDA Python to patch our obfuscated Emotet sample.
In the end we determine that directly patching the end of each state is not go...
2022-04-28 15:46:15 +0000 UTC View Post
In this Twitch stream we complete our generic deobfuscation algorithm and test it on an obfuscated Emotet sample.
We build off of our work from the previous stream and attempt to finally patc...
2022-04-23 02:35:06 +0000 UTC View Post
In this Twitch stream we take a pause to go back and walk through the basics of what symbolic execution really is, and how it can help us with deobfuscation. This was a much requested stream, and h...
2022-04-16 02:37:48 +0000 UTC View Post
In this Twitch stream we attempt to build a generic algorithm to separate the dispatcher basic blocks from the original basic blocks in an obfuscated Emotet sample.
We build off of our ...
2022-04-12 20:37:50 +0000 UTC View Post
In this Twitch stream we begin to look at the CFF obfuscation in Emotet. Our first step is to build an algorithm to separate the dispatcher control flow blocks from the original basic blocks. ...
2022-04-12 20:29:18 +0000 UTC View Post