In this Twitch stream we analyze the multi-stage delivery chain used to install Jupyter / Solarmarker InfoStealer. The delivery chain includes an Inno Installer, m...
2022-02-01 23:42:32 +0000 UTC View Post
In this tutorial we unpack Night Sky Ransomware (x64) which is protected with VMProtect 3. We use VMPDump to dump and fix the imports and then re-create the virtualized entry point manually. <...
2022-02-01 03:30:09 +0000 UTC View Post
In this Twitch stream we unpack a VMProtect "soldier" implant developed by HackingTeam. Once we have unpacked the payload we write a static config extractor using Python.
... 2022-01-28 04:55:18 +0000 UTC View Post
This is the third part in our three-part tutorial series on unpacking VMProtect malware. At this stage we have dumped the unpacked PE payload. The entry...
2022-01-25 21:02:57 +0000 UTC View Post
This is part two in our three-part tutorial series on unpacking VMProtect malware. We are attempting to unpack a sample that has been packed with VMprotect where the e...
2022-01-25 21:02:13 +0000 UTC View Post
This is the first part in our three-part tutorial series on unpacking VMProtect malware. When approaching a VMProtect malware sample it is i...
2022-01-25 20:57:54 +0000 UTC View Post
In this Twitch stream we test the latest Dev 3.0 release of Binary Ninja using our standard IDA Pro malware analysis workflow. Stick around to see what works, what doesn't, and what's next for
In this Twitch stream we reverse engineer the “WhisperGate” malware stages 2, 3, and 4. The first two stages are .NET obfuscated with NetReactor and Ea...
2022-01-21 19:28:48 +0000 UTC View Post
In this tutorial we discuss the __security_init_cookie and __scrt_common_main_seh functions and why the PE Entry Point on an MSVC binary does not point to Main.
This is an important con...
2022-01-18 23:55:42 +0000 UTC View Post
In this tutorial we are going to discuss simple ways to stay safe while handling malware in non-safe environments.
The first step is to setup a saf...
2022-01-18 03:56:53 +0000 UTC View Post
Twitch live stream VOD. We generate IDA Pro FLIRT / FLAIR signatures for...
2022-01-16 00:29:40 +0000 UTC View Post
Twitch live stream VOD. We begin reverse engineering NightSky ransomware and identify a statically compiled mbedtls library. We build mbedtls and use the .pdb file to quickly import the library str...
2022-01-15 23:17:42 +0000 UTC View Post
Twitch live stream VOD. We unpack NightSky ransomware which is packed with VMProtect 3 (but not fully virtualized). We also use 2022-01-10 05:01:04 +0000 UTC View Post
Twitch live stream VOD. We build a static config extractor for Qakbot / Qbot malware using Python. In this stream we complete building out the C++ structs for the malware, identify how the config i...
2022-01-03 04:52:19 +0000 UTC View Post
Twitch live stream VOD. We begin reverse engineering Qakbot / Qbot malware. In this stream we resolve the dynamic imports, decrypt the encrypted strings, and begin building out the C++ structs for ...
2021-12-26 22:48:02 +0000 UTC View Post
Twitch live stream (clip). We take a look at Zeppelin Ransomware which is developed in Delphi. We go through the steps to correctly set up IDA Pro for analysis of a Delphi compiled binary including...
2021-12-23 04:02:34 +0000 UTC View Post
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and complete our static config extractor in Python.
Sample available on Malshare:
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and begin building out the struct that is used for it's injected code. We also realize we should have read Chong's ...
2021-12-02 14:01:02 +0000 UTC View Post
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and prepare it for full static analysis. We resolve the imports, decrypt the strings, and decrypt the embedded shel...
2021-12-01 14:01:07 +0000 UTC View Post
Twitch live stream VOD. We take a look at the new Emotet binary and build a static config extractor.
Sample available on Malshare: 2021-11-19 20:49:19 +0000 UTC View Post
Twitch live stream VOD. We take a look at the new Emotet binary and slowly start reverse engineering it...
Sample available on Malshare: 2021-11-18 14:00:07 +0000 UTC View Post
Igor's Tips: Type Libraries Deep Dive
Igor's Tips: 2021-11-14 01:04:56 +0000 UTC View Post
Usually Python and IDA play nice but when they don't the troubleshooting process can be maddening. In this tutorial we will cover some IDA Python environment basics that can assist with troubleshoo...
2021-11-08 22:21:17 +0000 UTC View Post
Twitch live stream VOD. This is our redemption stream! We finally deobfuscate the modified Confuser and extract the .NET payload.
2021-11-08 00:34:42 +0000 UTC View Post
Twitch live stream VOD. We take a look at a garbage RAT that is written in .NET obfuscated with ConfuserEx and packed in Themida.
2021-11-07 23:27:21 +0000 UTC View Post
In this tutorial we analyze the anti-debug checks in BlackMatter ransomware with IDA Pro. We use static analysis to determine exactly what the checks are doing.
BlackMatter sample:
<... 2021-10-15 17:00:15 +0000 UTC View Post
In this tutorial we demonstrate how to bypass the anti-debug checks in BlackMatter ransomware with x64dbg.
BlackMatter sample:
