Static Devirtualization of Tencent VM
Over the course of several months we have noticed an increased interest in Tencent VM obfuscation. We have had complete static devirtualization of this VM obfuscation for quite some time now and have noticed others have achieved similar deobfuscation results.
https://back.engineering/blog/31/07/2026/
🎖@malwr
Over the course of several months we have noticed an increased interest in Tencent VM obfuscation. We have had complete static devirtualization of this VM obfuscation for quite some time now and have noticed others have achieved similar deobfuscation results.
https://back.engineering/blog/31/07/2026/
🎖@malwr
aftermathlabs.net
Static Devirtualization of Tencent VM
Over the course of several months we have noticed an increased interest in Tencent VM obfuscation. We have had complete static devirtualization of this VM obfuscation for quite some time now and have noticed others have achieved similar deobfuscation results.
🔥1
Inside the Falcon How CrowdStrike Catches You
A full reverse-engineering teardown of the CrowdStrike Falcon sensor: the six kernel callback sources, the WFP network engine, the file-system minifilter, the cspcm4 broker, the user-mode service (DNS / AMSI / browser / Identity Protection), and the cloud-loaded detection engine — plus every structural blind spot. How Falcon sees you, and where the seams are.
https://0xdbgman.github.io/posts/inside-the-falcon-how-crowdstrike-catches-you/
🎖@malwr
A full reverse-engineering teardown of the CrowdStrike Falcon sensor: the six kernel callback sources, the WFP network engine, the file-system minifilter, the cspcm4 broker, the user-mode service (DNS / AMSI / browser / Identity Protection), and the cloud-loaded detection engine — plus every structural blind spot. How Falcon sees you, and where the seams are.
https://0xdbgman.github.io/posts/inside-the-falcon-how-crowdstrike-catches-you/
🎖@malwr
DbgMan
Inside the Falcon How CrowdStrike Catches You
A full reverse-engineering teardown of the CrowdStrike Falcon sensor: the six kernel callback sources, the WFP network engine, the file-system minifilter, the cspcm4 broker, the user-mode service (DNS / AMSI / browser / Identity Protection), and the cloud…
Turning Chrome Remote Desktop into Pure Red Team Ops
How to hide the Chrome Remote Desktop connection banner by patching a single dialog resource, then abuse host.json and MSI packaging to turn CRD into a quiet persistent access channel.
https://zerotracelab.com/blog/chrome-remote-desktop-red-ops
🎖@malwr
How to hide the Chrome Remote Desktop connection banner by patching a single dialog resource, then abuse host.json and MSI packaging to turn CRD into a quiet persistent access channel.
https://zerotracelab.com/blog/chrome-remote-desktop-red-ops
🎖@malwr
Zerotracelab
Turning Chrome Remote Desktop into Pure Red Team Ops
How to hide the Chrome Remote Desktop connection banner by patching a single dialog resource, then abuse host.json and MSI packaging to turn CRD into a quiet persistent access channel.
JoasASantos/NeuroPurple: The AI Autonomous SOC & Purple-Team Engine
https://github.com/JoasASantos/NeuroPurple
🎖@malwr
https://github.com/JoasASantos/NeuroPurple
🎖@malwr
❤1
oldwalls/pyghidra-PAL: A defensive decompilation layer: Ghidra facts, lifted into runnable Python & artifacts aiding analysis.
https://github.com/oldwalls/pyghidra-PAL
🎖@malwr
https://github.com/oldwalls/pyghidra-PAL
🎖@malwr
GitHub
GitHub - oldwalls/pyghidra-PAL: A defensive decompilation layer: Ghidra facts, lifted into runnable Python & artifacts aiding analysis.
A defensive decompilation layer: Ghidra facts, lifted into runnable Python & artifacts aiding analysis. - oldwalls/pyghidra-PAL
aelassas/servy: Professional-Grade Windows Service Wrapper with Real-Time Monitoring
https://github.com/aelassas/servy
🎖@malwr
https://github.com/aelassas/servy
Servy lets you run any app as a native Windows service with full control over the working directory, startup type, process priority, CPU affinity, logging, health checks, environment variables, dependencies, pre-launch and post-launch hooks, pre-stop and post-stop hooks, and parameters.
🎖@malwr
GitHub
GitHub - aelassas/servy: Enterprise-Grade Windows Service Wrapper with Real-Time Monitoring
Enterprise-Grade Windows Service Wrapper with Real-Time Monitoring - aelassas/servy
winterknife/PLATINUMPICK: Windows Kernel-Mode Shellcode Development Framework (WKMSDF)
https://github.com/winterknife/PLATINUMPICK
🎖@malwr
https://github.com/winterknife/PLATINUMPICK
🎖@malwr
GitHub
GitHub - winterknife/PLATINUMPICK: Windows Kernel-Mode Shellcode Development Framework (WKMSDF)
Windows Kernel-Mode Shellcode Development Framework (WKMSDF) - winterknife/PLATINUMPICK
ioallocate/Ira: Ira - Interactive Reverser Analyzation is a POC of detecting Software Debuggers trough Machine Learning.
https://github.com/ioallocate/Ira
🎖@malwr
https://github.com/ioallocate/Ira
🎖@malwr
GitHub
GitHub - ioallocate/Cinnamon: Cinnamon is a POC of detecting Software Debuggers trough Machine Learning.
Cinnamon is a POC of detecting Software Debuggers trough Machine Learning. - ioallocate/Cinnamon
NHCM-dev/BytecodeVM: Obfuscator obfuscate using pure java bytecode virtual machine to interpret mutated java bytecodes of original java program.
https://github.com/NHCM-dev/BytecodeVM
🎖@malwr
https://github.com/NHCM-dev/BytecodeVM
🎖@malwr
GitHub
GitHub - NHCM-dev/BytecodeVM: Obfuscator obfuscate using pure java bytecode virtual machine to interpret mutated java bytecodes…
Obfuscator obfuscate using pure java bytecode virtual machine to interpret mutated java bytecodes of original java program. - NHCM-dev/BytecodeVM
Oros42/IMSI-catcher: This program show you IMSI numbers of cellphones around you.
https://github.com/Oros42/IMSI-catcher
🎖@malwr
https://github.com/Oros42/IMSI-catcher
🎖@malwr
GitHub
GitHub - Oros42/IMSI-catcher: This program show you IMSI numbers of cellphones around you.
This program show you IMSI numbers of cellphones around you. - Oros42/IMSI-catcher
VMMap Basics: How to Read a Windows Process's Memory Layout » TrainSec
Pavel Yosifovich uses VMMap to break down a process's memory layout, for developers and researchers who want to see what memory a process really uses.
https://trainsec.net/library/windows-internals/vmmap-basics-how-to-read-a-windows-processs-memory-layout/
🎖@malwr
Pavel Yosifovich uses VMMap to break down a process's memory layout, for developers and researchers who want to see what memory a process really uses.
https://trainsec.net/library/windows-internals/vmmap-basics-how-to-read-a-windows-processs-memory-layout/
🎖@malwr
TrainSec - CyberSecurity online training
VMMap Basics: How to Read a Windows Process's Memory Layout » TrainSec
Pavel Yosifovich uses VMMap to break down a process's memory layout, for developers and researchers who want to see what memory a process really uses.
Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon
Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.
https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon
🎖@malwr
Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.
https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon
🎖@malwr
hunt.io
Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon
Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.
gavamedia/deltafin: Run full Kimi K3 on a single device. And an OpenAI-compatible API server for local chat and coding agents.
https://github.com/gavamedia/deltafin
🎖@malwr
https://github.com/gavamedia/deltafin
🎖@malwr
GitHub
GitHub - gavamedia/deltafin: Run full Kimi K3 on a single device. And an OpenAI-compatible API server for local chat and coding…
Run full Kimi K3 on a single device. And an OpenAI-compatible API server for local chat and coding agents. - gavamedia/deltafin
OctLurk and SilkLurk: new Backdoors in Central Asia
Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.
https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/
🎖@malwr
Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.
https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/
🎖@malwr
ENISA Secure by Design and Default Playbook | ENISA
ENISA is the EU agency dedicated to enhancing cybersecurity in Europe. They offer guidance, tools, and resources to safeguard citizens and businesses from cyber threats.
https://www.enisa.europa.eu/publications/enisa-secure-by-design-and-default-playbook
https://www.enisa.europa.eu/sites/default/files/2026-07/ENISA_Secure_By_Design_and_Default_Playbook_v1.pdf
🎖@malwr
ENISA is the EU agency dedicated to enhancing cybersecurity in Europe. They offer guidance, tools, and resources to safeguard citizens and businesses from cyber threats.
https://www.enisa.europa.eu/publications/enisa-secure-by-design-and-default-playbook
https://www.enisa.europa.eu/sites/default/files/2026-07/ENISA_Secure_By_Design_and_Default_Playbook_v1.pdf
🎖@malwr
cellebrite-labs/ida-bridge: Bridge between agents and IDA Pro.
https://github.com/cellebrite-labs/ida-bridge
🎖@malwr
https://github.com/cellebrite-labs/ida-bridge
🎖@malwr
GitHub
GitHub - cellebrite-labs/ida-bridge: Bridge between agents and IDA Pro.
Bridge between agents and IDA Pro. Contribute to cellebrite-labs/ida-bridge development by creating an account on GitHub.
❤1
bl4ckr0ss3/argus-vr-agent: Autonomous malware analysis + rootkit/bootkit forensics: detonate → triangulated verdict (behavior + YARA + VirusTotal) → auto-generated detection. Pure-Python, human-gated, tested.
https://github.com/bl4ckr0ss3/argus-vr-agent
🎖@malwr
https://github.com/bl4ckr0ss3/argus-vr-agent
🎖@malwr
GitHub
GitHub - bl4ckr0ss3/argus-vr-agent: Autonomous malware analysis + rootkit/bootkit forensics: detonate → triangulated verdict (behavior…
Autonomous malware analysis + rootkit/bootkit forensics: detonate → triangulated verdict (behavior + YARA + VirusTotal) → auto-generated detection. Pure-Python, human-gated, tested. - bl4ckr0ss3/ar...
0xMR007/Lab4PurpleSec: Lab4PurpleSec is a modular Purple Team homelab combining a vulnerable Active Directory environment (GOAD), a Docker-based web DMZ, pfSense + Suricata, and a Wazuh SIEM. It provides a realistic, open-source training environment for web exploitation, pivoting, Active Directory attacks, and Blue Team detection.
https://github.com/0xMR007/Lab4PurpleSec
🎖@malwr
https://github.com/0xMR007/Lab4PurpleSec
🎖@malwr
GitHub
GitHub - 0xMR007/Lab4PurpleSec: Lab4PurpleSec is a modular Purple Team homelab combining a vulnerable Active Directory environment…
Lab4PurpleSec is a modular Purple Team homelab combining a vulnerable Active Directory environment (GOAD), a Docker-based web DMZ, pfSense + Suricata, and a Wazuh SIEM. It provides a realistic, ope...