Malware wrapped in Cyberpunk 2077
🗣f474m0r64n4

And this is why that walled garden works!

Edit: and this is why we iOS users don’t need third party stores or the ability to side load just by clicking a link
👤AndreiD2017


🎖@malwr

Emotet Returns to Hit 100K Mailboxes Per Day
🗣DrinkMoreCodeMore

How wholesome, dropping Christmas presents!
👤PM_CUTE_PUSSY


🎖@malwr

HalMakeBeep - Reversing A Tiny Built-In Windows Kernel Module [Journey from Kernel32 to HAL](http://www.debasish.in/2014/02/reversing-tiny-built-in-windows-kernel.html)
🗣doctorstyles


🎖@malwr

New to defending? Short series of videos following a cyber attack start to finish.
8 videos under 5 minutes each which demonstrate a basic cyber attack from creating the phishing email, through to gaining persistence. The videos aren't sexy, but should be good if you are just starting out, and want some basic knowledge on what you should be looking out for.

https://blog.2code-monte.co.uk/2020/09/26/making-a-malicious-word-document-part-1-dde-vulnerability-feature/
🗣2codemonte

!remindme 20 hours
👤plamatonto

Cool
👤CallumIsCool69

Is this 2001, where 10 year olds made youtube videos with only notepad?
👤RegularAlicorn


🎖@malwr

SUNBURST Additional Technical Details
🗣0write

Additional information from FireEye regarding the SUNBURST malware. Some new, some already reported on and analyzed by other security companies.
👤0write


🎖@malwr

Recaf 2.X: The modern Java bytecode reversing tool
🗣PartOfTheBotnet

Looks really nice will have to try it out!
👤j_rapp

Hello again /r/ReverseEngineering its been over a year since I last shared my pet project, Recaf. Since then it has been almost completely re-written and is continues to make improvements upon what a reversing tool should provide.

2.X aims to make reverse engineering as user friendly as possible. How so? Here's the gist:

1. Automatic compiler integration
- Dependencies pulled from your current workspace (primary file plus any libraries)
- Can't find a dependency? Don't worry, Recaf will dynamically generate missing code for you via JPhantom. That's right, you don't even need to specify your missing compile dependencies.
2. Text based bytecode assembler with user friendly features
- Reference variables not by their index but by their source-code name for maximum legibility
- Write short bytecode snippets as plain old Java source code, Recaf will translate inline expressions for you
- See what values are on the stack and in your local variables at any point by selecting the line
- Verify all your modifications on the fly to prevent time-wasting mistakes
3. Multiple class representations, defaulting to decompiled code
- View the class in one of 3 decompilers, CFR, FernFlower, or Procyon
- Context sensitive right-click actions on source code elements
- Automatically suggest switching decompilers when errors occur in current one
- Code too obfuscated? Change the class representation to a table to show fields, methods, and class attributes in an organized table while retaining all the context sensitive menu actions
4. Highly configurable search
- Search for string constants by containment, equality, starts-with, ends-with, or regex
- You can do the same search types with member references
- You can also do the same for disassembled instruction text
5. Track changes per each class modified with the ability to revert to a prior state at any time
6. Apply mappings to an obfuscated file from a variety of popular mapping formats
7. Drag tabs to other windows for duplicate views that can be swapped out (Compare decompilers, switch one tab to table mode, etc)

More info on the documentation page: https://www.coley.software/Recaf-documentation/

And beyond those points, there's a lot more planned for the future.

I'm always looking for suggestions and bug reports, so do feel free to drop a comment.

Happy reversing and merry Christmas o/
👤PartOfTheBotnet


🎖@malwr

Various Visual Basic Macros-based Remote Code Execution techniques to get meterpreter invoked on the infected machine.
🗣digicat

It blows my mind that macros are still enabled by default.

A while back I walked into an organisation that had ongoing issues with ransomware. They got to call it "ransomware Friday" because of how common it was. They haven't had an incident in three years and I made the only change they had budget for - disable macros by GPO.
👤disclosure5


🎖@malwr