Day 29 #100DaysofYARA using maths; counting the number of resources in a PE that have MZ headers!

I can only count to 5 on one hand so thats why the counter went this high

https://github.com/g-les/100DaysofYARA/blob/main/100_days_of_yara.yar
🗣greglesnewich


🎖@malwr

Process Hollowing Alert is now in #SIGMA.

Sysmon Event ID 25 with a type of “image is replaced”
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_process_hollowing.yml
🗣SecurePeacock


🎖@malwr

Stop Windows Defender programmatically
https://github.com/lab52io/StopDefender
🗣pentest_swissky


🎖@malwr

I published a set of Python scripts that I use to integrate @dfir_iris , @MISPProject and @TimesketchProj #DFIR #CSIRT https://github.com/cudeso/dfir-iris-misp-timesketch
🗣cudeso


🎖@malwr

#MalwareAnalysis: Detecting Process Hollowing
The first pattern to look for are any calls to create processes in a suspended state:

> CreateProcessA
"dwCreationFlags" set 0x04 CREATE_SUSPENDED

Purpose is to disguise malicious code in a legit exe by replacing the contents.

Following the process being started in a suspended state... (usually svchost.exe but who's counting). Then there are API calls to native/non native APIs:

> ZwUnmapviewofsection
> virtualallocex
> writeprocessmemory
> setthreadcontext
> NTgetcontextthread
> ntreadvirtualmemory

Other ones:
> NTResumethread
> NTwritevirtualmemory
> ntsetcontextthread

The logic is to look for signs of processes being started in suspended state - then the process being hollowed, replaced with "malicious" contents and resuming of execution.

🗣inversecos


🎖@malwr

Driver loader for bypassing Windows x64 Driver Signature Enforcement. #Hack #108 (2016)
https://github.com/hfiref0x/TDL
🗣OPOSEC


🎖@malwr

Have you noticed that IDA sometimes renames and marks up local variables automatically? Read up on how Parameter identification and tracking aka PIT works:

https://hex-rays.com/blog/igors-tip-of-the-week-74-parameter-identification-and-tracking-pit/

#IgorsTipOfTheWeek #IDAtips #IDAPro
🗣HexRaysSA


🎖@malwr

I wrote a C++ library to parse Windows minidumps (.dump /mx) for another project; go check it out 🙏🏽!
https://github.com/0vercl0k/udmp-parser/
🗣0vercl0k


🎖@malwr

As a YuGiOh fan I couldn't resist reverse engineering the new "Master Duel" game :)

I used Cpp2Il to generate the C# DLL and used the symbols to import the functions into GameAssembly.dll.

If you want to tag along, here's my current 1.0.1 script: https://github.com/ioncodes/master-duel
🗣layle_ctf


🎖@malwr

Curious how to dump the WhisperGate wiper? This blog provides a step-by-step analysis, and shows how to load the third stage, since the original URL does not contain the payload anymore.

Link: https://maxkersten.nl/binary-analysis-course/malware-analysis/dumping-whispergates-wiper-from-an-eazfuscator-obfuscated-loader/

ℹ️ Sent from one of our channel members


🎖@malwr

RonnieColemanYARAParser is a script that uses YARA's upcoming console module to bulk extract arbitrary features from files and jam them in a table for quick analysis. Have fun, but keep in mind it's an experiment. #100DaysofYARA
https://github.com/stvemillertime/RonnieColemanYARAParser
🗣stvemillertime


🎖@malwr

Releasing My first repo in months, using thread description to hide the shellcode, xor encryption, thread stack spoofing, and more ...
#bypassav #cobaltstrike #imbacm
https://github.com/ORCA666/T.D.P
🗣ORCA6665


🎖@malwr

released another poc on KernelCallbackTable hijacking to run your shellcode, inspired by this paper here: https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
the repo can be found here:
https://github.com/ORCA666/KCTHIJACK
#bypassav #shellcode #poc

🗣ORCA6665


🎖@malwr

Mandiant's FLARE team is hiring malware reverse engineers!

https://jobs.smartrecruiters.com/Mandiant/743999802041669
🗣mrdurakovich


🎖@malwr

EvilSelenium - This project weaponizes Selenium to attack Chrome. Dump saved credentials, cookies, take (authenticated) screenshots, dump emails from gmail/o365 or chats from Whatsapp and exfiltrate & download files. ENJOY.
https://github.com/mrd0x/EvilSelenium
🗣mrd0x


🎖@malwr

I did a bit of research and learning and have blogged about it an released some code. I wanted to understand Nirvana Hooks, specifically in x86. So I did a thing:
https://blog.xenoscr.net/2022/01/17/x86-Nirvana-Hooks.html
🗣xenosCR


🎖@malwr