I wrote a C++ library to parse Windows minidumps (.dump /mx) for another project; go check it out 🙏🏽!
https://github.com/0vercl0k/udmp-parser/
🗣0vercl0k


🎖@malwr

As a YuGiOh fan I couldn't resist reverse engineering the new "Master Duel" game :)

I used Cpp2Il to generate the C# DLL and used the symbols to import the functions into GameAssembly.dll.

If you want to tag along, here's my current 1.0.1 script: https://github.com/ioncodes/master-duel
🗣layle_ctf


🎖@malwr

Curious how to dump the WhisperGate wiper? This blog provides a step-by-step analysis, and shows how to load the third stage, since the original URL does not contain the payload anymore.

Link: https://maxkersten.nl/binary-analysis-course/malware-analysis/dumping-whispergates-wiper-from-an-eazfuscator-obfuscated-loader/

ℹ️ Sent from one of our channel members


🎖@malwr

RonnieColemanYARAParser is a script that uses YARA's upcoming console module to bulk extract arbitrary features from files and jam them in a table for quick analysis. Have fun, but keep in mind it's an experiment. #100DaysofYARA
https://github.com/stvemillertime/RonnieColemanYARAParser
🗣stvemillertime


🎖@malwr

Releasing My first repo in months, using thread description to hide the shellcode, xor encryption, thread stack spoofing, and more ...
#bypassav #cobaltstrike #imbacm
https://github.com/ORCA666/T.D.P
🗣ORCA6665


🎖@malwr

released another poc on KernelCallbackTable hijacking to run your shellcode, inspired by this paper here: https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
the repo can be found here:
https://github.com/ORCA666/KCTHIJACK
#bypassav #shellcode #poc

🗣ORCA6665


🎖@malwr

Mandiant's FLARE team is hiring malware reverse engineers!

https://jobs.smartrecruiters.com/Mandiant/743999802041669
🗣mrdurakovich


🎖@malwr

EvilSelenium - This project weaponizes Selenium to attack Chrome. Dump saved credentials, cookies, take (authenticated) screenshots, dump emails from gmail/o365 or chats from Whatsapp and exfiltrate & download files. ENJOY.
https://github.com/mrd0x/EvilSelenium
🗣mrd0x


🎖@malwr

I did a bit of research and learning and have blogged about it an released some code. I wanted to understand Nirvana Hooks, specifically in x86. So I did a thing:
https://blog.xenoscr.net/2022/01/17/x86-Nirvana-Hooks.html
🗣xenosCR


🎖@malwr

TIL.. want all images from a docx? Rename it .zip and extract the media folder.
🗣Jean_Maes_1994


🎖@malwr

Detect It Easy, or abbreviated "DIE" is a program for determining types of files.

3.04


#hacker #infosec #malware #hacking #programming #reversing #opensource #linux #linuxsecurity #unix #macos #detectiteasy #android #cybersecurity
https://github.com/horsicq/Detect-It-Easy
🗣horsicq


🎖@malwr

The second article of MAS (Malware Analysis Series) is available for reading! The PDF version (96 pages) can be downloaded from:

https://exploitreversing.com/2022/02/03/malware-analysis-series-mas-article-2/

Have an excellent day.

#malware #malwareanalysis #reverseengineering #programming #threathunting
🗣ale_sp_brazil


🎖@malwr

Published a new Repo Today, first one on gitlab ;) combining more than more tech to bypass av products:
u can check it here:
#bypassav #shellcode #payload
https://gitlab.com/ORCA666/3in1
🗣ORCA6665


🎖@malwr

Is it possible to start a process as SYSTEM using only CreateFile and WriteFile? Yes

Spoiler: Write a custom RPC client and create a temporary service using \\.\pipe\ntsvcs 🙂

https://www.x86matthew.com/view_post?id=create_svc_rpc
🗣x86matthew


🎖@malwr