RE tip of the day: UPX structures are publically available, for example, https://buff.ly/3uAYU3L The most common ways how IoT malware authors modify them in samples is changing l_magic (UPX! signature) and p_filesize and p_blocksize fields
#infosec #malware #reverseengineering
🗣re_and_more
🎖@malwr
#infosec #malware #reverseengineering
🗣re_and_more
🎖@malwr
❤1
termshark: A terminal UI for tshark, inspired by Wireshark
⭐️ 6980
#golang
https://github.com/gcla/termshark
🗣GolangRepos
🎖@malwr
⭐️ 6980
#golang
https://github.com/gcla/termshark
🗣GolangRepos
🎖@malwr
GitHub
GitHub - gcla/termshark: A terminal UI for tshark, inspired by Wireshark
A terminal UI for tshark, inspired by Wireshark. Contribute to gcla/termshark development by creating an account on GitHub.
New blog post about analyzing a stealer distributed via MSI files! S/O to @MSAdministrator for helping me improve my MSI analysis game in a big way:
#malware #stealer #msi #msitools
https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/
🗣ForensicITGuy
🎖@malwr
#malware #stealer #msi #msitools
https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/
🗣ForensicITGuy
🎖@malwr
Tony Lambert
Analyzing a Stealer MSI using msitools
This post is dedicated to Josh Rickard (@MSAdministrator on Twitter) since his feedback on my blog posts has cut my triage time on MSI files down in a massive way! After writing an analysis of a MSI payload distributing njRAT, Josh hit me up on Twitter to…
Abusing LNK "Features" for Initial Access and Persistence
#infosec #redteam #pentest
https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
🗣CyberWarship
🎖@malwr
#infosec #redteam #pentest
https://v3ded.github.io/redteam/abusing-lnk-features-for-initial-access-and-persistence
🗣CyberWarship
🎖@malwr
VMProtect Devirtualization: An experimental dynamic approach to devirtualize pure functions protected by VMProtect 3.x
https://github.com/JonathanSalwan/VMProtect-devirtualization
🗣JonathanSalwan
🎖@malwr
https://github.com/JonathanSalwan/VMProtect-devirtualization
🗣JonathanSalwan
🎖@malwr
GitHub
GitHub - JonathanSalwan/VMProtect-devirtualization: Playing with the VMProtect software protection. Automatic deobfuscation of…
Playing with the VMProtect software protection. Automatic deobfuscation of pure functions using symbolic execution and LLVM. - JonathanSalwan/VMProtect-devirtualization
👍1
CinaRAT via HTML IDs; Protecting LSASS; Blocking Facebook Credential Exposure
https://i5c.us/p7878
🗣sans_isc
🎖@malwr
https://i5c.us/p7878
🗣sans_isc
🎖@malwr
Custom ReadMemory API x64 bit after @x86matthew's cool blogpost.
https://trickster0.github.io/posts/Custom-ReadMemory-API/
🗣trickster012
🎖@malwr
https://trickster0.github.io/posts/Custom-ReadMemory-API/
🗣trickster012
🎖@malwr
trickster0’s Nest
Custom ReadMemory API
After the great job and inspiration by x86matthew and his blogpost I decided to play with it as well for x64 bit. The NTAPI function in this method is RtlFirstEntrySList from ntdll.dll. Its definition like Matthew mentioned in his blog is similar like this:…
TECHNICAL MALWARE ANALYSIS: THE RETURN OF EMOTET
https://notes.netbytesec.com/2022/02/technical-malware-analysis-return-of.html
🗣RempahRz
🎖@malwr
https://notes.netbytesec.com/2022/02/technical-malware-analysis-return-of.html
🗣RempahRz
🎖@malwr
Netbytesec
Technical Malware Analysis: The return of Emotet
This post was authored by Taqi, Rosamira and Fareed. Overview NetbyteSEC malware analyst team has come across a Microsoft Excel document con...
So the first part of the blog post on OneDrive Logs (ODL) is finally posted, and so is the python script to parse it! 👇
and
https://www.swiftforensics.com/2022/02/reading-onedrive-logs.html
🗣SwiftForensics
🎖@malwr
and
https://www.swiftforensics.com/2022/02/reading-onedrive-logs.html
🗣SwiftForensics
🎖@malwr
Swiftforensics
Reading OneDrive Logs
Due to the popularity of OneDrive, it has become an important source of evidence in forensics. Last week, Brian Maloney posted about his res...
👍1
🎉5😁2🤯1
frida typescript trick : if you want to hook functions with reserverd names such as toString(), encode the string and get function with [""]
Instead of jsonObj.toString.implementation
use jsonObj[b64decode("dG9TdHJpbmc=")]
:D
🗣0xabc0
🎖@malwr
Instead of jsonObj.toString.implementation
use jsonObj[b64decode("dG9TdHJpbmc=")]
:D
🗣0xabc0
🎖@malwr
My write up for CVE-2021-43893, a vulnerability that allowed a remote attacker to upload files to a Domain Controller, just got posted 😍
https://www.rapid7.com/blog/post/2022/02/14/dropping-files-on-a-domain-controller-using-cve-2021-43893/
🗣Junior_Baines
🎖@malwr
https://www.rapid7.com/blog/post/2022/02/14/dropping-files-on-a-domain-controller-using-cve-2021-43893/
🗣Junior_Baines
🎖@malwr
Rapid7
Dropping Files on a Domain Controller Using CVE-2021-43893 | Rapid7 Blog
BigQuery SQL Injection Cheat Sheet
https://ozguralp.medium.com/bigquery-sql-injection-cheat-sheet-65ad70e11eac
🗣tbbhunter
🎖@malwr
https://ozguralp.medium.com/bigquery-sql-injection-cheat-sheet-65ad70e11eac
🗣tbbhunter
🎖@malwr
Medium
BigQuery SQL Injection Cheat Sheet
Last year, we (My researcher partner on this topic, Anil and me) and found a SQL injection vulnerability on a target at Synack which was…
dronesploit : Drone pentesting framework console : https://github.com/dhondta/dronesploit credits @alex_dhondt
🗣binitamshah
🎖@malwr
🗣binitamshah
🎖@malwr
Interesting awesome list about PE/ELF/... packing
: credits @alex_dhondt
https://github.com/dhondta/awesome-executable-packing
🗣binitamshah
🎖@malwr
: credits @alex_dhondt
https://github.com/dhondta/awesome-executable-packing
🗣binitamshah
🎖@malwr
GitHub
GitHub - packing-box/awesome-executable-packing: A curated list of awesome resources related to executable packing
A curated list of awesome resources related to executable packing - packing-box/awesome-executable-packing
👍1
We have a Valentine’s Day surprise for everyone - The first Kali Linux release of 2022 is posted and ready for download!
https://www.kali.org/blog/kali-linux-2022-1-release/
Included in this release is:
Visual Refresh
New Kali Everything Image
Legacy SSH support
Accessibility Features
& More!
🗣kalilinux
🎖@malwr
https://www.kali.org/blog/kali-linux-2022-1-release/
Included in this release is:
Visual Refresh
New Kali Everything Image
Legacy SSH support
Accessibility Features
& More!
🗣kalilinux
🎖@malwr
👍1
Have Linux dev skills and want to work on Sysinternals tools for Linux?
https://careers.microsoft.com/us/en/job/1260200
🗣markrussinovich
🎖@malwr
https://careers.microsoft.com/us/en/job/1260200
🗣markrussinovich
🎖@malwr