Well, Sentinel1 is the first EDR I've seen doing this. The whole Export Address Table (EAT) is modified in memory for kernel32.dll and not just the WinAPI calls. So, if you are trying to parse kernel32 to find any export function, you will be forever stuck in a loop... lol! 🤣🤣
🗣NinjaParanoid


🎖@malwr

Best python libraries for Cybersecurity
🗣LetsDefendIO


🎖@malwr

Sharing something I have written lately.
#redteam #maldev
https://captmeelo.com/redteam/maldev/2022/02/16/libraries-for-maldev.html
🗣CaptMeelo


🎖@malwr

Had some free time lately due to covid isolation, so I thought why not write something?
This is my new article about #BazarLoader. Similar to my previous articles, this writeup is a hybrid between a presentation and a step-by-step tutorial.
https://elis531989.medium.com/highway-to-conti-analysis-of-bazarloader-26368765689d
🗣elisalem9


🎖@malwr

You can now install and run latest r2, rax2 and rasm2 in your browser or terminal thanks to webassembly! (no disk or network access, it's a sandbox! (use pc* and terminal paste to load binaries) https://wapm.io/package/pancake/r2#shell
🗣radareorg


🎖@malwr

Analyzing an IDA Pro anti-decompilation code
https://antonioparata.blogspot.com/2022/01/analyzing-ida-pro-anti-decompilation.html
🗣reverseame


🎖@malwr

IDA Free has been upgraded to the latest IDA version 7.7SP1!
This light but powerful tool can quickly analyze the binary code samples and allow users to take a closer look at the results.
Try it out for free https://hex-rays.com/ida-free/

#IDAFreeware #Binaryanalysis #HexRays
🗣HexRaysSA


🎖@malwr

Woop Woop, good day for #CTI. @MISPProject released v2.4.153 with a lot of fixes and extra features. These new taxonomies are very interesting for state attribution ( and intrusion modeling ( See 👏💯
https://www.misp-project.org/taxonomies.html#_state_responsibility
🗣digihash


🎖@malwr

Fuzzing sockets: Apache HTTP, Part 3: Results
https://securitylab.github.com/research/fuzzing-apache-3/
🗣kmkz_security


🎖@malwr

I wrote a Binary Ninja UI plugin for exploring Structured Exception Handlers in PEs today

https://github.com/EliseZeroTwo/SEH-Helper
🗣EliseZeroTwo


🎖@malwr

RE tip of the day: Resolving imports in IDA and notice that for ntdll there are no API names? Save the resolved addresses with "Debugger->Take memory snapshot" and manually load ntdll.dll to the same base using pe_dlls.idc: https://buff.ly/34LlfAX
#infosec #cybersecurity #malware
🗣re_and_more


🎖@malwr

Puzzled why a yara rule did or didn't match?

Let me introduce http://yaradbg.dev, a web-based #yara #debugger!

With #YaraDbg, you can see the:
1⃣ evaluation steps
2⃣ matched strings
3⃣ relationship among the rules
🗣DissectMalware


🎖@malwr

Quick blog tonight on a #Monzo and #Revolut bank #phishing campaign targeting digital-only mobile users

https://blog.bushidotoken.net/2022/02/mobile-banking-phishing-campaign.html
🗣BushidoToken


🎖@malwr

Blog: Detecting Karakurt – an extortion focused threat actor by NCC Group's Cyber Incident Response Team members - Simon Biggs, Richard Footman and Michael Mullen -
https://research.nccgroup.com/2022/02/17/detecting-karakurt-an-extortion-focused-threat-actor/ #Karakurt
🗣NCCGroupInfosec


🎖@malwr

I wrote API hook for simple Windows 10 x86 using Capstone engine 🎃
https://github.com/CaptanMoss/API-Hooking-on-Windows10
🗣ereborlugimli


🎖@malwr

Our software engineer Boyan Milanov introduces Maat, a low-level symbolic execution framework based on Ghidra's IR language p-code.
https://blog.trailofbits.com/2022/02/23/maat-symbolic-execution-made-easy/
🗣trailofbits


🎖@malwr

Windows Drivers Reverse Engineering Methodology : credits @Void_Sec
https://voidsec.com/windows-drivers-reverse-engineering-methodology/
🗣binitamshah


🎖@malwr

MISC study notes about ARM AArch64 Assembly and the ARM Trusted Execution Environment (TEE) : credits @0xricksanchez

Ref : Dissecting and exploiting ELF files :
https://0x434b.dev/misc-study-notes-about-arm-aarch64-assembly-and-the-arm-trusted-execution-environment-tee/
🗣binitamshah


🎖@malwr

Fuzz your Rust code with a Rust fuzzer using the new LibAFL cargo extension
https://github.com/AFLplusplus/cargo-libafl
🗣andreafioraldi


🎖@malwr