Had some free time lately due to covid isolation, so I thought why not write something?
This is my new article about #BazarLoader. Similar to my previous articles, this writeup is a hybrid between a presentation and a step-by-step tutorial.
https://elis531989.medium.com/highway-to-conti-analysis-of-bazarloader-26368765689d
🗣elisalem9
🎖@malwr
This is my new article about #BazarLoader. Similar to my previous articles, this writeup is a hybrid between a presentation and a step-by-step tutorial.
https://elis531989.medium.com/highway-to-conti-analysis-of-bazarloader-26368765689d
🗣elisalem9
🎖@malwr
Medium
Highway to Conti: Analysis of Bazarloader
As we look back to summarize the year 2021 we observe that the biggest threat in the cybersecurity landscape is still ransomware. A large…
You can now install and run latest r2, rax2 and rasm2 in your browser or terminal thanks to webassembly! (no disk or network access, it's a sandbox! (use pc* and terminal paste to load binaries) https://wapm.io/package/pancake/r2#shell
🗣radareorg
🎖@malwr
🗣radareorg
🎖@malwr
Analyzing an IDA Pro anti-decompilation code
https://antonioparata.blogspot.com/2022/01/analyzing-ida-pro-anti-decompilation.html
🗣reverseame
🎖@malwr
https://antonioparata.blogspot.com/2022/01/analyzing-ida-pro-anti-decompilation.html
🗣reverseame
🎖@malwr
Blogspot
Analyzing an IDA Pro anti-decompilation code
Twitter: @s4tan GitHub: https://github.com/enkomio/ In this post I'll analyze a piece of code that induces IDA Pro to decompile t...
IDA Free has been upgraded to the latest IDA version 7.7SP1!
This light but powerful tool can quickly analyze the binary code samples and allow users to take a closer look at the results.
Try it out for free https://hex-rays.com/ida-free/
#IDAFreeware #Binaryanalysis #HexRays
🗣HexRaysSA
🎖@malwr
This light but powerful tool can quickly analyze the binary code samples and allow users to take a closer look at the results.
Try it out for free https://hex-rays.com/ida-free/
#IDAFreeware #Binaryanalysis #HexRays
🗣HexRaysSA
🎖@malwr
🔥1
Woop Woop, good day for #CTI. @MISPProject released v2.4.153 with a lot of fixes and extra features. These new taxonomies are very interesting for state attribution ( and intrusion modeling ( See 👏💯
https://www.misp-project.org/taxonomies.html#_state_responsibility
🗣digihash
🎖@malwr
https://www.misp-project.org/taxonomies.html#_state_responsibility
🗣digihash
🎖@malwr
Fuzzing sockets: Apache HTTP, Part 3: Results
https://securitylab.github.com/research/fuzzing-apache-3/
🗣kmkz_security
🎖@malwr
https://securitylab.github.com/research/fuzzing-apache-3/
🗣kmkz_security
🎖@malwr
I wrote a Binary Ninja UI plugin for exploring Structured Exception Handlers in PEs today
https://github.com/EliseZeroTwo/SEH-Helper
🗣EliseZeroTwo
🎖@malwr
https://github.com/EliseZeroTwo/SEH-Helper
🗣EliseZeroTwo
🎖@malwr
RE tip of the day: Resolving imports in IDA and notice that for ntdll there are no API names? Save the resolved addresses with "Debugger->Take memory snapshot" and manually load ntdll.dll to the same base using pe_dlls.idc: https://buff.ly/34LlfAX
#infosec #cybersecurity #malware
🗣re_and_more
🎖@malwr
#infosec #cybersecurity #malware
🗣re_and_more
🎖@malwr
This media is not supported in your browser
VIEW IN TELEGRAM
Puzzled why a yara rule did or didn't match?
Let me introduce http://yaradbg.dev, a web-based #yara #debugger!
With #YaraDbg, you can see the:
1⃣ evaluation steps
2⃣ matched strings
3⃣ relationship among the rules
🗣DissectMalware
🎖@malwr
Let me introduce http://yaradbg.dev, a web-based #yara #debugger!
With #YaraDbg, you can see the:
1⃣ evaluation steps
2⃣ matched strings
3⃣ relationship among the rules
🗣DissectMalware
🎖@malwr
👍1
Quick blog tonight on a #Monzo and #Revolut bank #phishing campaign targeting digital-only mobile users
https://blog.bushidotoken.net/2022/02/mobile-banking-phishing-campaign.html
🗣BushidoToken
🎖@malwr
https://blog.bushidotoken.net/2022/02/mobile-banking-phishing-campaign.html
🗣BushidoToken
🎖@malwr
Blog: Detecting Karakurt – an extortion focused threat actor by NCC Group's Cyber Incident Response Team members - Simon Biggs, Richard Footman and Michael Mullen -
https://research.nccgroup.com/2022/02/17/detecting-karakurt-an-extortion-focused-threat-actor/ #Karakurt
🗣NCCGroupInfosec
🎖@malwr
https://research.nccgroup.com/2022/02/17/detecting-karakurt-an-extortion-focused-threat-actor/ #Karakurt
🗣NCCGroupInfosec
🎖@malwr
I wrote API hook for simple Windows 10 x86 using Capstone engine 🎃
https://github.com/CaptanMoss/API-Hooking-on-Windows10
🗣ereborlugimli
🎖@malwr
https://github.com/CaptanMoss/API-Hooking-on-Windows10
🗣ereborlugimli
🎖@malwr
GitHub
GitHub - CaptanMoss/API-Hooking-on-Windows10: API Hooking on Windows 10
API Hooking on Windows 10. Contribute to CaptanMoss/API-Hooking-on-Windows10 development by creating an account on GitHub.
Added 2 PoCs for HackSys Extreme Vulnerable Driver to KernelWritePoCs.
One tries to get SYSTEM with SeCreateTokenPrivilege.
The other tries to get SYSTEM by secondary logon feature with SeCreateTokenPrivilege and SeImpersonatePrivilege.
https://github.com/daem0nc0re/PrivFu#KernelWritePoCs
🗣daem0nc0re
🎖@malwr
One tries to get SYSTEM with SeCreateTokenPrivilege.
The other tries to get SYSTEM by secondary logon feature with SeCreateTokenPrivilege and SeImpersonatePrivilege.
https://github.com/daem0nc0re/PrivFu#KernelWritePoCs
🗣daem0nc0re
🎖@malwr
Our software engineer Boyan Milanov introduces Maat, a low-level symbolic execution framework based on Ghidra's IR language p-code.
https://blog.trailofbits.com/2022/02/23/maat-symbolic-execution-made-easy/
🗣trailofbits
🎖@malwr
https://blog.trailofbits.com/2022/02/23/maat-symbolic-execution-made-easy/
🗣trailofbits
🎖@malwr
The Trail of Bits Blog
Maat: Symbolic execution made easy
We have released Maat, a cross-architecture, multi-purpose, and user-friendly symbolic execution framework. It provides common symbolic execution capabilities such as dynamic symbolic execution (DSE), taint analysis, binary instrumentation, environment simulation…
Windows Drivers Reverse Engineering Methodology : credits @Void_Sec
https://voidsec.com/windows-drivers-reverse-engineering-methodology/
🗣binitamshah
🎖@malwr
https://voidsec.com/windows-drivers-reverse-engineering-methodology/
🗣binitamshah
🎖@malwr
VoidSec
Windows Drivers Reverse Engineering Methodology
Methodology for reverse engineering Windows drivers, finding vulnerabilities and understanding their exploitability.
MISC study notes about ARM AArch64 Assembly and the ARM Trusted Execution Environment (TEE) : credits @0xricksanchez
Ref : Dissecting and exploiting ELF files :
https://0x434b.dev/misc-study-notes-about-arm-aarch64-assembly-and-the-arm-trusted-execution-environment-tee/
🗣binitamshah
🎖@malwr
Ref : Dissecting and exploiting ELF files :
https://0x434b.dev/misc-study-notes-about-arm-aarch64-assembly-and-the-arm-trusted-execution-environment-tee/
🗣binitamshah
🎖@malwr
Low-level adventures
MISC study notes about ARM AArch64 Assembly and the ARM Trusted Execution Environment (TEE)
Disclaimer: These are unfiltered study notes mostly for myself. Guaranteed not to be error free. So if you did land here, managed to get to the end of it and found some mistakes just hit me up, I'd love to know what's wrong :)
AArch64 - Preface
Basic assembly…
AArch64 - Preface
Basic assembly…
Fuzz your Rust code with a Rust fuzzer using the new LibAFL cargo extension
https://github.com/AFLplusplus/cargo-libafl
🗣andreafioraldi
🎖@malwr
https://github.com/AFLplusplus/cargo-libafl
🗣andreafioraldi
🎖@malwr
GitHub
GitHub - AFLplusplus/cargo-libafl: Fuzz Rust code with LibAFL
Fuzz Rust code with LibAFL. Contribute to AFLplusplus/cargo-libafl development by creating an account on GitHub.
Faking a positive COVID Test : https://labs.f-secure.com/blog/faking-a-positive-covid-test credits @Yogehi
🗣binitamshah
🎖@malwr
🗣binitamshah
🎖@malwr
My #BinaryNinja plugin obfuscation_detection can now identify uncommon instruction sequences (such as MBAs or weird calculations) based on stochastic n-gram analysis. Right now the feature works for x86-64; an architecture-agnostic version follows soon.
https://github.com/mrphrazer/obfuscation_detection/
🗣mr_phrazer
🎖@malwr
https://github.com/mrphrazer/obfuscation_detection/
🗣mr_phrazer
🎖@malwr