Want to know from which source file line a specific instruction comes? With the right debug info, IDA can show you that 🌐 https://hex-rays.com/blog/igors-tip-of-the-week-130-source-line-numbers/?utm_source=Social-Media-Post&utm_medium=Twitter&utm_campaign=Igor-Tip-130

#IgorsTipOfTheWeek #IDAtips #IDAPro
🗣HexRaysSA


🎖@malwr

Here’s a tutorial on how to unpack Android APKs with the Medusa framework!

This is an alternative method of decoding using dynamic analysis rather than static analysis which I used in my previous video: Writing a Custom Android Decryptor in Java.

https://youtu.be/ffM5R2Wfl0A
🗣lauriewired


🎖@malwr

I have written a brief article explaining how compilation units matching work in #Diaphora:

https://github.com/joxeankoret/diaphora/blob/master/doc/articles/compilation_units.md
🗣matalaz


🎖@malwr

I just published my implementation of call stack spoofing using hardware breakpoints 😁
Works for syscalls and APIs, supports x64, x86 and WoW64.
https://www.coresecurity.com/blog/hardware-call-stack
🗣s4ntiago_p


🎖@malwr

The Red Report 2023 — A comprehensive analysis of the most prevalent TTPs used in 2022, and how they were leveraged by threat actors. Based on an in-depth analysis of over 500,000 real-world malware samples collected from a wide range of sources.

https://drive.google.com/file/d/1Rp2QF4e5-zvdtPJApaiRQEGtscweb8SV/view
🗣snkhan


🎖@malwr

I have published a highly technical debunking whitepaper called:

A brief note on "Exonerating Morocco disproving the spyware"

(I'm sorry for the lack of pet photos, but that just wouldn't be professional)

https://www.researchgate.net/publication/368985450_A_brief_note_on_Exonerating_Morocco_disproving_the_spyware
🗣maldr0id


🎖@malwr

Researchers from The DFIR Report present a review of 2022 in which they look at the most prevalent types of intrusions, the most common TTPs used to infiltrate networks, and provide predictions on what they expect to see in the coming year. https://thedfirreport.com/2023/03/06/2022-year-in-review/
🗣virusbtn


🎖@malwr

Another tool for the upcoming Maldev Academy course! This tool is part of the entropy reduction module.
https://github.com/Maldev-Academy/EntropyReducer
🗣NUL0x4C


🎖@malwr

AhnLab's ASEC team describe a recent Lazarus attack in which the affected company used a vulnerable version of a certificate program commonly used by public Korean institutions & universities, & the software’s 0-day vulnerability was used for infiltration. https://asec.ahnlab.com/en/48810/
🗣virusbtn


🎖@malwr

In the latest edition of the Ransomware Roundup Fortinet reseachers cover the Sirattacker and ALC ransomware. https://www.fortinet.com/blog/threat-research/ransomware-roundup-sirattacker-acl
🗣virusbtn


🎖@malwr