Malware News

2022-02-06 13:41:01 Hours of troubleshooting and some more evenings went into a Nim port of reflective PE loading. Learned a lot porting that one, special thanks to @am0nsec and @_EthicalChaos_ for answering all my questions regarding to issues!

https://github.com/S3cur3Th1sSh1t/Nim-RunPE
ShitSecure


@malwr Open / Comment

2022-02-05 21:54:06 For quite some time I wanted a command-line tool to calculate the entropy of files that was fast and supported Windows. I ended up coding my own. It could be useful for people in #malwareanalysis, #forensics, etc.
https://github.com/merces/entropy
mer0x36


@malwr Open / Comment

2022-02-05 20:47:46 My latest msdt uac bypass has been added to UACME. Thx @hFireF0X!
https://github.com/hfiref0x/UACME
EmericNasi


@malwr Open / Comment

2022-02-05 20:45:05 Reversing Go Tip 0x0001. Here is an Assembler view of a simple, "Hello, world!" and "Hello, world again!" bin. Notice with modern Go the values about to be passed into Fprintln are in r8 on x64.
mytechnotalent


@malwr Open / Comment

2022-02-05 20:39:46 a tiny DNS resolver
full program: https://github.com/jvns/tiny-resolver
b0rk


@malwr Open / Comment

2022-02-05 20:18:11 The ultimate backdoor doesn't exi-
DuchyRE


@malwr Open / Comment

2022-02-01 13:45:35 As a YuGiOh fan I couldn't resist reverse engineering the new "Master Duel" game :)

I used Cpp2Il to generate the C# DLL and used the symbols to import the functions into GameAssembly.dll.

If you want to tag along, here's my current 1.0.1 script: https://github.com/ioncodes/master-duel
layle_ctf


@malwr Open / Comment

2022-01-31 20:46:19 I wrote a C++ library to parse Windows minidumps (.dump /mx) for another project; go check it out !
https://github.com/0vercl0k/udmp-parser/
0vercl0k


@malwr Open / Comment

2022-01-31 17:13:00 Weekend Reading (or viewing) - a pretty clever set of C2 mechanisms, steganography and backdoors targeting Japan from @TeamT5_Official

might be a new favorite cluster Thinking face

check it out!

https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf
greglesnewich


@malwr Open / Comment

2022-01-31 17:11:08 Have you noticed that IDA sometimes renames and marks up local variables automatically? Read up on how Parameter identification and tracking aka PIT works:

https://hex-rays.com/blog/igors-tip-of-the-week-74-parameter-identification-and-tracking-pit/

#IgorsTipOfTheWeek #IDAtips #IDAPro
HexRaysSA


@malwr Open / Comment