This is the second part of our SmokeLoader analysis. We finish cleaning up the obfuscation in Stage 2 and locate the API hashing algorithm, we also locate the encrypted Stage 3 payloads but there is a problem... something just isn't right with our analysis and we aren't able to resolve the API hashes, or decrypt Stage 3!
2022-09-03 04:29:58 +0000 UTC
View Post
This is our first look at SmokeLoader, we begin with analysis of Stage 2 (unpacked automatically). The binary is obfuscated using a mixture of simple opaque predicates, and encrypted functions that are decrypted on the fly.
Honestly, this is a very slow paced stream. We do make progress and end up with a binary that is ful...
2022-09-03 04:14:02 +0000 UTC
View Post
In this tutorial we will setup a free, safe, Windows 11 virtual machine (VM) that can be used for dynamic malware analysis on an M1 Apple host (M1 MacBooks, etc.) Since the new M1 chips run an ARM architecture the options for VMs are limited....
2022-08-08 05:45:26 +0000 UTC
View Post
Our final steam on Lockbit 3.0 ransomware! We complete our analysis of the third embedded binary. This is a tricky one, we need to use some debugging to decrypt the binary before we can begin our analysis...
Samples
Lockbit Ransomware: 2022-08-03 06:36:40 +0000 UTC
View Post
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We add another hashing algorithm to HashDB and complete our analysis of the 2nd binary!
Samples
Lockbit Ransomware: 2022-08-03 06:32:21 +0000 UTC
View Post
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We begin analysis of the second embedded binary...
Samples
Lockbit Ransomware: 80e8defa5377018b093b5b90de0f...
2022-07-25 00:25:47 +0000 UTC
View Post
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We complete our analysis of the first binary, and move on to look at the second binary...
Samples
Lockbit Ransomware: 2022-07-25 00:23:29 +0000 UTC
View Post
In this twitch stream we start analyzing the binaries embedded in Lockbit 3.0 ransomware. We take a look at the first binary which requires the development of a new HashDB algorithm, and some string decryption tools.
Samples
Lockbit Ransomware: 2022-07-25 00:18:51 +0000 UTC
View Post
Fixing Our Config Extractor
In this twitch stream we continue our analysis of the new Lockbit 3.0 ransomware and complete our config extractor. We extract the ransom note along with many encrypted strings, and some shell code ... and curiously... three embedded PE files!
Sample
2022-07-12 05:30:00 +0000 UTC
View Post
In this twitch stream we take a look at the new Lockbit 3.0 ransomware and realize it is just a ripoff of BlackMatter! We resolve the dynamic imports then take a look at extracting the config... the config extraction is almost the same as BlackMatter...
Sample
2022-07-09 17:44:59 +0000 UTC
View Post
In this twitch stream we take a final look at the Matanbuchus loader malware. We focus on an older version of the payload that uses a different type of string encryption.
This stream is more of an experiment with emulation rather than anything useful for tracking the loader since the sample we are examining is old and no longer in us...
2022-07-09 17:35:58 +0000 UTC
View Post
This is the first in a short three-part series on pointers; how they work in memory, and what they look like in assembly. In this tutorial we look at the basics, what is a pointer, how is a pointer assigned, and what is dereferencing.
Further Reading
The following resources may be of interest.
This is the second in a short three-part series on pointers. In this tutorial we take a look at VOID pointers, VOID*, PVOID, PVOID* etc. We also discuss casting and briefly touch on memory allocation and access via VOID pointers.
Further Reading
This is the last part of a short three-part series on pointers. In this tutorial we look at what happens when an argument is passed by reference. What actually occurs in memory and in the compiled assembly.
Hands On Example
Attached to this post is the compiled example we analyzed in the tutorial. You are encouraged to analyze the ...
2022-07-06 04:27:07 +0000 UTC
View Post
In this twitch stream we take a second look at the Matanbuchus loader malware. We tighten our Yara rule, and refine our config extractor to work on all the samples we have collected, except one...
Samples
Each sample can be downloaded from M...
2022-06-28 03:47:36 +0000 UTC
View Post
In this twitch stream we begin our triage of the Matanbuchus loader malware. First, we resolve the API hashes, and decrypt the strings, then we attempt to build a Yara rule and and automated config extractor.
Stream Bookmarks
- 00:31:00 We conclude our research and begin reverse engineeri...
2022-06-24 03:03:30 +0000 UTC
View Post
In this twitch stream we analyze a loader associated with FIN7 called DICELOADER. During our analysis we build and test a Yara rule as well as a config extractor.
Sample:
2022-06-21 04:53:31 +0000 UTC
View Post
In this twitch stream we triage two simple malware downloaders and look for common characteristics that we can use to automatically detect them. One loader turns out to be a Cobalt Strike loader and we attempt to extend our detections...
Downloader #1
2022-06-13 04:14:19 +0000 UTC
View Post
In this twitch stream we take a look at various forms of Cobalt Strike Beacon and how their config can be extracted. We also triage a sample that is packed using Syscalls.
Notes (including config extractor code):
2022-06-10 18:24:17 +0000 UTC
View Post
In this twitch stream we triage an Amadey Loader malware sample and write a config extractor in Python.
Packed Sample:
7ff0ff6e51a58398ad73da3cc8e7e6233a23e49d93aaa4...
2022-06-08 03:58:58 +0000 UTC
View Post
In this twitch stream we walk through the triage of a packed loader and discuss some of techniques that can help save time when triaging unknown malware.
Packed Sample:
bbb1db25b2b54928d97...
2022-05-23 22:31:59 +0000 UTC
View Post
In this twitch stream we look at the recently updated emotet that is using obfuscation to hide its config and we use emulation to build a config extractor.
Sample:
2022-05-23 02:51:34 +0000 UTC
View Post
In this twitch stream we take a look at the new Bumblebee loader malware. First we unpack it using x64dbg, then begin our triage work with IDA, and end up extracting the encrypted "config".
Sample:
2022-05-13 04:06:18 +0000 UTC
View Post
In this twitch stream we investigate some quick ways to statically reverse engineer samples that rely on Syscalls. The sample we are looking at is Magniber ransomware.
Sample:
2022-05-10 00:33:05 +0000 UTC
View Post
In this twitch stream we take a look at the new 64-bit version of Emotet. We use dumpulator and python to extract the config and write a simple Yara rule.
Sample:
2022-05-05 04:58:47 +0000 UTC
View Post
In this Twitch stream we create a binary patching script using IDA Python to patch our obfuscated Emotet sample.
In the end we determine that directly patching the end of each state is not going to work since the flags we rely on may change within the state. Our workaround is to save the flags which gives us a complete solution but it stil...
2022-04-28 15:46:15 +0000 UTC
View Post
In this Twitch stream we complete our generic deobfuscation algorithm and test it on an obfuscated Emotet sample.
We build off of our work from the previous stream and attempt to finally patch out the obfuscation from this sample. We almost... complete... it...
Sample: c7574aac7583a5bdc446f813b8e347a768a9f4af85...
2022-04-23 02:35:06 +0000 UTC
View Post
In this Twitch stream we take a pause to go back and walk through the basics of what symbolic execution really is, and how it can help us with deobfuscation. This was a much requested stream, and hopefully it helps everyone is able to catch up so we all have the same base of knowledge as we continue to build our one-click easy button tool for CF...
2022-04-16 02:37:48 +0000 UTC
View Post
In this Twitch stream we attempt to build a generic algorithm to separate the dispatcher basic blocks from the original basic blocks in an obfuscated Emotet sample.
We build off of our work from the previous stream and attempt to convert our assembly specific algorithm to a generic algorithm that uses symbolic execution with Angr ins...
2022-04-12 20:37:50 +0000 UTC
View Post
In this Twitch stream we begin to look at the CFF obfuscation in Emotet. Our first step is to build an algorithm to separate the dispatcher control flow blocks from the original basic blocks.
We have a rough start since the function we focus on has two entry points to the dispatcher which means we can't use the same approach we used ...
2022-04-12 20:29:18 +0000 UTC
View Post
