In this Twitch stream we analyze the multi-stage delivery chain used to install Jupyter / Solarmarker InfoStealer. The delivery chain includes an Inno Installer, malicious Pascal script, malicious PowerShell script, and a reflectively loaded .NET assembly.
In this tutorial we unpack Night Sky Ransomware (x64) which is protected with VMProtect 3. We use VMPDump to dump and fix the imports and then re-create the virtualized entry point manually.
In this Twitch stream we unpack a VMProtect "soldier" implant developed by HackingTeam. Once we have unpacked the payload we write a static config extractor using Python.
Packed sample: 2022-01-28 04:55:18 +0000 UTC View Post
This is the third part in our three-part tutorial series on unpacking VMProtect malware. At this stage we have dumped the unpacked PE payload. The entry point was virtualized so the dumped sample won't run but it could be statically reverse engineered -- if static reverse engineering is all that is re...
2022-01-25 21:02:57 +0000 UTC View Post
This is part two in our three-part tutorial series on unpacking VMProtect malware. We are attempting to unpack a sample that has been packed with VMprotect where the entry point has been virtualized but all other functions are not protected.
The concept behind our approach...
2022-01-25 21:02:13 +0000 UTC View Post
This is the first part in our three-part tutorial series on unpacking VMProtect malware. When approaching a VMProtect malware sample it is important to understand the concept of a packer vs. a virtualizer. VMProtect offers both the option to pack files, and the option to virtualize individ...
2022-01-25 20:57:54 +0000 UTC View Post
In this Twitch stream we test the latest Dev 3.0 release of Binary Ninja using our standard IDA Pro malware analysis workflow. Stick around to see what works, what doesn't, and what's next for Binja!
This wasn't a sponsored stream but we d...
2022-01-24 03:57:00 +0000 UTC View Post
In this Twitch stream we reverse engineer the “WhisperGate” malware stages 2, 3, and 4. The first two stages are .NET obfuscated with NetReactor and EazFuscator, while Stage 4 is an x86 binary compiled with MinGW.
Stage 2 - Downloader: dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d3...
2022-01-21 19:28:48 +0000 UTC View Post
In this tutorial we discuss the __security_init_cookie and __scrt_common_main_seh functions and why the PE Entry Point on an MSVC binary does not point to Main.
This is an important concept to understand when first learning how to reverse engineer windows binaries, especially when using a debugger. Often it can be confusing when the ...
2022-01-18 23:55:42 +0000 UTC View Post
In this tutorial we are going to discuss simple ways to stay safe while handling malware in non-safe environments.
The first step is to setup a safe analysis environment using a virtual machine set up with the FLARE-VM tools. Our full 2022-01-18 03:56:53 +0000 UTC View Post
Twitch live stream VOD. We generate IDA Pro FLIRT / FLAIR signatures for the mbedtls library in Night Sky ransomware and begin reverse engineering. Once we have a nice IDB we use 2022-01-16 00:29:40 +0000 UTC View Post
Twitch live stream VOD. We begin reverse engineering NightSky ransomware and identify a statically compiled mbedtls library. We build mbedtls and use the .pdb file to quickly import the library structs.
Sample available on Malshare:
Twitch live stream VOD. We unpack NightSky ransomware which is packed with VMProtect 3 (but not fully virtualized). We also use Dumpulator to identify a complex function without needing to fully reverse engineer it.
Sample available on Mal...
2022-01-10 05:01:04 +0000 UTC View Post
Twitch live stream VOD. We build a static config extractor for Qakbot / Qbot malware using Python. In this stream we complete building out the C++ structs for the malware, identify how the config is stored, and replicate the config decryption in Python.
Sample available on Malshare:
Twitch live stream VOD. We begin reverse engineering Qakbot / Qbot malware. In this stream we resolve the dynamic imports, decrypt the encrypted strings, and begin building out the C++ structs for the malware.
Sample available on Malshare:
Twitch live stream (clip). We take a look at Zeppelin Ransomware which is developed in Delphi. We go through the steps to correctly set up IDA Pro for analysis of a Delphi compiled binary including installing and using IDR (Interactive Delphi Reconstructor).
We don't start reverse engineering but our IDA configuration might be useful...
2021-12-23 04:02:34 +0000 UTC View Post
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and complete our static config extractor in Python.
Sample available on Malshare:
2021-12-23 03:41:58 +0000 UTC View Post
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and begin building out the struct that is used for it's injected code. We also realize we should have read Chong's blog and actually patched API called to save us a lot of trouble... this was a struggle stream...
Sample available on Malshare:
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and prepare it for full static analysis. We resolve the imports, decrypt the strings, and decrypt the embedded shell code.
Sample available on Malshare:
Twitch live stream VOD. We take a look at the new Emotet binary and build a static config extractor.
Sample available on Malshare: eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994f...
2021-11-19 20:49:19 +0000 UTC View Post
Twitch live stream VOD. We take a look at the new Emotet binary and slowly start reverse engineering it...
Sample available on Malshare: eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbf...
2021-11-18 14:00:07 +0000 UTC View Post
Igor's Tips: Type Libraries Deep Dive
Igor's Tips: Creating Custom Type Libraries
2021-11-14 01:04:56 +0000 UTC View Post
Usually Python and IDA play nice but when they don't the troubleshooting process can be maddening. In this tutorial we will cover some IDA Python environment basics that can assist with troubleshooting and configuring a sane Python 3 environment for IDA Pro.
If you are running the latest version of IDA and you have a single Python en...
2021-11-08 22:21:17 +0000 UTC View Post
Twitch live stream VOD. This is our redemption stream! We finally deobfuscate the modified Confuser and extract the .NET payload.
2021-11-08 00:34:42 +0000 UTC View Post
Twitch live stream VOD. We take a look at a garbage RAT that is written in .NET obfuscated with ConfuserEx and packed in Themida.
2021-11-07 23:27:21 +0000 UTC View Post
In this tutorial we analyze the anti-debug checks in BlackMatter ransomware with IDA Pro. We use static analysis to determine exactly what the checks are doing.
BlackMatter sample:
In this tutorial we demonstrate how to bypass the anti-debug checks in BlackMatter ransomware with x64dbg.
BlackMatter sample:
Anti-de...
2021-10-15 16:53:21 +0000 UTC View Post