In this Twitch stream we analyze the multi-stage delivery chain used to install Jupyter / Solarmarker InfoStealer. The delivery chain includes an Inno Installer, malicious Pascal script, malicious PowerShell script, and a reflectively loaded .NET assembly.
In this tutorial we unpack Night Sky Ransomware (x64) which is protected with VMProtect 3. We use VMPDump to dump and fix the imports and then re-create the virtualized entry point manually.
In this Twitch stream we unpack a VMProtect "soldier" implant developed by HackingTeam. Once we have unpacked the payload we write a static config extractor using Python.
Packed sample: 76840fa18df8764afb51f1aa6d...
2022-01-28 04:55:18 +0000 UTC View Post
This is the third part in our three-part tutorial series on unpacking VMProtect malware. At this stage we have dumped the unpacked PE payload. The entry point was virtualized so the dumped sample won't run but it could be statically reverse engineered -- if static reverse engineering is all that is required this final stage is not needed.
This is part two in our three-part tutorial series on unpacking VMProtect malware. We are attempting to unpack a sample that has been packed with VMprotect where the entry point has been virtualized but all other functions are not protected.
The concept behind our approach is to use a sandbox to identify an API that is ca...
2022-01-25 21:02:13 +0000 UTC View Post
This is the first part in our three-part tutorial series on unpacking VMProtect malware. When approaching a VMProtect malware sample it is important to understand the concept of a packer vs. a virtualizer. VMProtect offers both the option to pack files, and the option to virtualize individual functions. Depending on what options are selec...
2022-01-25 20:57:54 +0000 UTC View Post
In this Twitch stream we test the latest Dev 3.0 release of Binary Ninja using our standard IDA Pro malware analysis workflow. Stick around to see what works, what doesn't, and what's next for Binja!
This wasn't a sponsored stream but we did get a free 30-day license from the folks over a...
2022-01-24 03:57:00 +0000 UTC View Post
In this Twitch stream we reverse engineer the “WhisperGate” malware stages 2, 3, and 4. The first two stages are .NET obfuscated with NetReactor and EazFuscator, while Stage 4 is an x86 binary compiled with MinGW.
Stage 2 - Downloader: dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78
Stage 3 - File Corrupto...
2022-01-21 19:28:48 +0000 UTC View Post
In this tutorial we discuss the __security_init_cookie and __scrt_common_main_seh functions and why the PE Entry Point on an MSVC binary does not point to Main.
This is an important concept to understand when first learning how to reverse engineer windows binaries, especially when using a debugger. Often it can be confusing when the debugger breaks on the PE Entry Point only to find...
2022-01-18 23:55:42 +0000 UTC View Post
In this tutorial we are going to discuss simple ways to stay safe while handling malware in non-safe environments.
The first step is to setup a safe analysis environment using a virtual machine set up with the FLARE-VM tools. Our full Dynamic Malware Analysis Lab ...
2022-01-18 03:56:53 +0000 UTC View Post
Twitch live stream VOD. We generate IDA Pro FLIRT / FLAIR signatures for the mbedtls library in Night Sky ransomware and begin reverse engineering. Once we have a nice IDB we use
Twitch live stream VOD. We begin reverse engineering NightSky ransomware and identify a statically compiled mbedtls library. We build mbedtls and use the .pdb file to quickly import the library structs.
Sample available on Malshare:
8c1a72991fb04dc3a8cf89605fb8...
2022-01-15 23:17:42 +0000 UTC View Post
Twitch live stream VOD. We unpack NightSky ransomware which is packed with VMProtect 3 (but not fully virtualized). We also use Dumpulator to identify a complex function without needing to fully reverse engineer it.
Sample available on Malshare:
Twitch live stream VOD. We build a static config extractor for Qakbot / Qbot malware using Python. In this stream we complete building out the C++ structs for the malware, identify how the config is stored, and replicate the config decryption in Python.
Sample available on Malshare:
Twitch live stream VOD. We begin reverse engineering Qakbot / Qbot malware. In this stream we resolve the dynamic imports, decrypt the encrypted strings, and begin building out the C++ structs for the malware.
Sample available on Malshare:
Twitch live stream (clip). We take a look at Zeppelin Ransomware which is developed in Delphi. We go through the steps to correctly set up IDA Pro for analysis of a Delphi compiled binary including installing and using IDR (Interactive Delphi Reconstructor).
We don't start reverse engineering but our IDA configuration might be useful for other Delphi malware.
...
2021-12-23 04:02:34 +0000 UTC View Post
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and complete our static config extractor in Python.
Sample available on Malshare:
c7990f1e72fdfa84552f02f9d11cabb74251b0508291af5366fefcee646f9c91<...
2021-12-23 03:41:58 +0000 UTC View Post
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and begin building out the struct that is used for it's injected code. We also realize we should have read Chong's blog and actually patched API called to save us a lot of trouble... this was a struggle stream...
Sample available on Malshare:
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and prepare it for full static analysis. We resolve the imports, decrypt the strings, and decrypt the embedded shell code.
Sample available on Malshare:
Twitch live stream VOD. We take a look at the new Emotet binary and build a static config extractor.
Sample available on Malshare: eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827
Python config extractor:
<... 2021-11-19 20:49:19 +0000 UTC View Post
Twitch live stream VOD. We take a look at the new Emotet binary and slowly start reverse engineering it...
Sample available on Malshare: eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827
2021-11-18 14:00:07 +0000 UTC View Post
Igor's Tips: Type Libraries Deep Dive
Igor's Tips: Creating Custom Type Libraries
2021-11-14 01:04:56 +0000 UTC View Post
Usually Python and IDA play nice but when they don't the troubleshooting process can be maddening. In this tutorial we will cover some IDA Python environment basics that can assist with troubleshooting and configuring a sane Python 3 environment for IDA Pro.
If you are running the latest version of IDA and you have a single Python environment installed on your host you may nev...
2021-11-08 22:21:17 +0000 UTC View Post
Twitch live stream VOD. This is our redemption stream! We finally deobfuscate the modified Confuser and extract the .NET payload.
2021-11-08 00:34:42 +0000 UTC View Post
Twitch live stream VOD. We take a look at a garbage RAT that is written in .NET obfuscated with ConfuserEx and packed in Themida.
2021-11-07 23:27:21 +0000 UTC View Post
In this tutorial we analyze the anti-debug checks in BlackMatter ransomware with IDA Pro. We use static analysis to determine exactly what the checks are doing.
BlackMatter sample:
Malshare Download&nbs...
2021-10-15 17:00:15 +0000 UTC View Post
In this tutorial we demonstrate how to bypass the anti-debug checks in BlackMatter ransomware with x64dbg.
BlackMatter sample:
Anti-debug feature explained:
