Automating Malware Deobfuscation with Binary Ninja
Writing a Static Unpacker

This section will teach participants how to automate unpacking and decryption of malware samples. This will be accomplished using the Qakbot sample as an example. The Qakbot sample is packed (obfuscated using an external program that “unpacks itself”) and therefore we will perform multiple hands-on exercises to automate the extraction of Qakbot from its packed form using Binary Ninja, PEFile and Binary Refinery.
+ The first exercise will teach attendees how to use Binary Ninja to identify the encryption algorithm used by the first stage of the packer and how to extract key information to decrypt the second stage.

+The next exercise will teach attendees how to use PEFile to extract an embedded resource from the packed binary. Once extracted, the resource will then be decrypted using the key information from the first exercise

The next exercise will teach attendees how to use Binary Refinery to carve binary files from the decrypted resource


Code

Slides

Workshop Manual

Analysis of two arbitrary code execution vulnerabilities affecting WPS Office
(Used by APT-60)


#apt #analysis #cve

The SOS Intelligence CVE Chatter Weekly Top Ten
This weekly blog post is from via our unique intelligence collection pipelines. We are your eyes and ears online, including the Dark Web.

https://sosintel.co.uk/category/cve-top-10/

———

CISA ( America's Cyber Defence Agency )
Bulletins provide weekly summaries of new vulnerabilities.

https://www.cisa.gov/news-events/bulletins

———

Silly EDR Bypasses and Where To Find Them
Credit: Marcus Hutchins

A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.

_ Article _

https://github.com/MalwareTech/EDRception.git

#edr #redteam

DEF CON 24 - Joshua Drake, Steve Christey Coley - Vulnerabilities 101

#vulnerability
#research
#vr
#conference

Video

———
🆔 @Infosec_Fortress

https://github.com/kbandla/APTnotes
yummyyyyy

The Enigma 7.40 x86 & x64
#packer #protector #reverse


Thanks to Sh4doVV

The tragedy of low-level exploitation

https://gynvael.coldwind.pl/?id=791

похожие мысли всегда в голове крутились

How detect data exfiltration:

https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/

قسمت اول دوره چیتینگ

Native function and Assembly Code Invocation

https://research.checkpoint.com/2022/native-function-and-assembly-code-invocation/

#reverse #idapro

Win32 Reverse TCP Shellcode

Wanna learn how to write shellcode for your specific purpose in windows?
This is what you need !

Credit: Xenofon Vassilakopoulos


Pt1: https://xen0vas.github.io/Win32-Reverse-Shell-Shellcode-part-1-Locating-the-kernelbase-address/
Pt2: https://xen0vas.github.io/Win32-Reverse-Shell-Shellcode-part-2-Locate-the-Export-Directory-Table/
Pt3: https://xen0vas.github.io/Win32-Reverse-Shell-Shellcode-part-3-Constructing-the-reverse-shell-connection/
Code:
https://github.com/xen0vas/Win32-Reverse-TCP-Shellcode.git


#shellcode #asm #winasm