estrellas

Reverse engineer mostly interested in SAT/SMT solvers, Program Analysis, and Obfuscation.

Views are my own.

[смех @0x6D6172636F]

Taking a little walk through one of those Oath2.0 token phishing kit admin panels:

https://t.co/YHxHHVOkhD

On login, some info about recently acquired tokens

[estrellas @CryptDeriveKey]

@BlinkzSec This is likely APT-C-36/Blind Eagle.

[estrellas @CryptDeriveKey]

https://t.co/E7CcWC9K3w

[estrellas @CryptDeriveKey]

✊

[estrellas @CryptDeriveKey]

@0x6D6172636F I'd take the advice

[estrellas @CryptDeriveKey]

@killandy01 ❤️

[estrellas @CryptDeriveKey]

@bugfireIO @0x6D6172636F Yes it is! https://t.co/cUAtCDXMkH

[estrellas @CryptDeriveKey]

@belabs_james Appreciate the feedback! Do you have any resources on doing so? I've also been thinking about implementing value tracking for tail call detection purposes.

[estrellas @CryptDeriveKey]

Lately I've been working in my very own binary lifter... As part of the documentation process, I decided to write a few words about my implementation of static recovery of a given function's control flow graph. Hope you enjoy it!

https://t.co/4e1tBzWlYv

[estrellas @CryptDeriveKey]

@netspooky Pyarmor's BCC mode transpiles python to C, producing an ELF afterwards (even for Windows applications). The ELF can also be a wrapper around GNU Lightning (JIT assembler) if certain options are marked in the obfuscation process

[estrellas @CryptDeriveKey]

@jsrailton @Mandiant that is not new

[estrellas @CryptDeriveKey]

@daltsec @thefinalfl46498 oh lmao that's indeed me

[estrellas @CryptDeriveKey]

@vmfunc I am sorry :(

[смех @0x6D6172636F]

Additional info on the Fancy Bear kit being reported on. Cheers to @Laughing_Mantis for writing backdoors so good that APTs plagiarize it.
https://t.co/4mBI2jNY34

[estrellas @CryptDeriveKey]

My latest analysis of #XWORM's new delivery method just got published! You can read it at:
https://t.co/FboSytSQS5

[estrellas @CryptDeriveKey]

@vector35 @RussianPanda9xx Mostly these. They are: Search options (text, byte pattern, imm), Segments view, Graphs editor (zoom, fit to window, proximity browser), Graphs view (XREFs, Function calls), and "Windows management" (Imports, Exports, Strings)

[estrellas @CryptDeriveKey]

@vector35 @RussianPanda9xx Ooh! Exactly like this! Thanks!

[estrellas @CryptDeriveKey]

@vector35 @RussianPanda9xx I am honestly not a big fan of the r64_N syntax for variables, the lack of icons for functionalities, as well as not having brackets😅... But I do appreciate being able to go through many different IL's, and IL forms