As a DFIR Engineer, you should notice something suspicious going on here!!
But how many techniques do you know that an attacker can use to hide this easy detection from you?!
#C5W#DFIR#Malware#ThreatHunting#Cybersecurity
NTFS is always the place where every disk-related artifact will leave a trace, mastering its analysis is a crucial skill to have as this will make your investigation much easier.
#blueteam#digitalforensics#cyberdefense
If you have any addition or an interesting tool you want to share it with the community, please reach out to me and I will add it to the post, I am really interested to know more about how other analysts customize their machines.
#malware#blueteam#cybersecuritytips
Check out my last blog post talking about how I customize my malware analysis machine with tools and plugins that can make my life easier and save me time.
https://t.co/kiYI6JvLvn
Just a quick tip for reverse engineering new guys, and any old one who doesn't care.
Never rely on Decompiled code only, that always happens to me, but this time that was insane.
my decompiler missed tens of lines of functions and API calls.
Browsers are keeping track of almost every move, check out my new blog post which is a reference where you can find what you need during your investigation.
https://t.co/wSrIeyLnr7
@cyber5w#dfir#blueteam#CyberSecurity#DigitalForensics
In our new blog post, @Cyberagent101 wrote about the different Anti-Analysis techniques used by the #Pikabot malware in its loader with detailed analysis. #malware#DFIR#Cybersecurity#RE
https://t.co/WoXhJ07KNf
Hey malware analysts, "Pikabot" is a relatively new malware and is considered the second wave of the famous "Qakbot".
This malware contains two stages armed with many Anti-Analysis techniques to make defenders' lives harder like:
https://t.co/9tAxmBibJW
- Junk Code
- API Hashing
- Encrypted Stack Strings
- INT 0x2D instruction
- OutputDebugString
- Memory Write Watch
Here is a detailed analysis of the new version of its Loader part.
Firmware is really a great place for hunting vulnerabilities these days.
here I am discussing how to emulate and reverse firmware binaries by doing research in "DLINK DIR 832G" router "CVE-2023-43241 & CVE-2023-43235" OOB writes.
https://t.co/HK97hETfzX
For Malware Analysts & Developers,
another trick for executing code before "main" using "_initterm" to hide code.
In this small article I discuss how you can get code execution before main using dynamically assigned global variables.
https://t.co/jXgJkkJ3Mg
#malware
ESXIArgs Ransomware analysis.
ESXIArgs Ransomware is widely spread these days due to the wide exploitation of a vulnerability with CVE-2021-21974 which is quite old but is not patched in many ESXI Servers. The malware itself is not complex at all but the danger comes from the