Invoke RE

Empowering you to take on today's toughest threats.

[Invoke RE @InvokeReversing]

Learn how to reverse engineer malware: https://t.co/jKUXbQ46t6
YouTube: https://t.co/4ptrgTwQ4N
Twitch: https://t.co/8r0GnPeGeh
Mastodon: https://t.co/hMM9FJBkdO
GitHub: https://t.co/OUqRdaeAZB

[Invoke RE @InvokeReversing]

Link to video: https://t.co/zjrWioEu9p

[Invoke RE @InvokeReversing]

We've uploaded a preview of our Advanced Malware Binary Triage course where we analyze an example x86-64 binary in Binary Ninja and compare it to x86. Enjoy!

[Squiblydoo @SquiblydooBlog]

The campaign seems most similar to the classic "Recipe Lister", the original TamperedChef, analyzed by @luke92881 , @InvokeReversing 's community, Dingusxmcgee, others https://t.co/ktTyCT9FXc

Based on the certificate usage, it aligns: again with US, UK, and UA certificates.
7/9

[L0Psec @L0Psec]

Fun conversation as always with @arinwaichulis :) with a focus on macOS malware and their link to some of the biggest hacks recently. Enjoy!

[Dulge @dulgex]

x64dbg larping

[Invoke RE @InvokeReversing]

Join us for a special Halloween Stream! We'll be reversing spooky scareware, join if you dare! https://t.co/3cvENo4Rzw

[Invoke RE @InvokeReversing]

Join us on Friday October 30th for a halloween live stream at 1PM EST! We'll be reversing spooky scareware, come if you dare!

[Invoke RE @InvokeReversing]

Stream link: https://t.co/IO1Mwbv9bs

[Invoke RE @InvokeReversing]

We've uploaded our live stream from October 16th where we analyzed a Rust loader that uses indirect syscall resolution, AES decryption, ETW patching and multiple unpacking steps to load and execute NWHStealer. Enjoy!

[Invoke RE @InvokeReversing]

Stream link: https://t.co/TlrjeFqOA6

[Josh Reynolds (jmag) @JershMagersh]

Or, hear me out for a second, you could always learn how to RE yourself

[Invoke RE @InvokeReversing]

Come hang out for some Rust reversing in IDA. Potentially a new loader? 🕵️‍♂️ https://t.co/zei1v2ovdH

[Invoke RE @InvokeReversing]

@w33t_io did a great write up on this campaign, including follow on payloads: https://t.co/f50HdRlNVM

[Invoke RE @InvokeReversing]

We're also seeing fake "RDP OfficeX Manager" and "PLClean Master" as a part of the same campaign. IOCs (including 2FA apps):

052a2258a185f4c858326ff1a5754b2c4c2bf680c12ebf30a3c2b2b9c1af8f68
0bcf272d8f22fa30d327d7c0233b7eae7d50df1ebd95472aae59aef19c8e23bf
1b2432c99b877ac71a37d505ca7165f8d46cb4fc9a98762d54c529c7aef26d71
73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed
e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3

C2s:
get[.]calo44[.]net
ftp[.]mawar180[.]org
pub[.]futsalbandung[.]org

[Invoke RE @InvokeReversing]

We're also seeing fake "RDP OfficeX Manager" and "PLClean Master" as a part of the same campaign. IOCs (including 2FA apps):

052a2258a185f4c858326ff1a5754b2c4c2bf680c12ebf30a3c2b2b9c1af8f68
0bcf272d8f22fa30d327d7c0233b7eae7d50df1ebd95472aae59aef19c8e23bf
1b2432c99b877ac71a37d505ca7165f8d46cb4fc9a98762d54c529c7aef26d71
73cb8ff57d809fe1042ef02ba5571d8ad7ee871cadf01a9bbc609f69f8d407ed
e27d133c3b29c1a0c0eca19b56dbb1db2f731db5c7b6dd3e7acacfdf49615cd3

C2s:
get[.]calo44[.]net
ftp[.]mawar180[.]org
pub[.]futsalbandung[.]org

[tanner @wbmmfq]

Analysts @HuntressLabs have been seeing an uptick of malicious MFA apps from the Microsoft Store the last few days. In some cases, they're being delivered via tech support scams through Teams, in others via malvertizing.

We've been digging into it, and hopefully we'll have more info soon.

[Invoke RE @InvokeReversing]

Stream link: https://t.co/tlqMIaVaJ0

[Invoke RE @InvokeReversing]

We've uploaded our live stream from late September where we explored Detection Engineering with Yara using Assemblyline, CAPEv2, bindiff and mquery. We go over packer detection, unpacked file detection and writing dependable rules that will outlast changes by the malware author and recompilations. Enjoy!

[Invoke RE @InvokeReversing]

Stream link: https://t.co/tlqMIaVaJ0

[Josh Reynolds (jmag) @JershMagersh]

It was an honour to speak with Pablo on the debut episode of the Polo Cyber podcast. We spoke about my early beginnings, career, reverse engineering, malware analysis and Invoke RE. Hope you enjoy it!

[Pablo Brum @pgbrum]

New Polo Cyber YouTube channel is up! First video with @InvokeReversing founder and former colleague of mine @JershMagersh

https://t.co/jEBYeoydq5

[Invoke RE @InvokeReversing]

Check out these new testamonials from students completing the Advanced Malware Binary Triage course! 🤩