Mark

Senior TI Analyst @ MSTIC.
Ex Senior RE @ FLARE (Mandiant/Google).

[Ariel Jungheit @ArielJT]

Check out our latest report covering Ivanti CSA vulnerability with complete root cause analysis, detailed breakdown of ITW exploitation, overview of worldwide targets alongside comprehensive IoCs & detection rules 👇🏻
https://t.co/Ng41t7inNK

[hasherezade @hasherezade]

In case if you wonder what broke #ProcessHollowing on Windows 11 24H2, I have something for you: https://t.co/nPSD841K0N

[cod @wolfcod]

Read “Behind Hacking-Team’s vector-edk“ on Medium: https://t.co/qgCJ1ALGPB

[Mark @_marklech_]

My old keybase is dead, if you want to reach me on keybase use this one.

[Mark @_marklech_]

Verifying myself: I am marklechtik on https://t.co/1xSqxAmxoh. 9RMVFje1UmWmrBeffCo6c69DF6sjVQ_FGpMI / https://t.co/5MrqGKBa7J

[Mark @_marklech_]

Verifying myself: I am marklechtik on https://t.co/1xSqxAmxoh. 9RMVFje1UmWmrBeffCo6c69DF6sjVQ_FGpMI / https://t.co/5MrqGKBa7J

[allthingsida @allthingsida]

Writing an IDA processor module for the PigletVM

https://t.co/PdUoylbvb3

[Muhammad Umair @m_umairx]

FLARE is releasing a tool today that I've been working on over this year that helps break down binaries into smaller functional clusters and uses Gemini to describe their relationships, behavior and the overall malware functionality. It's called XRefer and it is out for you to read about and try out. Check out the write up here, and look below for some examples: https://t.co/qLxJMOgePy

[Ramin Nafisi @MalwareRE]

Frequent freeloader part II: After co-opting the tools and infrastructure of another nation-state threat actor to facilitate espionage activities, Secret Blizzard used those tools and infrastructure to compromise targets in Ukraine. These campaigns consistently led to the download of Secret Blizzard’s custom malware, with the #Tavdig backdoor creating the foothold to install their #Kazuar V2 backdoor.
#SecretBlizzard
https://t.co/cO7coGJsaZ

[Kristina Balaam @chmodxx_]

Excited to be able to publicly share the research I've been focusing on (and off) for the past several months! ~ https://t.co/xYFKqwaR3D

[hasherezade @hasherezade]

#FlareOn11 is over, so I published the repository with all my source codes: https://t.co/jmk53qXLyK. Write-ups coming soon!

[allthingsida @allthingsida]

tldw;

For #flareon11 challenge #10 by @_marklech_, here's the approach I took:

1. Use UEFI Tool to extract the Shell app from the bios file
2. Use efiXplorer and Lumina to bring it as many symbols as possible
3. Use the angr framework to solve flag #1 and flag #2
4. For flag #3, full RE of the virtual machine
5. Implement a VM disassembler
6. Implement a VM decompiler: bytecode -> x64 assembly -> Hex-Rays decompiler -> C pseudocode
7. For fun, solve flag #1 and flag #2 again but with KLEE (on the decompiled bytecode which is now VM interpreter free and in clean C form)
8. Solve flag #3 with a bit of bruteforce

The most fun part was converting the bytecode back to pseudocode (going through x64 assembly first) and taking the blackbox approach with both angr and KLEE.

All files are online here: https://t.co/7RSHUqpuoo (fully documented IDB, KLEE adapated bytecode, angr driver, and bytecode decompiler via x64asm, etc.).

[Mark @_marklech_]

@hasherezade 💓

[Mark @_marklech_]

Earlier this year, before leaving Mandiant, I had the opportunity to create Challenge #10 for the #FlareOn11 CTF! Here’s a quick rundown of the challenge. 🧵⬇️

[jro @junr0n]

Solving (and Pwning) Flare-On Level 10

https://t.co/4GYWBpCkzt

#flareon11

[hasherezade @hasherezade]

My solution for the 10-th task: https://t.co/QgnkYx6cVd #FlareOn11

[allthingsida @allthingsida]

Flare-On 11's CatBert CTF challenge walkthrough

https://t.co/cescC2LcRB

#flareon11

[Mark @_marklech_]

I hope you enjoyed tackling this year’s challenge! Looking forward to reading everyone’s solutions and learning from the unique approaches. #flareon11

[Mark @_marklech_]

In crafting my solution, I opted for a straightforward approach. For more advanced techniques, I often look to @allthingsida’s content. This year, he shared his own solution in a fantastic video that you can check here 🎥 :https://t.co/3YoTOed90f