@cyb3rops I understand where Shellter is coming from here, and while I agree it would be nice for Elastic to have reported this directly- I don’t see this being feasible for every suspected case. I also don’t see anything in their signatures you couldn’t create via the malicious binaries?
The slides from our @reconmtl talk, "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" (CC @nicolodev), are now online!
Slides: https://t.co/O9s6ItbHFw
Plugin: https://t.co/cek4bXbNyB
@_winter_wonders This is really cool! I’m curious if in this visual form, could you still differentiate malware families even after obfuscation passes?
Did you know that WinDbg has a `dx` command that lets you define variables, cast memory, and walk structures?
Here's some absolutely cursed code I wrote today to walk the PEB, locate ntdll.dll, and dump its exports - using only `dx`!
After #flareon11 challenge 7, I got inspired to build tooling for #dotnet Native AOT reverse engineering.
As such, I built a #Ghidra Analyzer that can automatically recover most .NET types, methods and frozen objects (e.g., strings).
Blog:👉https://t.co/qmGBlgCUir
@0x6D6172636F Using the CAPA plugin in IDA is a game changer on large binaries where drilling down functionality would be miserable otherwise, fully agreed
Huge congrats to @b_sendpacket and @Autonomatom for being the first students to finish the Introduction to Malware Binary Triage (IMBT) course! They have now received their certificates of completion 🥳