#DOSfuscation - Twitter Hashtag

over 6 years ago

Işık Üniversitesi Siber Güvenlik Yüksek Lisans Program��'nda @absucan ile birlikte Siber Olay Müdahalesi, Siber Saldırıların Tespit ve Analiz yöntemlerini anlattık. #DOSfuscation tekniğini kullanan #emotet zararlı yazılımını analiz ettik. @polatgo davetin için teşekkürler. #DFIR

IntrusionSkills's tweet photo. Işık Üniversitesi Siber Güvenlik Yüksek Lisans Program��'nda @absucan ile birlikte Siber Olay Müdahalesi, Siber Saldırıların Tespit ve Analiz yöntemlerini anlattık. #DOSfuscation tekniğini kullanan #emotet zararlı yazılımını analiz ettik. @polatgo davetin için teşekkürler. #DFIR https://t.co/mN5zicESP3

0

4

2

0

Sam King @Sam0rai

over 7 years ago

Thank U, @lennyzeltser, for a well thought-of and riveting lecture on the use of evasive #malware in the wild: from string replacement to packing to #DOSfuscation and #VBA-Stomping. The lecture - and the lunch chit-chat after - were truly a delight!

Sam0rai's tweet photo. Thank U, @lennyzeltser, for a well thought-of and riveting lecture on the use of evasive #malware in the wild: from string replacement to packing to #DOSfuscation and #VBA-Stomping.
The lecture - and the lunch chit-chat after - were truly a delight! https://t.co/D1W4yXoIf3

0

3

0

HackExplorer @Hack_Explorer

over 7 years ago

Here you will learn some tricks used to obfuscate commands malware scripts using CMD (#MSDOS) #Dosfuscation, and de-obfuscate an advanced dosfuscation scenario. #cybersecurity #security #Windows #malware #analysis #dedosfuscation Watch here: https://t.co/ton49Ygvv3

Hack_Explorer's tweet photo. Here you will learn some tricks used to obfuscate commands malware scripts using CMD (#MSDOS) #Dosfuscation, and de-obfuscate an advanced dosfuscation scenario.

#cybersecurity #security #Windows #malware #analysis #dedosfuscation
Watch here: https://t.co/ton49Ygvv3 https://t.co/lJ6cobLfXl

0

1

0

c't magazin @ctmagazin

over 7 years ago

Wenn unter Windows Malware heimlich das Kommando übernimmt, könnte #DOSfuscation dahinter stecken. Was das ist, erklärt c't-Redakteurin Olivia von Westernhagen in einem c't-Artikel und im aktuellen #ctuplink. (lmd) #security https://t.co/kpEMCRSht9

ctmagazin's tweet photo. Wenn unter Windows Malware heimlich das Kommando übernimmt, könnte #DOSfuscation dahinter stecken. Was das ist, erklärt c't-Redakteurin Olivia von Westernhagen in einem c't-Artikel und im aktuellen #ctuplink. (lmd) #security
https://t.co/kpEMCRSht9 https://t.co/dw5iVsCpUU

0

2

0

c't magazin @ctmagazin

over 7 years ago

Rechtzeitig zum Kaffee gibts den neuen c't uplink 29.0: Diesmal beschäftigen wir uns mit #5G. Was können wir von dem Standard erwarten? Außerdem geht's um einen Formate-Streit und #DOSfuscation. (lmd) #ctuplink https://t.co/kpEMCRSht9

ctmagazin's tweet photo. Rechtzeitig zum Kaffee gibts den neuen c't uplink 29.0: Diesmal beschäftigen wir uns mit #5G. Was können wir von dem Standard erwarten? Außerdem geht's um einen Formate-Streit und #DOSfuscation. (lmd) #ctuplink
https://t.co/kpEMCRSht9 https://t.co/PS83QpHFxc

0

4

1

0

oR10n @oR10nLabs

over 7 years ago

Sharing my analysis of an #Emotet maldoc I stumbled upon a few days ago. Interesting usage of #DOSfuscation techniques! https://t.co/ysElYrxRIg

0

1

0

Daniel Bohannon @danielhbohannon

almost 8 years ago

@DissectMalware Indeed, /V:ON, /VeryCool and /VeryVeryCool are great for enabling same-session #DOSfuscation goodness.

3

6

0

Malwrologist

@DissectMalware

almost 8 years ago

note: !var! is used in #DOSfuscation I am trying to deobfuscate its output so tested a few combination to have a better understanding of how it works

0

3

0

Malwrologist

@DissectMalware

almost 8 years ago

I should also thank @danielhbohannon as I got the idea of padding commands from his #DOSfuscation tool. * the techniques are new (at least to the best of my knowledge). Some of them can be used in batch as well like and or operators

0

4

0

Malwrologist

@DissectMalware

almost 8 years ago

@danielhbohannon @mattnotmax I am glad that you liked it. I learned new things while playing with your #DOSfuscation tool.

0

2

0

Malwrologist

@DissectMalware

almost 8 years ago

@mattnotmax @danielhbohannon I tested with #DOSfuscation and improved the #batch_deofuscator code. Now, it can (almost) deobfuscate code generated with payload/concat/1 & 2 (easy & medium)

3

5

1

0

Nick Carr

@ItsReallyNick

almost 8 years ago

@snowbrick_ @pmelson @vysecurity @Hexacorn .@danielhbohannon's #DOSfuscation research. That's the single best place to read up on cmd.exe Character Insertion Obfuscation (pages 11-15): https://t.co/6YLCpj4DRa Carets, double quotes, parentheses, commas, semicolons - oh my!

ItsReallyNick's tweet photo. @snowbrick_ @pmelson @vysecurity @Hexacorn .@danielhbohannon's #DOSfuscation research.
That's the single best place to read up on cmd.exe Character Insertion Obfuscation (pages 11-15): https://t.co/6YLCpj4DRa

Carets, double quotes, parentheses, commas, semicolons - oh my! https://t.co/a0HhDyfhTQ

0

11

6

1

0

Cyber_Ravan

@cyber_ra1

about 8 years ago

Deobfuscation of obfuscated DOS command/payload. Thanks @struppigel for the DOSfuscation Deobfuscation video (https://t.co/gfsyAJII7T) learn a lot form your Malware analysis YouTube channel. Sample: https://t.co/0VN0AZj98j cc @virusbay_io #DOSfuscation