oalabs

Live Stream VOD: Hermetic Wizard WMI Spreader Reverse Engineering COM

In this Twitch stream we continue our analysis of the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine. In this stream we focus on the COM component that is used to interface with WMI.

Sample: a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec

Research Notes: 2022-03-14 01:30:56 +0000 UTC View Post

Live Stream VOD: Hermetic Wizard WMI Spreader Analysis

In this Twitch stream we take a look at the WMI spreader component of the Hermetic Wizard malware used in the recent cyber attacks on Ukraine. 

Sample: a259e9b0acf375a8bef8dbc27a8a1996ee02a56889cba07ef58c49185ab033ec 

Research Notes: 2022-03-12 06:46:34 +0000 UTC View Post

Live Stream VOD: Analysis of Leaked Conti Ransomware Source Code

In this Twitch stream we review the leaked Conti v2 ransomware source code and learn more about its capabilities as well as the developers who developed the ransomware. 

Some backstory here, a twitter account @contileaks began posting leaked chat logs and source code from the Conti ransomware group. Initially they posted a password protected archive of the Conti v2 source code. Later posted an a...

Live Stream VOD: Hermetic Wiper Analysis

In this Twitch stream we start our analysis of the Hermetic Wiper malware that was deployed as part of a cyber attack on Ukraine. The wiper binary is signed using a code signing certificate issued Hermetica Digital Ltd. The wiper also abuses legitimate drivers from the EaseUS Partition Master.

Sample: 2022-03-04 02:21:45 +0000 UTC View Post

Live Stream VOD: Follow-Up On STL C++ Reversing Mistakes

In this Twitch stream we follow-up on some issues we had reversing C++ STL types our last stream. We are forever grateful to Rolf for the help!

Sample: 7d47e5871efc4c079531513f29926d394922d7954701f34dc6244ea311d20969

MÖBIUS STRIP REVERSE ENGINEERING

We received a lot of help from Rolf of 2022-03-04 00:11:54 +0000 UTC View Post

Live Stream VOD: Reverse Engineering Polyglot Dropper Malware STL C++ Stage 3

In this Twitch stream we reverse engineer the third stage of a polyglot JPG dropper that was distributed via WeChat.

Sample: 7d47e5871efc4c079531513f29926d394922d7954701f34dc6244ea311d20969 

The malware is possibly related to Ghost RAT, based on the use of the export PluginMe.

Fu...

Hunting The XOR Keys For Hashed Imports - Emotet Example

With HashDB we have a new powerful tool to deal with malware that is using API hashing. If you missed our tutorial on API hashing and how HashDB can be used to resolve hashed imports you can view it on YouTube. In addition to hashing API names some malware families will XOR the API hashes with a XOR key t...

Live Stream VOD: Reverse Engineering Polyglot Dropper Malware

In this Twitch stream we reverse engineer a dropper that is using a polyglot JPEG file to deliver its second stage payload. 

The mawlare is currently unknown. Submissions to VirusTotal indicate that the original file name was 申博公司服务器采购表.exe which roughly translates to Shenbo company server purchase form.exe

SHA256: 2022-02-22 00:48:36 +0000 UTC View Post

Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 5

In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.

In this part we complete the following work:

• Implement CREATE_PROCESS_DEBUG_EVENT
• Build an automated dumper for x86 VMProtect malware

The code is open source and posted on our GitHub: 2022-02-19 01:35:06 +0000 UTC View Post

Live Stream VOD: Building A Debugger From Scratch - TrashDBG Part 4

In this Twitch stream we continue to build a debugger from scratch. The purpose of building a debugger is to gain a better understanding of how debuggers work and how the general Windows debugging process works under the hood.

In this part we implement hardware breakpoints!

The code is open source and posted on our GitHub: TrashDBG

All coding of the debugger is done live on stream so ...

Practical Calling Conventions For Reverse Engineers

Calling Conventions

• Different conventions based on processor, OS, and language
• Describes how arguments are passed to functions
• Describes how values are returned from functions
• Describes if the caller or callee cleans the stack
• Responsible for function prologue and epilogue

Practical Calling Conventions

2022-02-17 07:27:27 +0000 UTC View Post

Assembly Calling Convention: __stdcall

Calling Convention: __stdcall

• Calling convention for WIN32 APIs
• Arguments are passed on the stack (pushed right-to-left)
• Callee is responsible for stack cleanup

MSDN __stdcall documentation 

Assembly Calling Convention: __fastcall

Calling Convention: __fastcall

• Calling convention may be specified by the developer or added by the compiler as an optimization
• The Borland compiler (Delphi) uses a different version of __fastcall as the default calling convention
• Microsoft: first two DWORD arguments are passed in
  ECX and EDX (left-to-right)
• Borland: first three D...
  2022-02-17 07:10:12 +0000 UTC View Post

Assembly Calling Convention: __thiscall

Calling Convention: __thiscall

• Calling convention for C++ class members
  (passing the “this” object)
• Arguments are passed on the stack (pushed right-to-left)
• An additional argument, the “this” object pointer, is passed in the ECX register
• Callee is responsible for stack cleanup

Rev...