In this Twitch stream we analyze the multi-stage delivery chain used to install Jupyter / Solarmarker InfoStealer. The delivery chain includes an Inno Installer, malicious Pascal script, malicious PowerShell script, and a reflectively loaded .NET assembly.
Stage 1 - Unpacking Inno (Pascal)
- Use Inno Extractor to extract all files from the Inno installer
2022-02-01 23:42:32 +0000 UTC
View Post
In this tutorial we unpack Night Sky Ransomware (x64) which is protected with VMProtect 3. We use VMPDump to dump and fix the imports and then re-create the virtualized entry point manually.
Tools
In this Twitch stream we unpack a VMProtect "soldier" implant developed by HackingTeam. Once we have unpacked the payload we write a static config extractor using Python.
Packed sample: 76840fa18df8764afb51f1aa6da10ff65f1bdfe434dc988917380fa31fbe3a73
Detailed notes are available on GitHub in our...
2022-01-28 04:55:18 +0000 UTC
View Post
Fixing OEP (Virtualized Entry Point)
This is the third part in our three-part tutorial series on unpacking VMProtect malware. At this stage we have dumped the unpacked PE payload. The entry point was virtualized so the dumped sample won't run but it could be statically reverse engineered -- if static reverse engineering is all that is required this final stage is not needed.
The MSVC Entry Point
Since the unpacked payload is an 2022-01-25 21:02:57 +0000 UTC
View Post
Debugging and Dumping
This is part two in our three-part tutorial series on unpacking VMProtect malware. We are attempting to unpack a sample that has been packed with VMprotect where the entry point has been virtualized but all other functions are not protected.
Unpacking Concept
The concept behind our approach is to use a sandbox to identify an API that is called by the malware payload (not the VMprotect code). Then use that API call as a "flag" to indicate...
2022-01-25 21:02:13 +0000 UTC
View Post
Overview of Unpacking vs. Devirtualization
This is the first part in our three-part tutorial series on unpacking VMProtect malware. When approaching a VMProtect malware sample it is important to understand the concept of a packer vs. a virtualizer. VMProtect offers both the option to pack files, and the option to virtualize individual functions. Depending on what options are selected by the malware developer it may be possible to trivially recover the protected payload.
2022-01-25 20:57:54 +0000 UTC
View Post
In this Twitch stream we test the latest Dev 3.0 release of Binary Ninja using our standard IDA Pro malware analysis workflow. Stick around to see what works, what doesn't, and what's next for Binja!
This wasn't a sponsored stream but we did get a free 30-day license from the folks over at Vector35. Our main reason for testing Binja is we have had a lot of feedback from independent rese...
2022-01-24 03:57:00 +0000 UTC
View Post
In this Twitch stream we reverse engineer the “WhisperGate” malware stages 2, 3, and 4. The first two stages are .NET obfuscated with NetReactor and EazFuscator, while Stage 4 is an x86 binary compiled with MinGW.
Stage 2 - Downloader: dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78
Stage 3 - File Corruptor (injector): 9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d
Stage 4 - Final...
2022-01-21 19:28:48 +0000 UTC
View Post
In this tutorial we discuss the __security_init_cookie and __scrt_common_main_seh functions and why the PE Entry Point on an MSVC binary does not point to Main.
This is an important concept to understand when first learning how to reverse engineer windows binaries, especially when using a debugger. Often it can be confusing when the debugger breaks on the PE Entry Point only to find some code that is not related to the main functionality of the binary. This code is often called "b...
2022-01-18 23:55:42 +0000 UTC
View Post
In this tutorial we are going to discuss simple ways to stay safe while handling malware in non-safe environments.
Malware Analysis Environment
The first step is to setup a safe analysis environment using a virtual machine set up with the FLARE-VM tools. Our full Dynamic Malware Analysis Lab Setup tutorial is available here on Patreon.
Make sure to disabled shared folder...
2022-01-18 03:56:53 +0000 UTC
View Post
Twitch live stream VOD. We generate IDA Pro FLIRT / FLAIR signatures for the mbedtls library in Night Sky ransomware and begin reverse engineering. Once we have a nice IDB we use BinDiff to compare NightSKy against Rook ransomware and confirm they are from the...
2022-01-16 00:29:40 +0000 UTC
View Post
Twitch live stream VOD. We begin reverse engineering NightSky ransomware and identify a statically compiled mbedtls library. We build mbedtls and use the .pdb file to quickly import the library structs.
Sample available on Malshare:
8c1a72991fb04dc3a8cf89605fb85150ef0e742472a0c58b8fa942a1f04877b0
Lab Notes:
2022-01-15 23:17:42 +0000 UTC
View Post
Twitch live stream VOD. We unpack NightSky ransomware which is packed with VMProtect 3 (but not fully virtualized). We also use Dumpulator to identify a complex function without needing to fully reverse engineer it.
Sample available on Malshare:
8c1a72991fb04...
2022-01-10 05:01:04 +0000 UTC
View Post
Twitch live stream VOD. We build a static config extractor for Qakbot / Qbot malware using Python. In this stream we complete building out the C++ structs for the malware, identify how the config is stored, and replicate the config decryption in Python.
Sample available on Malshare:
670e990631c0b98ccdd7701c2136f0cb8863a308b07ab...
2022-01-03 04:52:19 +0000 UTC
View Post
Twitch live stream VOD. We begin reverse engineering Qakbot / Qbot malware. In this stream we resolve the dynamic imports, decrypt the encrypted strings, and begin building out the C++ structs for the malware.
Sample available on Malshare:
670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bde4
La...
2021-12-26 22:48:02 +0000 UTC
View Post
Twitch live stream (clip). We take a look at Zeppelin Ransomware which is developed in Delphi. We go through the steps to correctly set up IDA Pro for analysis of a Delphi compiled binary including installing and using IDR (Interactive Delphi Reconstructor).
We don't start reverse engineering but our IDA configuration might be useful for other Delphi malware.
Zeppelin sample available on Malshare:
2021-12-23 04:02:34 +0000 UTC
View Post
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and complete our static config extractor in Python.
Sample available on Malshare:
c7990f1e72fdfa84552f02f9d11cabb74251b0508291af5366fefcee646f9c91
Lab Notes - includes code samples:
2021-12-23 03:41:58 +0000 UTC
View Post
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and begin building out the struct that is used for it's injected code. We also realize we should have read Chong's blog and actually patched API called to save us a lot of trouble... this was a struggle stream...
Sample available on Malshare:
2021-12-02 14:01:02 +0000 UTC
View Post
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and prepare it for full static analysis. We resolve the imports, decrypt the strings, and decrypt the embedded shell code.
Sample available on Malshare:
c7990f1e72fdfa84552f02f9d11cabb74251b0508291af5366fefcee646f9c91
Lab Not...
2021-12-01 14:01:07 +0000 UTC
View Post
Twitch live stream VOD. We take a look at the new Emotet binary and build a static config extractor.
Sample available on Malshare: eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827
Python config extractor:
2021-11-19 20:49:19 +0000 UTC
View Post
Twitch live stream VOD. We take a look at the new Emotet binary and slowly start reverse engineering it...
Sample available on Malshare: eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827
2021-11-18 14:00:07 +0000 UTC
View Post
2021-11-14 01:05:53 +0000 UTC
View Post
2021-11-14 01:02:55 +0000 UTC
View Post
Usually Python and IDA play nice but when they don't the troubleshooting process can be maddening. In this tutorial we will cover some IDA Python environment basics that can assist with troubleshooting and configuring a sane Python 3 environment for IDA Pro.
If you are running the latest version of IDA and you have a single Python environment installed on your host you may never need this guide. However, if you are like us, and you want to run multiple versions of IDA to sup...
2021-11-08 22:21:17 +0000 UTC
View Post
Twitch live stream VOD. This is our redemption stream! We finally deobfuscate the modified Confuser and extract the .NET payload.
2021-11-08 00:34:42 +0000 UTC
View Post
Twitch live stream VOD. We take a look at a garbage RAT that is written in .NET obfuscated with ConfuserEx and packed in Themida.
2021-11-07 23:27:21 +0000 UTC
View Post
In this tutorial we analyze the anti-debug checks in BlackMatter ransomware with IDA Pro. We use static analysis to determine exactly what the checks are doing.
BlackMatter sample:
Malshare Download
Anti-debug feature explained:
2021-10-15 17:00:15 +0000 UTC
View Post
In this tutorial we demonstrate how to bypass the anti-debug checks in BlackMatter ransomware with x64dbg.
BlackMatter sample:
Malshare Download
Anti-debug feature explained:
...
2021-10-15 16:53:21 +0000 UTC
View Post
