Greetings and salutations fellow readers. Recently I’ve had to step into the awful world of kernel debugging. When malware drops a rootkit and conventional userland debugging falls short, you have to step into ring 0. Unfortunately, options are rather limited when it comes to decent ring0 debugging on windows. What’s that one debugger everyone’s heard […]
Back for part 2 are we? Let’s get this show on the road. We’ve seen how awful the first piece of malware was in terms of how it was thrown together in all but 10 minutes, but you aint seen nothing yet. The next one actually embeds passwords inside and even email addresses. After that, […]
Howdy all! On this glorious Saturday night we’re going to go over how to unpack the ‘Local-App-Wizard’ packer. The way the packer works is by creating a suspended process of itself, hollowing it out / allocating the space with memory mapped files, and writing the contents of the unpacked version of itself to this newly […]
Howdy all! It’s been a dog’s age. I’ve been busy with work and personal things. I enjoyed a brief 3 month relationship only to return to a life of loneliness. For now anyways. CactusCon went well. Had a nice turn out for my work shop. Hopefully the attendees learned something as I tried to make […]
Salutations! Just wanted to share a couple things. First off, I encountered some clever malware. By checking to see if an audio device is enabled (by adjusting the volume), the malware knows not to run if it can’t. Because honestly, who enables audio drivers on their VM? Other than that, I whipped up a little […]
Howdy all! Been a great few weeks. Lots of ideas flowing and lots more malware to work on. I got it down to a science now. What I’ve been digging into lately is taking advantage of the Python shell inside immunity debugger. The library is feature rich and combines the capabilities of Immunity with the […]
Seasons greetings from your fellow hacker cracker, AverageJoe. Tonight I’d like to go over some malware I spent the better part of November going through off and on. Its a part of the payload delivered by an exploit kit called Neutrino. Perhaps you’ve heard of it? Anywho, let’s get down to business. First things first, […]
So here I am at work on Christmas Eve (because I have no soul) and the malware is insulting me. See it? Fuck you too buddy! And in another one, to be an asshole, they embedded their program in another program. I was wondering why IDA was showing a stub program less than 5 kb […]
I came across this one individual’s page whom is an avid reverse engineer with some great material. Check out his pdf cheat sheet on anti-debugging. There were a few in there I didn’t know about like the ‘csr’ trick which involves calling an undocumented ‘CsrGetProcessId’ function within OpenProcess. CsrGetProcessId is a native API that returns […]
Some may say this is crazy, I call it Wednesday. This came across my desk yesterday and I worked it out today. It came as the payload following a java exploit from an old 2012 CVE (SecurityManager one I think). I’m calling it 0day because there were no listing for the exe in VirusTotal / […]