The third and final part in our series on the new Pikabot core! In this stream complete our custom emulator to automatically extract encrypted strings from the malware and create a few yara rules f...
2023-12-02 02:42:47 +0000 UTC View Post
The second part in our series on the new Pikabot core! In this stream we begin to build a custom emulator to automatically extract encrypted strings from the malware.
Just a heads up......
2023-12-02 02:40:27 +0000 UTC View Post
Pikabot is back! New loader, new string encryption, indirect syscalls and more! Join us for our initial triage of the core module. In this stream we focus on the dynamic API resolution and st...
2023-11-18 16:12:52 +0000 UTC View Post
In this Twitch stream we continue our work on an automated string recover tool for ADVObfuscator by extending it to handle custom variants with globals and AVX instructions.
In this Twitch stream we begin building a tool to assist with string recovery for malware that is protected with ADVObfuscator.
In this Twitch stream we build a config extractor for Mystic Stealer that is able to handle their "custom" obfuscation.
NOTE: We are troubleshooting some issues with Patreon video embeds. If ...
2023-10-24 14:00:05 +0000 UTC View Post
In this Twitch stream we continue our previous work on Garble Go string de...
2023-10-18 13:00:32 +0000 UTC View Post
In this Twitch stream we extend our previous work on Garble Go string decr...
2023-10-18 12:59:20 +0000 UTC View Post
A light Twitch stream taking a look at possibly world's worst cryptor... totally FUD until you upload to VirusTotal lol! This is just a silly stream but sometimes you have to call it out when you s...
2023-09-26 15:30:01 +0000 UTC View Post
In this Twich stream we take a closer look at Limerat and open source .NET RAT that has become very popular. Our goal is to build a stand alone configuration extractor that will extract all of the ...
2023-09-26 15:01:01 +0000 UTC View PostIn this Twitch stream we continue our efforts to recover strings encrypted with the Garble GoLang obfuscator. We manage to identify a common pattern that not only allows us to identify Go samples w...
2023-09-01 14:35:01 +0000 UTC View PostIn this Twitch stream we take a look at Bandit, a new infostealer written in GO that primarily targets browser credentials and crypto wallets. The collected information is uploaded to Telegram with...
2023-09-01 14:30:02 +0000 UTC View PostThis is the last part in our five-part tutorial series on emulation. In this module we learn how to use a full User-Mode emulator capable of running a PE f...
2023-08-29 22:35:04 +0000 UTC View PostThis is the fourth part in our five-part tutorial series on emulation. In this module we expand our capabilities with Unicorn using the Unicorn hooks. We build a...
2023-08-29 22:23:16 +0000 UTC View PostThis is the third part in our five-part tutorial series on emulation. In this module we learn how to apply emulation to common reverse engineering tasks. ...
2023-08-29 22:15:39 +0000 UTC View PostThis is the second part in our five-part tutorial series on emulation. In this module we learn how to use the Unicorn emulator for simple emulation tasks. The module is...
2023-08-29 21:59:13 +0000 UTC View PostThis is the first part in our five-part tutorial series on emulation. In this module we begin by learning how an emulator works under the hood. The module is accompani...
2023-08-29 21:42:04 +0000 UTC View PostIn this stream we take a look at a lightly obfuscated version of Glupteba. This malware has multiple components but our focus is on the loader.
In this stream we take a look at this RootTeam is a GO stealer that can be built via a Telegram channel. Originally we confused this with BanditStealer but it is separate ... also we try of this ne...
2023-08-20 01:16:16 +0000 UTC View Post
In this stream we take a look at TruBot which has been in the news thanks to a recent Cybersecurity and Infrastructure Security Agency (CISA) report. Stick around for some ... interesting ... yara ...
2023-07-27 17:49:30 +0000 UTC View Post
In this stream we take a look at a new stealer that might be named "StatusRecorder" according to its C2 panel? The malware itself is very straight forward and we quickly create a Yara rule and star...
2023-07-24 15:00:05 +0000 UTC View Post
In this stream we take a close look at a multi-stage malware delivery system which is used to prepare the target so the final payload is not detected. There are a few tricky parts but this is a ver...
2023-07-19 18:11:20 +0000 UTC View Post
This is a bit of a different stream where we investigate a novel idea from @mishap where emulation is performed only on memory ...
2023-07-18 00:48:33 +0000 UTC View Post
This is a crazy 7h long dev stream! We probably won't do another one of these but if you like you can watch in real time I as build a generic string decryption tool for the xorstr library.
In this twitch stream we continue our analysis of RisePro but shift our focus to the string encryption library xorstr. The main focus of this stream is investigating use of the xorstr library in ma...
2023-07-05 18:20:40 +0000 UTC View Post
In this twitch stream we take a look at RisePro a stealer that shares a lot of code with PrivateLoader. The main focus of the stream is investigating the similarities between PrivateLoader and Rise...
2023-07-05 18:14:30 +0000 UTC View Post
In this Twitch stream we continue our triage of this new loader that uses AMSI bypasses to avoid detection. In this part we focus on the injected X64 shell code. The shell code uses relative offset...
2023-06-20 15:01:02 +0000 UTC View Post
In this Twitch stream we begin to triage a new loader that uses AMSI bypasses to avoid detection. The loader itself is .NET but as we dig deeper we discover that the AMSI bypass is implemented in P...
2023-06-20 14:59:02 +0000 UTC View Post
Join us as you help us rank the worst malware we have ever reverse engineered!
Special thanks to @huettenhain for...
2023-06-15 14:59:02 +0000 UTC View Post
In this Twitch stream we triage Metastealer creating a Yara rule and config extractor.