Malware Analysis

Virtualization is a powerful technique for code obfuscation, and reversing it can be challenging. In this post, we cover the work done during an internship on developing an automated devirtualization tool. We explore a simplified taint-based approach and discuss its limitations. For a more in-depth analysis, the full report is also made available.

BLint is a Binary Linter to check the security properties, and capabilities in your executables. Since v2, blint is also an SBOM generator for binaries. - owasp-dep-scan/blint

SEMA is based on angr, a symbolic execution engine used to extract API calls. Especially, we extend ANGR with strategies to create representative signatures based on System Call Dependency graph ...

This blog will share a tried and tested method for dealing with thousands of unknown functions in a given file to significantly decrease the time spent on analysis while improving accuracy. Once all theory is covered, an instance of the Golang based qBit stealer is analyzed with the demonstrated techniques to show what happens when the theory is put into practice.

Static deobfuscator for Themida/WinLicense/Code Virtualizer's mutation-based obfuscation. - ergrelet/themida-unmutate

Elastic Security detection content for Endpoint.

Note: Volexity has reported the activity described in this blog and details of the impacted systems to CERT at the National Informatics Centre (NIC) in India. In 2024, Volexity identified a cyber-espionage campaign undertaken by a suspected Pakistan-based threat actor that Volexity currently tracks under the alias UTA0137. The malware used in these recent campaigns, which Volexity tracks as DISGOMOJI, is written in Golang and compiled for Linux systems. Volexity assesses with high confidence that UTA0137 has espionage-related objectives and a remit to target government entities in India. Based on Volexity’s analysis, UTA0137’s campaigns appear to have been successful. DISGOMOJI appears to be exclusively used by UTA0137. It is a modified version of the public project discord-c2, which uses the messaging service Discord for command and control (C2), making use of emojis for its C2 communication. The use of Linux malware for initial access paired with decoy documents (suggesting a […]

A simple commandline application to automatically decrypt strings from Obfuscator protected binaries - cod3nym/Deobfuscar

A simple crossplatform heuristic PE-analyzer.

This blog entry provides an analysis of the Noodle RAT backdoor, which is likely being used by multiple Chinese-speaking groups engaged in espionage and other types of cybercrime.

Elastic Security Labs observed threat actors masquerading as recruiting firms to deploy a new malware backdoor called WARMCOOKIE. This malware has standard backdoor capabilities, including capturing screenshots, executing additional malware, and reading/writing files.

A command line Windows API tracing tool for Golang binaries. - leandrofroes/gftrace

An analysis of a diverse dataset of Windows malware extracted from more than 100,000 samples revealing insights into the most prevalent tactics, techniques, and procedures.

Sigma rules from Joe Security.

This article provides an in-depth look into two techniques used by Earth Freybug actors: dynamic-link library (DLL) hijacking and application programming interface (API) unhooking to prevent child processes from being monitored via a new malware we’ve discovered and dubbed UNAPIMON.

A list of useful tools for Malware Analysis (will be updated regularly) - ashemery/malware-tools

Automated static analysis tools for binary programs - cmu-sei/pharos

The COM Hijacking technique is often utilized by threat actors and various malware families to achieve both persistence and privilege escal...

Following our guide about regular expressions, we present a new unique tool that can help you with a creation of such expressions, mainly for those used in the YARA Cuckoo module.    To fully understand the benefits of our new open-source project, we first expand our knowledge about regular expressions in the Cuckoo module, share resources […]

SRE - Dissecting Malware for Static Analysis & the Complete Command-line Tool - GitHub - malsearchs/Static-Reverse-Engineering-SRE: SRE - Dissecting Malware for Static Analysis & th...

An easy-to-use library for emulating memory dumps. Useful for malware analysis (config extraction, unpacking) and dynamic analysis in general (sandboxing). - GitHub - mrexodia/dumpulator: An easy-t...

YARA malware query accelerator (web frontend). Contribute to CERT-Polska/mquery development by creating an account on GitHub.

Trigram database written in C++, suited for malware indexing

The Lumma information-stealing malware is now using an interesting tactic to evade detection by security software - the measuring of mouse movements using trigonometry to determine if the malware is running on a real machine or an antivirus sandbox.

SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also contains its own custom disassembler, with many innovative featur...

Python library to parse and convert Sigma rules into queries (and whatever else you could imagine) - GitHub - SigmaHQ/pySigma: Python library to parse and convert Sigma rules into queries (and what...

Titan is a VMProtect devirtualizer. Contribute to archercreat/titan development by creating an account on GitHub.

Userspace eBPF runtime for fast Uprobe & Syscall hook

Reverse Engineer's Toolkit. Contribute to mentebinaria/retoolkit development by creating an account on GitHub.

toolkit for python reverse engineering. Contribute to Fadi002/de4py development by creating an account on GitHub.