In this post I will write about achieving persistence using some unconventional methods . These methods does not use any registry key and… — In this post I will write about achieving persistence using some unconventional methods . These methods does not use any registry key and they are more stealthy as compared to more mainstream methods . Well there is only one method but this works in a lot of software . One…

This will be a line by line static analysis of the hancitor malware . I will be using Ghidra and IDA . I am using Ghidra because i dont… — This will be a line by line static analysis of the hancitor malware . I will be using Ghidra and IDA . I am using Ghidra because i dont have IDA decompiler and I am using IDA because I feel like IDA does it better when it comes to assembly…

I have a passion for backdooring things . So this time after backdooring linux iso files i tried to backdoor windows ISO files . Adding… — I have a passion for backdooring things . So this time after backdooring linux iso files i tried to backdoor windows ISO files . Adding backdoor to linux ISO file is fairly easy as the OS is open source but when it comes to windows its hard . The backdoor…

I found this bug a while ago . This bug requires initial access . Its great for post exploitation . Discord keeps a sqlite database called… — I found this bug a while ago . This bug requires initial access . Its great for post exploitation . Discord keeps a sqlite database called installer.db . The database has sha256 hashes of every file that discord uses but it turns out that the integrity of some files are…

Malwares will sometimes run shellcode directly in memory . The common method to do that is first use VirtualAlloc to allocate memory with… — Malwares will sometimes run shellcode directly in memory . The common method to do that is first use VirtualAlloc to allocate memory with the right permissions . Then the malware will use RtlMoveMemory to write the shellcode to the allocated space . …

I am writing this blog with hopes that i will probably get hired by some gentleman/woman . I have been trying to get a job in IT but cant… — I am writing this blog with hopes that i will probably get hired by someone . I have been trying to get a job in IT but cant seem to impress . I have done enough projects which gave me enough confidence that i can make anything . I like…

Beacon frame : Here is the wikipedia defination . Beacon frame is one of the management frames in IEEE 802.11 based WLANs. It contains all… — Beacon frame : Here is the wikipedia defination . Beacon frame is one of the management frames in IEEE 802.11 based WLANs. It contains all the information about the network. …

I have been analysing maldocs for few days . I analysed two variants of emotet but i will write about only one variant . This will be a… — I have been analysing maldocs for few days . I analysed two variants of emotet but i will write about only one variant . This will be a static analysis . First download the samples from here:https://github.com/jstrosch/malware-samples/blob/master/maldocs/emotet/2020/January/samples.zip

Since you are here , i am going to assume that you know basic about syscalls and how to call them as well as how to assemble and link the… — Since you are here , i am going to assume that you know basic about syscalls and how to call them as well as how to assemble and link the assembly files . You may have a question . Why assembly ? Well there are two reasons . My life…