I came across a malware when i browsing any.run . I thought i would give it a try to reverse it , so i downloaded the sample and started reversing it . The tools that i used for this are Detect It Easy and procmon . …

In this post I will write about achieving persistence using some unconventional methods . These methods does not use any registry key and they are more stealthy as compared to more mainstream methods . Well there is only one method but this works in a lot of software . One…

This will be a line by line static analysis of the hancitor malware . I will be using Ghidra and IDA . I am using Ghidra because i dont have IDA decompiler and I am using IDA because I feel like IDA does it better when it comes to assembly…

I have a passion for backdooring things . So this time after backdooring linux iso files i tried to backdoor windows ISO files . Adding backdoor to linux ISO file is fairly easy as the OS is open source but when it comes to windows its hard . The backdoor…

I found this bug a while ago . This bug requires initial access . Its great for post exploitation . Discord keeps a sqlite database called installer.db . The database has sha256 hashes of every file that discord uses but it turns out that the integrity of some files are…

Malwares will sometimes run shellcode directly in memory . The common method to do that is first use VirtualAlloc to allocate memory with the right permissions . Then the malware will use RtlMoveMemory to write the shellcode to the allocated space . Then it will create thread to pass the…

I like to make things that break things if that makes sense so my dream job would be researching and making exploits ,tools,security tools,malwares for red teams for use in pentests etc . But i am ok with any job that lets my inner researcher out . So anyway here are the things I made A 3d game : I was working with an Indie game startup . They are making a 3d game . I worked with them for like 8 months . Here is the first level . I left the company cause they were getting lazy . This level is made by…

Beacon frame : Here is the wikipedia defination . Beacon frame is one of the management frames in IEEE 802.11 based WLANs. It contains all the information about the network. …

I have been analysing maldocs for few days . I analysed two variants of emotet but i will write about only one variant . This will be a static analysis . First download the samples from here:https://github.com/jstrosch/malware-samples/blob/master/maldocs/emotet/2020/January/samples.zip I dumped the macros using oledump . The streams with M/m contains the…