In this post I will write about achieving persistence using some unconventional methods . These methods does not use any registry key and they are more stealthy as compared to more mainstream methods . Well there is only one method but this works in a lot of software . One…

This will be a line by line static analysis of the hancitor malware . I will be using Ghidra and IDA . I am using Ghidra because i dont have IDA decompiler and I am using IDA because I feel like IDA does it better when it comes to assembly…

I have a passion for backdooring things . So this time after backdooring linux iso files i tried to backdoor windows ISO files . Adding backdoor to linux ISO file is fairly easy as the OS is open source but when it comes to windows its hard . The backdoor…

I found this bug a while ago . This bug requires initial access . Its great for post exploitation . Discord keeps a sqlite database called installer.db . The database has sha256 hashes of every file that discord uses but it turns out that the integrity of some files are…

Malwares will sometimes run shellcode directly in memory . The common method to do that is first use VirtualAlloc to allocate memory with the right permissions . Then the malware will use RtlMoveMemory to write the shellcode to the allocated space . Then it will create thread to pass the…

I am writing this blog with hopes that i will probably get hired by someone . I have been trying to get a job in IT but cant seem to impress . I have done enough projects which gave me enough confidence that i can make anything . I like…

Beacon frame : Here is the wikipedia defination . Beacon frame is one of the management frames in IEEE 802.11 based WLANs. It contains all the information about the network. Beacon frames are transmitted periodically, they serve to announce the presence of a wireless LAN and to synchronise the members…

I have been analysing maldocs for few days . I analysed two variants of emotet but i will write about only one variant . This will be a static analysis . First download the samples from here:https://github.com/jstrosch/malware-samples/blob/master/maldocs/emotet/2020/January/samples.zip I dumped the macros using oledump . The streams with M/m contains the…

Since you are here , i am going to assume that you know basic about syscalls and how to call them as well as how to assemble and link the assembly files . You may have a question . Why assembly ? Well there are two reasons . My life…