BOOMSLANG Mobile fraud family analysis
https://www.liansecurity.com/#/main/news/mlRmJIwB203zX1eeD8-r/detail
https://www.liansecurity.com/#/main/news/mlRmJIwB203zX1eeD8-r/detail
Secret Handshake A Mutual TLS Based C2 Communication Channel - John Conwell | CypherCon 6.0
https://www.youtube.com/watch?v=AOWFM-JhW3g&list=PLUC_sTnMl8NxZqs4b2Rt8VygLaquV5vY_
https://www.youtube.com/watch?v=AOWFM-JhW3g&list=PLUC_sTnMl8NxZqs4b2Rt8VygLaquV5vY_
YouTube
Secret Handshake A Mutual TLS Based C2 Communication Channel - John Conwell | CypherCon 6.0
(S6:E57) Secret Handshake A Mutual TLS Based C2 Communication Channel - John Conwell - CypherCon 6.0 - Wisconsin
Secret Handshake A Mutual TLS Based C2 Communication Channel
One of the goals of malware command & control (C2) communication is to blend into…
Secret Handshake A Mutual TLS Based C2 Communication Channel
One of the goals of malware command & control (C2) communication is to blend into…
Obfuscating native code for fun: Part 1 - Introduction
https://blog.es3n1n.eu/posts/obfuscator-pt-1/
https://github.com/es3n1n/obfuscator
https://blog.es3n1n.eu/posts/obfuscator-pt-1/
https://github.com/es3n1n/obfuscator
blog.es3n1n.eu
Obfuscating native code for fun: Part 1 - Introduction
In this series of posts, I will try to cover all the common knowledge you would need to create your PE bin2bin obfuscator. This year I saw a rise of interest in the topics of software obfuscation and deobfuscation, yet I didn’t see any new open-source projects…
Ghidra Basics - Identifying, Decoding and Fixing Encrypted Strings
https://embee-research.ghost.io/ghidra-basics-identifying-and-decoding-encrypted-strings/
https://embee-research.ghost.io/ghidra-basics-identifying-and-decoding-encrypted-strings/
Embee Research
How To Use Ghidra For Malware Analysis - Identifying, Decoding and Fixing Encrypted Strings
Manual identification, decryption and fixing of encrypted strings using Ghidra and x32dbg.
знаете что мне в голову пришло, на обложке hybrid theory изображен человек с крыльями бабочки стреокозы (?? у стрекозы четыре крыла), и в клипе papercut вылетают стрекозы. интересно связано ли это както или хуйня.
Abusing Liftoff assembly and efficiently escaping from sbx
https://retr0.zip/blog/abusing-Liftoff-assembly-and-efficiently-escaping-from-sbx.html
https://retr0.zip/blog/abusing-Liftoff-assembly-and-efficiently-escaping-from-sbx.html
Extracting Strings from Go and Rust Executables
https://www.mandiant.com/resources/blog/extracting-strings-go-rust-executables
https://www.mandiant.com/resources/blog/extracting-strings-go-rust-executables
Google Cloud Blog
FLOSS for Gophers and Crabs: Extracting Strings from Go and Rust Executables | Google Cloud Blog
Reverse engineering Android 2FA OTP application
https://marcoguerri.github.io/2023/09/09/android-home-banking.html
https://marcoguerri.github.io/2023/09/09/android-home-banking.html
marcoguerri
Reverse engineering Android 2FA OTP application
As part of my disaster recovery plan, I want to have offline backup of 2FA codes for online banking to generate OTPs without my phone in case of emergency. This required reverse engineering my bank’s Android OTP application, that I expected would reveal some…
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC
https://gist.github.com/testanull/dac6029d306147e6cc8dce9424d09868
https://gist.github.com/testanull/dac6029d306147e6cc8dce9424d09868
Gist
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC
SharePoint Pre-Auth Code Injection RCE chain CVE-2023-29357 & CVE-2023-24955 PoC - SharePwn_public.py
Bad Zip and new Packer for Android/BianLian
https://cryptax.medium.com/bad-zip-and-new-packer-for-android-bianlian-5bdad4b90aeb
https://cryptax.medium.com/bad-zip-and-new-packer-for-android-bianlian-5bdad4b90aeb
Medium
Bad Zip and new Packer for Android/BianLian
I got my hands on a new sample of Android/BianLian (sha256: 0070bc10699a982a26f6da48452b8f5e648e1e356a7c1667f393c5c3a1150865), a banking…