Malware-analysis-and-Reverse-engineering - Some of my publicly available Malware analysis and

项目说明

Malware-analysis-and-Re

Some of my publicly a Malware analysis and Reverse engineering (Reports, Tips, Tricks...)

<br/>

[[Reverse engineering KPOT v2.0 Stealer]]()

[[Debugging MBR - IDA + Bochs Emulator (CTF example)]]()

[[TLS decryption in Wireshark]]()

[[Ryuk Ransomware - API Resolving and Imports reconstruction]]()

[[Formbook Re]]()

[[Re encoded shellcode]]()

[[WINDBG Kernel&User Mode Debugging (EPROCESS, ETHREAD, TEB, PEB...)]]()

[[Cutter 2.0 - Introduction of new features (Reverse Debugging...)]]()

[[Tracing C function fopen]]()

Tracing C function fopen [Part1] - IDA Free User-Mode Walk-Through tracing to NTApi<br/>
Tracing C function fopen [Part2] - Windbg Kernel Debugging - Walk-Through User-Mode to Kernel Executi<br/>

[[ Sheet - Excel Binary File Format (.xls)]]()

[[Exploiting C (BlueKeep) using Metasploit (Manual settings GROOMBASE + GROOMSIZE)]]()

[[Abusing External Resource References MSOffice]]()

Abusing External Resource References MSOffice [part1] - TEMPLATE_INJECTION<br/>
Abusing External Resource References MSOffice [part2] - OLEOBJECT_INJECTION<br/>

[[Real-Time Solving CyberDefenders "DumpMe" MemoryForensics Challenge in 1 hour]]()

[[ Output Formatting Trick in PS]]()

[[Ad Memory Forensics (Windows) - Threat_Hunting and Initial Malware_Analysis]]()

[[LokiBot Analyzing]]()

[1] Lokibot analyzing - defeating GuLoader with Windbg (Kernel debugging) and Live C2<br/>
[2] Lokibot analyzing - spoofing GULoader and LokiBot C2 [part1] - Own implementation in Python<br/>
[2] Lokibot analyzing - spoofing GULoader and LokiBot C2 [part2] - INetSim + BurpSuite<br/>
[3] Lokibot analyzing - Re, API Hashing, decoding<br/>

[[Fast API resolving of RE related to Kaseya attack]]()

[[Dancing with COM - Deep dive into understanding Component Object Model]]()

What is COM and its Functionality, COM in Registry (Tools - COM ), COM Client-Server (Using Powershell/.NET COM Client), Re COM instances and methods in IDA (Structures, Types, ComIDA plugin), Interesting way of using COM Method in LokiBot malware sample<br/>

[[Hi - Bug in ACLs of Registry Hives]]()

[[Finding in PE parsing tool - NE tool you didn´t write by your own]]()

[[Re binary (Malware sample) which using statically imported OpenSource library]]()%20which%20using%20statically%20imported%20OpenSource%20library/Dealing%20with%20binary%20(Malware%20sample)%20which%20using%20statically%20imported%20OpenSource%20library.md)

Some notes, tips and tricks when you are dealing with re Malware sample which using statically imported OpenSource library<br/>

[[Re CryptoCrazy Ransomware - PoC Decryptor and some Tricks]]()

This video covers guide during re and making PoC decryptor in Python. In the last part of the video I will be co another Trick how you can dynamically invoke only the decryption routine of this Ransomware directly from Powershell and get all files decrypted.<br/>

[[Powershell and DnSpy tricks in .NET re – AgentTesla]]()

[[So you Really think you Know What Powershell Is ???]]()

Managed code code. Difficulties during re and debugging.<br/>
One nice example is Powershell ItSefl.<br/>

[[Full malware analysis Work-Flow of AgentTesla Malware]]()

[[Deobfuscation SmartAssembly 8+ and recreating Original Module SAE+DnSpy]]()

Video covers Deobfuscation of latest SmartAssembly 8+ (commercial obfuscator for .NET) using SAE (Simple-Assembly-Explorer)
and Recreating original module using DnSpy. [[Samples Download]]()<br/>

[[Ad DnSpy tricks in .NET re - Tracing, Breaking, dealing with ]]()

[[NightSky Ransomware – just a Rook RW fork in suit]]()

[[IDAPro Re Delphi MBR Wiper and Infected Bootstrap Code]]()

Sample, my prepared annotated IDA IDB, Bochs image: [[Download-Pass:infected]]()

[[.NET Re Get-PDIn - Dealing with P/Invoke, D/Invoke and Dynamic P/Invoke]]()

Video about .NET re of P/Invoke, D/Invoke and Dynamic P/Invoke implementation which serve for calling unmanaged code from managed. Co tool Get-PDIn [[Get-PDIn]]()

[[Malware Analysis Report – APT29 C2-Client Dropbox Loader]]()

Deep dive into reverse engineering APT29 C2-Client Dropbox Loader.

[[Analyzing HTML Application "HTA" Loading .NET Runtime]]()

[[From Zero to Hero - Ad Usage of Tiny_Tracer tracing APT29]]()

For more information - check the description below the video.

[[Ad DnSpy tricks in .NET re 2 - PS debugging, Watch , Code Optimization, more..]]()

Debugging Powershell process when debugging Powershell scripts - catch module loading (dnSpy)<br/>
DnSpy multi-process debugging<br/>
Dealing with code optimization during .NET debugging (when and why you can NOT see Locals and put a breakpoints)<br/>
Watch Windows in dnSpy - benefit from both (see fields, invoke expressions etc.)<br/>

[[Nati and Assembly Code In]]()

My first tips and tricks released under CPR @_CPResearch_ - showing practical usage of IDA-Appcall, Dumpulator and pure Unicorn Engine.<br/>
Getting the best and full of annotated code snippets.<br/>
Big thanks to my team members and who helped to make this cool.<br/>

[[Deobfuscation of .NET using PowerShelling & dnlib - Eternity Malware]]()

In this video, I will guide you through .NET deobfuscations co a few exciting tricks and tips.<br/>
We will be using PowerShell and dnlib library.<br/>
We will create a uni string deobfuscator for Eternity Malware that uses some kind of custom obfuscation that is not so trivial at first sight.<br/>

[[Pulling the Curtains on Azo: Not a Skidsware but Polymorphic Wiper]]()

Deep dive into re Azo - Polymorphic wiper, released under CPR @_CPResearch_ - showing not only main technical points but also many interesting anti-analysis and code obfuscation techniques.<br/>
Big thanks to my team members and who helped to make this cool.<br/>

[[Reverse Engineering Mixed Mode Assemblies (IDA, DnSpyEx)]]()

In this video, I will guide you through reverse engineering Mixed Mode Assemblies.<br/>
Example Sample of Mixed Mode Assembly: [[Source/binary]]())<br/>

[[DotRunpeX – demystifying new .NET injector used in the wild]]()

Defeating dotRunpeX — New .NET injector abusing ad techniques to deli malware families.<br/>
Released under CPR @_CPResearch_<br/>

[[Rorschach – A New Sophisticated and Fast Ransomware]]()

Re highly ad, lightning-fast, and very customizable Rorschach Ransomware. Because of the obfuscation and protection (custom UPX-style packer, , etc.), and the way it is being depolyed, the re process was quite a brain-buster.<br/>
Released under CPR @_CPResearch_<br/>

[[IDA Memory Snapshot - Amadey Malware Unpacking & Initterm Poisoning]]()

In this video, I will explain how the feature of IDA - Memory Snapshot works, what are the currently a options and the benefits of using them. We will use the IDA Memory Snapshotting on a practical example of unpacking Amadey Malware with all shellcode pre-stages.<br/>
In the last section, I will cover what _Initterm C++ internal function is, how it is used in the Amadey sample, and how malware can abuse that to run code before reaching the "main" method. In some cases (where we hijack the execution flow), we can refer to this technique as an _Initterm function table poisoning.<br/>

[[BYOS – Bundle Your Own Stealer]]()

In-depth analysis of the new malware strain dubbed BundleBot spreading under the radar. BundleBot is abusing the dotnet bundle (single-file), self-contained format that results in very low or no static detection at all.<br/>
Re several techniques that were approved to be effective for reverse engineering the dotnet bundle (single-file), self-contained format.<br/>
Released under CPR @_CPResearch_<br/>

[[R2R stomping – are you ready to run?]]()

Introducing a new method for running hidden implanted code in ReadyToRun (R2R) compiled .NET binaries, R2R stomping.<br/>
Released under CPR @_CPResearch_<br/>

[[.NET Hooking – Harmonizing Managed Territory]]()

Introduction to .NET managed hooking using the Harmony library.<br/>
A practical example of using Harmony hooking to defeat the notorious “ConfuserEx2” obfuscator results in the “ConfuserEx2_String_Decryptor” tool. Re a neat trick on how to combine both debugging and hooking using the Harmony library (Harmony hooking from the dnSpyEx debugging context).<br/>
Released under CPR @_CPResearch_<br/>

[[ConfuserEx2 - Full Deobfuscation Guide]]()

Tools used in the video: [[GitHub - ConfuserEx2_String_Decryptor]]()<br/>

[[Inside the Box: Malware’s New Playground]]()

Re the increasing abuse of BoxedApp products to pack and deploy known threats.<br/>
In-depth analysis of the BoxedApp internals, focusing on the resulting packed binary structures with Yara signatures that can be used to statically detect the packer in use while distinguishing the product itself.<br/>
Released under CPR @_CPResearch_<br/>

项目信息

开发语言：Python

Star 数：963

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Some of my publicly available Malware analysis and Reverse engineering.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。