oalabs posts
Posts: 243
Files: 416
Live Stream VOD: Pikabot is Back - Automated String Extraction - Part 3
The third and final part in our series on the new Pikabot core! In this stream complete our custom emulator to automatically extract encrypted strings from the malware and create a few yara rules for hunting.Fun fact, the string extractor also works on the Pikabot loader!Sample39d6f7865949ae7bb846f5...
Live Stream VOD: Pikabot is Back - Automated String Extraction - Part 2
The second part in our series on the new Pikabot core! In this stream we begin to build a custom emulator to automatically extract encrypted strings from the malware.Just a heads up... at the end of the stream I run into a very obvious bug that I don't solve until the next stream... if you spot ...
Live Stream VOD: Pikabot is Back - Part 1
Pikabot is back! New loader, new string encryption, indirect syscalls and more! Join us for our initial triage of the core module. In this stream we focus on the dynamic API resolution and string decryption. The majority of the stream we are using some tricks in x64dbg to automatically decrypt the s...
Live Stream VOD: Solving ADVObfuscator Part 2
In this Twitch stream we continue our work on an automated string recover tool for ADVObfuscator by extending it to handle custom variants with globals and AVX instructions.Samples 765d19b4728008c1589f222d1fa49f1cb7310204c7a4574eb9f930d0544bed7b 3a987fd51423f186242c3fbbdab59113c11d4ac67109e90ab948d5...
Live Stream VOD: Solving ADVObfuscator Part 1
In this Twitch stream we begin building a tool to assist with string recovery for malware that is protected with ADVObfuscator.Since ADVObfuscator is an open source tool we built our own test sample instead of using malware when developing the tool. Notes with source code can be found here...ADVObfu...
Live Stream VOD: Mystic Stealer Deobfuscation
In this Twitch stream we build a config extractor for Mystic Stealer that is able to handle their "custom" obfuscation.NOTE: We are troubleshooting some issues with Patreon video embeds. If you can't see/watch the video please let me know (comment or DM, whichever you prefer).SamplesBF38...
Live Stream VOD: Automated Go String Decryption for UNK Obfuscator - Part 2
In this Twitch stream we continue our previous work on Garble Go string decryption to tackle another type of obfuscator used for GoLang that creates in-line obfuscated strings (similar to ADV) instead of using functions.This is really a development stream with a lot of distractions along the way but...
Live Stream VOD: Automated Go String Decryption for UNK Obfuscator - Part 1
In this Twitch stream we extend our previous work on Garble Go string decryption to tackle another type of obfuscator used for GoLang that creates in-line obfuscated strings (similar to ADV) instead of using functions. The source/name of the obfuscator is currently unknown but the obfuscation patter...
Live Stream VOD: AttackerCryptor Is Not a Cryptor
A light Twitch stream taking a look at possibly world's worst cryptor... totally FUD until you upload to VirusTotal lol! This is just a silly stream but sometimes you have to call it out when you see it ... we will be back on schedule next week!Samples11c38fc24bf7b29cd6e974670bc11d7f92af124d8b7e...
Live Stream VOD: Limerat Exposed
In this Twich stream we take a closer look at Limerat and open source .NET RAT that has become very popular. Our goal is to build a stand alone configuration extractor that will extract all of the config settings not just the C2!Samples6d08ed6acac230f41d9d6fe2a26245eeaf08c84bc7a66fddc764d82d6786d334...
Live Stream VOD: Garble GoLang String Recovery
In this Twitch stream we continue our efforts to recover strings encrypted with the Garble GoLang obfuscator. We manage to identify a common pattern that not only allows us to identify Go samples where Garble has been used but also provides a pattern match for our string decryption tool.Spoiler aler...
Live Stream VOD: Bandit Stealer (GoLang)
In this Twitch stream we take a look at Bandit, a new infostealer written in GO that primarily targets browser credentials and crypto wallets. The collected information is uploaded to Telegram with the operator's telegram ID and channel ID hard coded in the binary but there is a separate C2 host...
Applied Emulation - Module 5
Emulating The Windows EnvironmentThis is the last part in our five-part tutorial series on emulation. In this module we learn how to use a full User-Mode emulator capable of running a PE file. The focus is mainly on Dumpulator and its applications vs. Unicorn (and other CPU only emulators). The modu...
Applied Emulation - Module 4
Advanced Unicorn TechniquesThis is the fourth part in our five-part tutorial series on emulation. In this module we expand our capabilities with Unicorn using the Unicorn hooks. We build a tracing engine and lay the groundwork for a full binary instrumentation tool. The module is accompanied by a li...
Applied Emulation - Module 3
Reverse Engineering With EmulationThis is the third part in our five-part tutorial series on emulation. In this module we learn how to apply emulation to common reverse engineering tasks. The module is accompanied by a live demo and a lab that builds on the concepts we discuss.Please Note - Based on...
Applied Emulation - Module 2
Unicorn CPU EmulatorThis is the second part in our five-part tutorial series on emulation. In this module we learn how to use the Unicorn emulator for simple emulation tasks. The module is accompanied by a live demo and a lab that builds on the concepts we discuss.References Unicorn Overviewhttps://...
Applied Emulation - Module 1
Emulator FundamentalsThis is the first part in our five-part tutorial series on emulation. In this module we begin by learning how an emulator works under the hood. The module is accompanied by a live demo and a lab that builds on the concepts we discuss.References Windows Stack Overviewhttps://en.w...
Live Stream VOD: Glupteba Obfuscated GoLang
In this stream we take a look at a lightly obfuscated version of Glupteba. This malware has multiple components but our focus is on the loader.Samples 3cc7fb757318a924954642bfa36dda9c2cf53c9446a85bdcda756603e17a6961NotesGlubteba - Investigating this elusive GO loader
Live Stream VOD: RootTeam GoLang Stealer
In this stream we take a look at this RootTeam is a GO stealer that can be built via a Telegram channel. Originally we confused this with BanditStealer but it is separate ... also we try of this neat GO symbol recovery tool GO IDA parser!Samplese0cd16b3de1f8b6c91b3483e383199f691e935d3d4e1ed9e77f6f9a...
Live Stream VOD: TrueBot Exposed
In this stream we take a look at TruBot which has been in the news thanks to a recent Cybersecurity and Infrastructure Security Agency (CISA) report. Stick around for some ... interesting ... yara rules lol.Sample717beedcd2431785a0f59d194e47970e9544fbf398d462a305f6ad9a1b1100cbNotesTruebot - Truely a...
Live Stream VOD: Status Recorder
In this stream we take a look at a new stealer that might be named "StatusRecorder" according to its C2 panel? The malware itself is very straight forward and we quickly create a Yara rule and start hunting for similar samples...Heads Up!At the beginning of the stream we discover some unusua...
Live Stream VOD: N00bs Night - Multi-Stage Malware Delivery
In this stream we take a close look at a multi-stage malware delivery system which is used to prepare the target so the final payload is not detected. There are a few tricky parts but this is a very accessible stream... N00bs Night!Samples8661bf09583ac5882e4183052c4273c267711236b79aeecf3e3fd1ac0da63...
Live Stream VOD: Mishapulator A Memory-Only Emulator
This is a bit of a different stream where we investigate a novel idea from @mishap where emulation is performed only on memory based instructions. The concept is that this may end up being a useful (fast) tool for generic string decryption problems.The stream itself is a bit boring and sort of a fai...
Live Stream VOD: Generic xorstr Decryption
This is a crazy 7h long dev stream! We probably won't do another one of these but if you like you can watch in real time I as build a generic string decryption tool for the xorstr library.What?The idea for this tool was developed over the past few streams and I just wanted to test it out. In the...
Live Stream VOD: RisePro Triage (xorstr) - Part 2
In this twitch stream we continue our analysis of RisePro but shift our focus to the string encryption library xorstr. The main focus of this stream is investigating use of the xorstr library in malware and building a universal string decryption tool... this is the stream that kicks off our exciting...
Live Stream VOD: RisePro Triage - Part 1
In this twitch stream we take a look at RisePro a stealer that shares a lot of code with PrivateLoader. The main focus of the stream is investigating the similarities between PrivateLoader and RisePro but we also create a simple string decryption and attempt to build a decent Yara rule.Samples2cd2f0...
Live Stream VOD: AMSI Bypass Loader Part 2
In this Twitch stream we continue our triage of this new loader that uses AMSI bypasses to avoid detection. In this part we focus on the injected X64 shell code. The shell code uses relative offsets to access data within itself which poses some challenges for IDA, and it contains multiple encrypted ...
Live Stream VOD: AMSI Bypass Loader Part 1
In this Twitch stream we begin to triage a new loader that uses AMSI bypasses to avoid detection. The loader itself is .NET but as we dig deeper we discover that the AMSI bypass is implemented in PowerShell, native X64 shell code is used (no yet analyzed) and the final payload is a Async RAT.For the...
Live Stream VOD: 😂 Cringe Malware Contest 😂
Join us as you help us rank the worst malware we have ever reverse engineered!Special thanks to @huettenhain for helping to host, and everyone who sent us submissions and voted in the chat!🏆 Congrats to @struppige for submitting the winning sample!ChatGPT Polymorphic Malware 1c287608ab586296a265b...
Live Stream VOD: Metastealer Triage
In this Twitch stream we triage Metastealer creating a Yara rule and config extractor.Sample6cf8bfba1b221effcb1eccec0c91fb0906d0b8996932167f654680cb3ac53aacNotesMetastealer: DGAs and obfuscation as malware goes meta
