oalabs posts
Posts: 243
Files: 416
Live Stream VOD: SmokeLoader Analysis Part 2 - Import Hashing and Stage 3
This is the second part of our SmokeLoader analysis. We finish cleaning up the obfuscation in Stage 2 and locate the API hashing algorithm, we also locate the encrypted Stage 3 payloads but there is a problem... something just isn't right with our analysis and we aren't able to resolve the A...
Live Stream VOD: SmokeLoader Analysis Part 1 - Deobfuscation
This is our first look at SmokeLoader, we begin with analysis of Stage 2 (unpacked automatically). The binary is obfuscated using a mixture of simple opaque predicates, and encrypted functions that are decrypted on the fly.Honestly, this is a very slow paced stream. We do make progress and end up wi...
Apple M1 Mac Malware Analysis Lab (Windows 11)
In this tutorial we will setup a free, safe, Windows 11 virtual machine (VM) that can be used for dynamic malware analysis on an M1 Apple host (M1 MacBooks, etc.) Since the new M1 chips run an ARM architecture the options for VMs are limited.Currently (August 2022), there are no usable ARM-to-x86 tr...
Live Stream VOD: Lockbit 3.0 Embedded Binaries Analysis - Part 5
Our final steam on Lockbit 3.0 ransomware! We complete our analysis of the third embedded binary. This is a tricky one, we need to use some debugging to decrypt the binary before we can begin our analysis...SamplesLockbit Ransomware: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceEm...
Live Stream VOD: Lockbit 3.0 Embedded Binaries Analysis - Part 4
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We add another hashing algorithm to HashDB and complete our analysis of the 2nd binary!SamplesLockbit Ransomware: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceEmbedded PE #1:d641ad955ef4cf...
Live Stream VOD: Lockbit 3.0 Embedded Binaries Analysis - Part 3
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We begin analysis of the second embedded binary...SamplesLockbit Ransomware: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceEmbedded PE #1:d641ad955ef4cff5f0239072b3990d47e17b9840e07fd5feea9...
Live Stream VOD: Lockbit 3.0 Embedded Binaries Analysis - Part 2
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We complete our analysis of the first binary, and move on to look at the second binary...SamplesLockbit Ransomware: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceEmbedded PE #1:d641ad955ef4...
Live Stream VOD: Lockbit 3.0 Embedded Binaries Analysis - Part 1
In this twitch stream we start analyzing the binaries embedded in Lockbit 3.0 ransomware. We take a look at the first binary which requires the development of a new HashDB algorithm, and some string decryption tools.SamplesLockbit Ransomware: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4e...
Live Stream VOD: Lockbit 3.0 Ransomware Triage - Part 2
Fixing Our Config ExtractorIn this twitch stream we continue our analysis of the new Lockbit 3.0 ransomware and complete our config extractor. We extract the ransom note along with many encrypted strings, and some shell code ... and curiously... three embedded PE files!Sample80e8defa5377018b093b5b90...
Live Stream VOD: Lockbit 3.0 Ransomware Triage
In this twitch stream we take a look at the new Lockbit 3.0 ransomware and realize it is just a ripoff of BlackMatter! We resolve the dynamic imports then take a look at extracting the config... the config extraction is almost the same as BlackMatter...Sample80e8defa5377018b093b5b90de0f2957f7062144c...
Live Stream VOD: Matanbuchus Triage - Part 3
In this twitch stream we take a final look at the Matanbuchus loader malware. We focus on an older version of the payload that uses a different type of string encryption.This stream is more of an experiment with emulation rather than anything useful for tracking the loader since the sample we are ex...
Understanding Pointers for Reverse Engineers Part 1 - Pointer Basics
This is the first in a short three-part series on pointers; how they work in memory, and what they look like in assembly. In this tutorial we look at the basics, what is a pointer, how is a pointer assigned, and what is dereferencing.Further ReadingThe following resources may be of interest. Load Ef...
Understanding Pointers for Reverse Engineers Part 2 - Void Pointers and Casting
This is the second in a short three-part series on pointers. In this tutorial we take a look at VOID pointers, VOID*, PVOID, PVOID* etc. We also discuss casting and briefly touch on memory allocation and access via VOID pointers.Further Reading VirtualAllocHands On ExampleAttached to this post is th...
Understanding Pointers for Reverse Engineers Part 3 - Passing Arguments by Reference
This is the last part of a short three-part series on pointers. In this tutorial we look at what happens when an argument is passed by reference. What actually occurs in memory and in the compiled assembly.Hands On ExampleAttached to this post is the compiled example we analyzed in the tutorial. You...
Live Stream VOD: Matanbuchus Triage - Part 2
In this twitch stream we take a second look at the Matanbuchus loader malware. We tighten our Yara rule, and refine our config extractor to work on all the samples we have collected, except one...SamplesEach sample can be downloaded from MalwareBazaar. b9b399dbb5d901c16d97b7c30cc182736cd83a7c5331319...
Live Stream VOD: Matanbuchus Triage - Part 1
In this twitch stream we begin our triage of the Matanbuchus loader malware. First, we resolve the API hashes, and decrypt the strings, then we attempt to build a Yara rule and and automated config extractor.Stream Bookmarks 00:31:00 We conclude our research and begin reverse engineering. 01:09:00 W...
Live Stream VOD: Diceloader Triage and YARA Rule Building
In this twitch stream we analyze a loader associated with FIN7 called DICELOADER. During our analysis we build and test a Yara rule as well as a config extractor.Sample:2d88767c424d05330839e568b32f9f52962df56b1d3021f69930167fe623efd1Notes (including Yara rules)Diceloader Tirage Notes
Live Stream VOD: Basic Malware Downloader Triage and Detection
In this twitch stream we triage two simple malware downloaders and look for common characteristics that we can use to automatically detect them. One loader turns out to be a Cobalt Strike loader and we attempt to extend our detections...Downloader #19211ebf25c3cd3641451c95c50c1d3b7b2a4c53c36fa36564f...
Live Stream VOD: Cobalt Strike Unpacking and Config Extraction
In this twitch stream we take a look at various forms of Cobalt Strike Beacon and how their config can be extracted. We also triage a sample that is packed using Syscalls.Notes (including config extractor code):Cobalt Strike Analysis
Live Stream VOD: Writing A Config Extractor For Amadey Loader
In this twitch stream we triage an Amadey Loader malware sample and write a config extractor in Python.Packed Sample:7ff0ff6e51a58398ad73da3cc8e7e6233a23e49d93aaa4b190672e4f9f08b9bbUnpacked Sample:6e01f9d1997186d06274a508bc0a511aa6fb50e430b77efca593c00d3fc62cbaNotes (including config extractor code)...
Live Stream VOD: Malware Triage Tips For Dealing With Unknown Binaries - Your Questions Answered
In this twitch stream we walk through the triage of a packed loader and discuss some of techniques that can help save time when triaging unknown malware.Packed Sample:bbb1db25b2b54928d97b0a0caf8726e5d62501ab6cdcf9b4aa2e192f59958aa6Unpacked Sample:bf9c4930aa56984113443ea150ed106935394fa6e527c98ae92f0...
Live Stream VOD: New Emotet x64 Obfuscated Config Extraction
In this twitch stream we look at the recently updated emotet that is using obfuscation to hide its config and we use emulation to build a config extractor.Sample:92033dc85730f7dc5dbd85369ea1db8806ce7581c1e9b4764a82abfc54e3146eSample Unpacked:c688e079a16b3345c83a285ac2ae8dd48680298085421c225680f26cea...
Live Stream VOD: Unpacking and Triage of Bumblebee Loader
In this twitch stream we take a look at the new Bumblebee loader malware. First we unpack it using x64dbg, then begin our triage work with IDA, and end up extracting the encrypted "config".Sample:0d740a348362171814cb314a48d763e336407904a36fa278eaf390c5743ec33bLab Notes (with code):Bumblebee ...
Live Stream VOD: Reverse Engineering Syscalls with Magniber Ransomware
In this twitch stream we investigate some quick ways to statically reverse engineer samples that rely on Syscalls. The sample we are looking at is Magniber ransomware.Sample:cb34e574d68c3646ea7985542b5385f134ff71b715ee10f364af43f63a992774Lab Notes (with code):Magniber Ransomware Triage
Live Stream VOD: New Emotet x64 Config Extractor and Yara Rule
In this twitch stream we take a look at the new 64-bit version of Emotet. We use dumpulator and python to extract the config and write a simple Yara rule.Sample:b481ac05ea9a59eedf6233166327057279babef26c913a8e89536472b192e86cSample Unpacked:ed2640be5ed0a4486ecf7ac97b125e26b9d263624251eae1c9a42e9998c...
Live Stream VOD: Emotet Deobfuscation Part 4 - IDA Python Binary Patching
In this Twitch stream we create a binary patching script using IDA Python to patch our obfuscated Emotet sample.In the end we determine that directly patching the end of each state is not going to work since the flags we rely on may change within the state. Our workaround is to save the flags which ...
Live Stream VOD: Emotet Deobfuscation Part 3 - A Generic Algorithm and Patching
In this Twitch stream we complete our generic deobfuscation algorithm and test it on an obfuscated Emotet sample.We build off of our work from the previous stream and attempt to finally patch out the obfuscation from this sample. We almost... complete... it...Sample: c7574aac7583a5bdc446f813b8e347a7...
Live Stream VOD: What is Symbolic Execution and How Does it Help With Deobfuscation (Back to Basics)
In this Twitch stream we take a pause to go back and walk through the basics of what symbolic execution really is, and how it can help us with deobfuscation. This was a much requested stream, and hopefully it helps everyone is able to catch up so we all have the same base of knowledge as we continue...
Live Stream VOD: Emotet Deobfuscation Part 2 - Attempting A Generic Algorithm to Learn The Control Flow
In this Twitch stream we attempt to build a generic algorithm to separate the dispatcher basic blocks from the original basic blocks in an obfuscated Emotet sample.We build off of our work from the previous stream and attempt to convert our assembly specific algorithm to a generic algorithm that use...
Live Stream VOD: Emotet Deobfuscation Part 1 - Learning The Control Flow
In this Twitch stream we begin to look at the CFF obfuscation in Emotet. Our first step is to build an algorithm to separate the dispatcher control flow blocks from the original basic blocks.We have a rough start since the function we focus on has two entry points to the dispatcher which means we ca...
