oalabs posts
Posts: 243
Files: 416
Live Stream VOD: Analyzing Jupyter / Solarmarker InfoStealer Delivery Chain
In this Twitch stream we analyze the multi-stage delivery chain used to install Jupyter / Solarmarker InfoStealer. The delivery chain includes an Inno Installer, malicious Pascal script, malicious PowerShell script, and a reflectively loaded .NET assembly.Stage 1 - Unpacking Inno (Pascal) Use Inno E...
How To Unpack VMProtect 3 (x64) Night Sky Ransomware
In this tutorial we unpack Night Sky Ransomware (x64) which is protected with VMProtect 3. We use VMPDump to dump and fix the imports and then re-create the virtualized entry point manually.Tools FLARE-VM x64dbg IDA x64 Free VMPDumpAdditional Learning Resources Sandbox Tricks For Faster Reversing M...
Live Stream VOD: Unpacking VMProtect HackingTeam "Soldier" Implant and Writing Static Config Extractor
In this Twitch stream we unpack a VMProtect "soldier" implant developed by HackingTeam. Once we have unpacked the payload we write a static config extractor using Python.Packed sample: 76840fa18df8764afb51f1aa6da10ff65f1bdfe434dc988917380fa31fbe3a73Detailed notes are available on GitHub in o...
How To Unpack VMProtect Malware - Part 3
Fixing OEP (Virtualized Entry Point)This is the third part in our three-part tutorial series on unpacking VMProtect malware. At this stage we have dumped the unpacked PE payload. The entry point was virtualized so the dumped sample won't run but it could be statically reverse engineered -- if st...
How To Unpack VMProtect Malware - Part 2
Debugging and DumpingThis is part two in our three-part tutorial series on unpacking VMProtect malware. We are attempting to unpack a sample that has been packed with VMprotect where the entry point has been virtualized but all other functions are not protected.Unpacking ConceptThe concept behind ou...
How To Unpack VMProtect Malware - Part 1
Overview of Unpacking vs. DevirtualizationThis is the first part in our three-part tutorial series on unpacking VMProtect malware. When approaching a VMProtect malware sample it is important to understand the concept of a packer vs. a virtualizer. VMProtect offers both the option to pack files, and ...
Live Stream VOD: Binary Ninja (Dev 3.0) vs. IDA Pro Malware Analysis Workflow
In this Twitch stream we test the latest Dev 3.0 release of Binary Ninja using our standard IDA Pro malware analysis workflow. Stick around to see what works, what doesn't, and what's next for Binja!This wasn't a sponsored stream but we did get a free 30-day license from the folks over a...
Live Stream VOD: Reverse Engineering WhisperGate Stages 2-3-4
In this Twitch stream we reverse engineer the “WhisperGate” malware stages 2, 3, and 4. The first two stages are .NET obfuscated with NetReactor and EazFuscator, while Stage 4 is an x86 binary compiled with MinGW.Stage 2 - Downloader: dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9...
Why Is The PE Entry Point Not The Same As Main Understanding __security_init_cookie and __scrt_common_main_seh
In this tutorial we discuss the __security_init_cookie and __scrt_common_main_seh functions and why the PE Entry Point on an MSVC binary does not point to Main.This is an important concept to understand when first learning how to reverse engineer windows binaries, especially when using a debugger. O...
Safe Malware Handling and Windows File Associations
In this tutorial we are going to discuss simple ways to stay safe while handling malware in non-safe environments. Malware Analysis EnvironmentThe first step is to setup a safe analysis environment using a virtual machine set up with the FLARE-VM tools. Our full Dynamic Malware Analysis Lab Setup tu...
Live Stream VOD: Night Sky Ransomware FLAIR / FLIRT Signatures in IDA PRO and BinDiff With Rook Ransomware
Twitch live stream VOD. We generate IDA Pro FLIRT / FLAIR signatures for the mbedtls library in Night Sky ransomware and begin reverse engineering. Once we have a nice IDB we use BinDiff to compare NightSKy against Rook ransomware and confirm they are from the same code base.Sample available on Mals...
Live Stream VOD: Night Sky Ransomware mbedtls Library Reversing
Twitch live stream VOD. We begin reverse engineering NightSky ransomware and identify a statically compiled mbedtls library. We build mbedtls and use the .pdb file to quickly import the library structs.Sample available on Malshare:8c1a72991fb04dc3a8cf89605fb85150ef0e742472a0c58b8fa942a1f04877b0Lab N...
Live Stream VOD: Unpacking NightSky Ransomware (VMProtect)
Twitch live stream VOD. We unpack NightSky ransomware which is packed with VMProtect 3 (but not fully virtualized). We also use Dumpulator to identify a complex function without needing to fully reverse engineer it.Sample available on Malshare:8c1a72991fb04dc3a8cf89605fb85150ef0e742472a0c58b8fa942a1...
Live Stream VOD: Qakbot Config Extractor
Twitch live stream VOD. We build a static config extractor for Qakbot / Qbot malware using Python. In this stream we complete building out the C++ structs for the malware, identify how the config is stored, and replicate the config decryption in Python.Sample available on Malshare:670e990631c0b98ccd...
Live Stream VOD: Reverse Engineering Qakbot
Twitch live stream VOD. We begin reverse engineering Qakbot / Qbot malware. In this stream we resolve the dynamic imports, decrypt the encrypted strings, and begin building out the C++ structs for the malware.Sample available on Malshare:670e990631c0b98ccdd7701c2136f0cb8863a308b07abd0d64480c8a2412bd...
Live Stream VOD: (Clip) How To Setup IDA Pro For Delphi Analysis With Zeppelin Ransomware
Twitch live stream (clip). We take a look at Zeppelin Ransomware which is developed in Delphi. We go through the steps to correctly set up IDA Pro for analysis of a Delphi compiled binary including installing and using IDR (Interactive Delphi Reconstructor).We don't start reverse engineering but...
Live Stream VOD: Dridex (Loader) Config Extractor
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and complete our static config extractor in Python.Sample available on Malshare:c7990f1e72fdfa84552f02f9d11cabb74251b0508291af5366fefcee646f9c91Lab Notes - includes code samples:Dridex Loader
Live Stream VOD: Reversing Dridex Shellcode Injection, and Fixing API Calls
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and begin building out the struct that is used for it's injected code. We also realize we should have read Chong's blog and actually patched API called to save us a lot of trouble... this was a struggle stream....
Live Stream VOD: Reversing Dridex Loader Imports, String Decryption, and Code Injection
Twitch live stream VOD. We take a look at the (doppeldridex) Dridex loader binary and prepare it for full static analysis. We resolve the imports, decrypt the strings, and decrypt the embedded shell code.Sample available on Malshare:c7990f1e72fdfa84552f02f9d11cabb74251b0508291af5366fefcee646f9c91Lab...
Live Stream VOD: Emotet Static Config Extractor
Twitch live stream VOD. We take a look at the new Emotet binary and build a static config extractor.Sample available on Malshare: eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827Python config extractor:Emotet Lab Notes
Live Stream VOD: Slowly Reverse Engineering Emotet
Twitch live stream VOD. We take a look at the new Emotet binary and slowly start reverse engineering it...Sample available on Malshare: eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827
Quick Tip: IDA Pro Type Libraries For Analyzing Windows Malware
Igor's Tips: Type Libraries Deep DiveIgor's Tips: Creating Custom Type Libraries
Statically Resolving Dynamic Imports For BlackMatter
BlackMatter v3 Ransomware Sample: Malshare HashDB: HashDB IDA Plugin Struct-Typer: FLARE-IDA Plugins IDA Type Libraries: Igor's tips
Python3 Environment Basics For IDA Pro (Windows)
Usually Python and IDA play nice but when they don't the troubleshooting process can be maddening. In this tutorial we will cover some IDA Python environment basics that can assist with troubleshooting and configuring a sane Python 3 environment for IDA Pro.If you are running the latest version ...
Live Stream VOD: Deobfuscating .NET ConfuserEx
Twitch live stream VOD. This is our redemption stream! We finally deobfuscate the modified Confuser and extract the .NET payload.
Live Stream VOD: Themida .NET Dumping and .NET Deobfuscation
Twitch live stream VOD. We take a look at a garbage RAT that is written in .NET obfuscated with ConfuserEx and packed in Themida.
Analyzing BlackMatter Anti-Debug With IDA Pro
In this tutorial we analyze the anti-debug checks in BlackMatter ransomware with IDA Pro. We use static analysis to determine exactly what the checks are doing.BlackMatter sample:Malshare DownloadAnti-debug feature explained:Anti-Debug NtSetInformationThreadAnti-Debug NtGlobalFlag
Bypassing BlackMatter Anti-Debug With x64dbg
In this tutorial we demonstrate how to bypass the anti-debug checks in BlackMatter ransomware with x64dbg.BlackMatter sample:Malshare DownloadAnti-debug feature explained:Anti-Debug NtSetInformationThread
