Malware Research

25 Sep 2024 23:36

This is what I was looking for:

https://github.com/Malandrone/PowerDecode/

Malware Research

25 Sep 2024 11:23

Can I send another one

Malware Research

25 Sep 2024 10:31

Oh... interesting internals, will have a look. thanks

Malware Research

24 Sep 2024 19:16

I know and honestly it's unusable. It would be a perfect substitute, but really... we tired many times with different hw setups and it's too buggy to be used in practice.

Moreover, it is shipped with few evasive mitigations... so... long live cape :)

Malware Research

24 Sep 2024 17:47

Hi folks, I have an infrastructure running CAPEv2 that "works". It's for research so, we're satisfied :)

Now I need to keep track of the values of the instruction pointer (to measure coverage).

Could you suggest what to use?
I tried the built-in debugger but it's really too slow.

Otherwise, do you know any of the main developers and could you put me in touch?

Malware Research

24 Sep 2024 15:51

That requires VTs subscription?

Malware Research

24 Sep 2024 15:48

There is Yara matching in case you aren't aware...

Malware Research

24 Sep 2024 15:48

Search query needed to remove shitty samples.

Malware Research

24 Sep 2024 12:49

Hey guys do you know where can I learn more about values returned in the stack after an exception occurred? I’m working with a sample with custom sehandler which access to structure using the esp so I want lo learn more about it

Malware Research

24 Sep 2024 11:30

it lookjs like the file inside has password, and i don't know it :(

Malware Research

24 Sep 2024 10:53

For those who reverse engineer, please take 3 minutes of your time to fill in a survey I'm conducting: https://forms.gle/3h2CsFhpMdKPssve9

More context:

My name is Max 'Libra' Kersten and I'm a malware analyst. This survey will collect the answers you provide without the need for any personal information. The goal of this survey is to get a better understanding of the workflow of other reverse engineers. The results will be shared back with the community in the future, allowing us all to benefit.

If you have any questions, please do reach out to me on Twitter or LinkedIn.

The survey itself shouldn't take you more than a couple of minutes. Thank you for your time!

Malware Research

24 Sep 2024 09:41

please do not ask such a vague question...

Malware Research

24 Sep 2024 08:15

Sorry it was somebody else

Malware Research

23 Sep 2024 18:06

Hello ky_giorgos, welcome to the Malware Research group! Please read the pinned message before you post!

Malware Research

23 Sep 2024 09:42

Its a message to get people to look at the profile, which is a crypto scam

Malware Research

25 Sep 2024 11:31

what do you mean? send another what

Malware Research

25 Sep 2024 10:42

The source code of the driver is not available :(

https://github.com/cert-ee/cuckoo3/issues/6

Malware Research

24 Sep 2024 20:58

Hahaha ok. I am sorry, I don't know what you are doing. I have some interesting ideas and I am looking forward to seeing your work and results. Are you going to share?
Cuckoo3 is picking up speed recently also. They moved away from agent.py to kernel driver, maybe you can use and contribute there

Malware Research

24 Sep 2024 18:26

Do you know drakvuf? Have a quick look and see if it could better fit your needs

Malware Research

24 Sep 2024 16:03

There is also yaraify by Abuse.ch

Malware Research

24 Sep 2024 15:49

Or even signature matches

Malware Research

24 Sep 2024 15:48

Never tried that, will check thanks

Malware Research

24 Sep 2024 15:47

Anyone could suggest some dorks for VT, so as to find malware for RE from newly submitted samples.

Malware Research

24 Sep 2024 11:31

it's the usual one... infected

Malware Research

24 Sep 2024 11:05

appreciate dude, thx

Malware Research

24 Sep 2024 10:52

hi guys, does someone can please share with me this sample?

3e410397955d5a127182d69e019dbc8bbffeee864cd9c96e577c9c13f05a232f

https://www.virustotal.com/gui/file/3e410397955d5a127182d69e019dbc8bbffeee864cd9c96e577c9c13f05a232f/summary

Malware Research

24 Sep 2024 08:22

Hi I'm new to malware research. What's best software to reverse malware

Malware Research

24 Sep 2024 08:05

Hello Coliday, welcome to the Malware Research group! Please read the pinned message before you post!

Malware Research

23 Sep 2024 17:09

Hello! Can someone share with me this sample?

d7ba57d09945192105625366fdd211600f2b955d529e75cf099ea322f497689f

https://www.virustotal.com/gui/file/d7ba57d09945192105625366fdd211600f2b955d529e75cf099ea322f497689f/relations

Malware Research

23 Sep 2024 09:42

I cant even understand the attempts some make