oalabs posts
Posts: 243
Files: 416
Live Stream VOD: SmokeLoader Analysis Part 2 - Import Hashing and Stage 3
This is the second part of our SmokeLoader analysis. We finish cleaning up the obfuscation in Stage 2 and locate the API hashing algorithm, we also locate the encrypted Stage 3 payloads but there is a problem... something just isn't right with our analysis and we aren't able to resolve the API hashes, or decrypt Stage 3!This is also a very slow paced stream... not to give too much away for the next stream but we miss something very obvious in this stream that ends up being the cause of all our problems! Though most of the magic happens ...
Live Stream VOD: SmokeLoader Analysis Part 1 - Deobfuscation
This is our first look at SmokeLoader, we begin with analysis of Stage 2 (unpacked automatically). The binary is obfuscated using a mixture of simple opaque predicates, and encrypted functions that are decrypted on the fly.Honestly, this is a very slow paced stream. We do make progress and end up with a binary that is fully deobfuscated but there are many tricks still before we can extract Stage 3! You can skip ahead about 2h to get to the real deobuscation work.Samples Packed parent cef4f5f561b5c481c67e0a9a3dd751d18d696b61c7a5dab5ebb2953509374...
Apple M1 Mac Malware Analysis Lab (Windows 11)
In this tutorial we will setup a free, safe, Windows 11 virtual machine (VM) that can be used for dynamic malware analysis on an M1 Apple host (M1 MacBooks, etc.) Since the new M1 chips run an ARM architecture the options for VMs are limited.Currently (August 2022), there are no usable ARM-to-x86 translation shims for hypervisors on the M1 chip. This means that we are limited to using an ARM version of Windows for our VM. Windows 11 (ARM) provides the ability to run both 32-bit and 64-bit x86 binaries (via a technology similar to WOW64) making ...
Live Stream VOD: Lockbit 3.0 Embedded Binaries Analysis - Part 5
Our final steam on Lockbit 3.0 ransomware! We complete our analysis of the third embedded binary. This is a tricky one, we need to use some debugging to decrypt the binary before we can begin our analysis...SamplesLockbit Ransomware: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceEmbedded PE #1:d641ad955ef4cff5f0239072b3990d47e17b9840e07fd5feea93c372147313c5Embedded PE #2:63c8efca0f52ebea1b3b2305e17580402f797a90611b3507fab6fffa7f700383Embedded PE #3:917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2Embedded PE #3 ...
Live Stream VOD: Lockbit 3.0 Embedded Binaries Analysis - Part 4
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We add another hashing algorithm to HashDB and complete our analysis of the 2nd binary!SamplesLockbit Ransomware: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceEmbedded PE #1:d641ad955ef4cff5f0239072b3990d47e17b9840e07fd5feea93c372147313c5Embedded PE #2:63c8efca0f52ebea1b3b2305e17580402f797a90611b3507fab6fffa7f700383Embedded PE #3:917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2Notes:Lockbit 3.0 - Analysis of The Embedd...
Live Stream VOD: Lockbit 3.0 Embedded Binaries Analysis - Part 3
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We begin analysis of the second embedded binary...SamplesLockbit Ransomware: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceEmbedded PE #1:d641ad955ef4cff5f0239072b3990d47e17b9840e07fd5feea93c372147313c5Embedded PE #2:63c8efca0f52ebea1b3b2305e17580402f797a90611b3507fab6fffa7f700383Embedded PE #3:917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2Notes:Lockbit 3.0 - Analysis of The Embedded PE Files
Live Stream VOD: Lockbit 3.0 Embedded Binaries Analysis - Part 2
In this twitch stream we continue analyzing the binaries embedded in Lockbit 3.0 ransomware. We complete our analysis of the first binary, and move on to look at the second binary...SamplesLockbit Ransomware: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceEmbedded PE #1:d641ad955ef4cff5f0239072b3990d47e17b9840e07fd5feea93c372147313c5Embedded PE #2:63c8efca0f52ebea1b3b2305e17580402f797a90611b3507fab6fffa7f700383Notes:Lockbit 3.0 - Analysis of The Embedded PE Files
Live Stream VOD: Lockbit 3.0 Embedded Binaries Analysis - Part 1
In this twitch stream we start analyzing the binaries embedded in Lockbit 3.0 ransomware. We take a look at the first binary which requires the development of a new HashDB algorithm, and some string decryption tools.SamplesLockbit Ransomware: 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceEmbedded PE #1:d641ad955ef4cff5f0239072b3990d47e17b9840e07fd5feea93c372147313c5Notes:Lockbit 3.0 - Analysis of The Embedded PE Files
Live Stream VOD: Lockbit 3.0 Ransomware Triage - Part 2
Fixing Our Config ExtractorIn this twitch stream we continue our analysis of the new Lockbit 3.0 ransomware and complete our config extractor. We extract the ransom note along with many encrypted strings, and some shell code ... and curiously... three embedded PE files!Sample80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceNotes (with code)Lockbit 3.0 Ransomware Triage - Encrypted Strings
Live Stream VOD: Lockbit 3.0 Ransomware Triage
In this twitch stream we take a look at the new Lockbit 3.0 ransomware and realize it is just a ripoff of BlackMatter! We resolve the dynamic imports then take a look at extracting the config... the config extraction is almost the same as BlackMatter...Sample80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ceNotesLockbit 3.0 Ransomware Triage
Live Stream VOD: Matanbuchus Triage - Part 3
In this twitch stream we take a final look at the Matanbuchus loader malware. We focus on an older version of the payload that uses a different type of string encryption.This stream is more of an experiment with emulation rather than anything useful for tracking the loader since the sample we are examining is old and no longer in use. We end up with a small emulation tool that might be useful for more generic string decryption...NotesMatanbuchus Triage Notes - Taking a Closer Look At Obfuscated Samples
Understanding Pointers for Reverse Engineers Part 1 - Pointer Basics
This is the first in a short three-part series on pointers; how they work in memory, and what they look like in assembly. In this tutorial we look at the basics, what is a pointer, how is a pointer assigned, and what is dereferencing.Further ReadingThe following resources may be of interest. Load Effective Address Instruction (ASM Manual) Size Directives explained (ptr dword) Free Full Course on C++ Pointers (free code camp) Multi Level Pointers -- useful for in-memory game hacking (GuidedHacking)Hands On ExampleAttached to this post is the com...
Understanding Pointers for Reverse Engineers Part 2 - Void Pointers and Casting
This is the second in a short three-part series on pointers. In this tutorial we take a look at VOID pointers, VOID*, PVOID, PVOID* etc. We also discuss casting and briefly touch on memory allocation and access via VOID pointers.Further Reading VirtualAllocHands On ExampleAttached to this post is the compiled example we analyzed in the tutorial. You are encouraged to analyze the binary in the disassemble of your choice and identify how memory is assigned to the pointer, and the pointer is cast.Debugging the example is also encouraged!
Understanding Pointers for Reverse Engineers Part 3 - Passing Arguments by Reference
This is the last part of a short three-part series on pointers. In this tutorial we look at what happens when an argument is passed by reference. What actually occurs in memory and in the compiled assembly.Hands On ExampleAttached to this post is the compiled example we analyzed in the tutorial. You are encouraged to analyze the binary in the disassemble of your choice and identify how the argument is passed by reference.Debugging the example is also encouraged!
Live Stream VOD: Matanbuchus Triage - Part 2
In this twitch stream we take a second look at the Matanbuchus loader malware. We tighten our Yara rule, and refine our config extractor to work on all the samples we have collected, except one...SamplesEach sample can be downloaded from MalwareBazaar. b9b399dbb5d901c16d97b7c30cc182736cd83a7c53313194a1798d61f9c7501e c41f7b7ec0909d5c21107ddebc2fe84dbc137f701b42943c1a5e69f5d50e05ab b4e7710488c2b7aaa71688b8bd546410af07a215c2e835e8dfbe24887186bd4f 60f030597c75f9df0f7a494cb5432b600d41775cfe5cf13006c1448fa3a68d8d 58a673023bbc7f2726e3b7ac917a43d930669...
Live Stream VOD: Matanbuchus Triage - Part 1
In this twitch stream we begin our triage of the Matanbuchus loader malware. First, we resolve the API hashes, and decrypt the strings, then we attempt to build a Yara rule and and automated config extractor.Stream Bookmarks 00:31:00 We conclude our research and begin reverse engineering. 01:09:00 We start using Dumpulator and run into some issues. 03:55:00 Duncan shows up and give us some code for Dumpulator and we finish our string extraction.Samplef8cc2cf36e193774f13c9c5f23ab777496dcd7ca588f4f73b45a7a5ffa96145eNotesMatanbuchus Triage Notes
Live Stream VOD: Diceloader Triage and YARA Rule Building
In this twitch stream we analyze a loader associated with FIN7 called DICELOADER. During our analysis we build and test a Yara rule as well as a config extractor.Sample:2d88767c424d05330839e568b32f9f52962df56b1d3021f69930167fe623efd1Notes (including Yara rules)Diceloader Tirage Notes
Live Stream VOD: Basic Malware Downloader Triage and Detection
In this twitch stream we triage two simple malware downloaders and look for common characteristics that we can use to automatically detect them. One loader turns out to be a Cobalt Strike loader and we attempt to extend our detections...Downloader #19211ebf25c3cd3641451c95c50c1d3b7b2a4c53c36fa36564f3c1a177a0cda3dDownloader #2 (Cobalt Strike)1a10e2940151982f2ab4f1e62be6e4f53074a2ffb90c7977e16d6a183db98695Notes (including Yara rules)Malware Downloader Triage Notes
Live Stream VOD: Cobalt Strike Unpacking and Config Extraction
In this twitch stream we take a look at various forms of Cobalt Strike Beacon and how their config can be extracted. We also triage a sample that is packed using Syscalls.Notes (including config extractor code):Cobalt Strike Analysis
Live Stream VOD: Writing A Config Extractor For Amadey Loader
In this twitch stream we triage an Amadey Loader malware sample and write a config extractor in Python.Packed Sample:7ff0ff6e51a58398ad73da3cc8e7e6233a23e49d93aaa4b190672e4f9f08b9bbUnpacked Sample:6e01f9d1997186d06274a508bc0a511aa6fb50e430b77efca593c00d3fc62cbaNotes (including config extractor code):Triage Amadey Loader
Live Stream VOD: Malware Triage Tips For Dealing With Unknown Binaries - Your Questions Answered
In this twitch stream we walk through the triage of a packed loader and discuss some of techniques that can help save time when triaging unknown malware.Packed Sample:bbb1db25b2b54928d97b0a0caf8726e5d62501ab6cdcf9b4aa2e192f59958aa6Unpacked Sample:bf9c4930aa56984113443ea150ed106935394fa6e527c98ae92f06c8f71616e3
Live Stream VOD: New Emotet x64 Obfuscated Config Extraction
In this twitch stream we look at the recently updated emotet that is using obfuscation to hide its config and we use emulation to build a config extractor.Sample:92033dc85730f7dc5dbd85369ea1db8806ce7581c1e9b4764a82abfc54e3146eSample Unpacked:c688e079a16b3345c83a285ac2ae8dd48680298085421c225680f26ceae73eb7Lab Notes (with code and Yara rule):Emotet x64 Stack Strings Config Emulation
Live Stream VOD: Unpacking and Triage of Bumblebee Loader
In this twitch stream we take a look at the new Bumblebee loader malware. First we unpack it using x64dbg, then begin our triage work with IDA, and end up extracting the encrypted "config".Sample:0d740a348362171814cb314a48d763e336407904a36fa278eaf390c5743ec33bLab Notes (with code):Bumblebee Loader
Live Stream VOD: Reverse Engineering Syscalls with Magniber Ransomware
In this twitch stream we investigate some quick ways to statically reverse engineer samples that rely on Syscalls. The sample we are looking at is Magniber ransomware.Sample:cb34e574d68c3646ea7985542b5385f134ff71b715ee10f364af43f63a992774Lab Notes (with code):Magniber Ransomware Triage
Live Stream VOD: New Emotet x64 Config Extractor and Yara Rule
In this twitch stream we take a look at the new 64-bit version of Emotet. We use dumpulator and python to extract the config and write a simple Yara rule.Sample:b481ac05ea9a59eedf6233166327057279babef26c913a8e89536472b192e86cSample Unpacked:ed2640be5ed0a4486ecf7ac97b125e26b9d263624251eae1c9a42e9998ca1e68Lab Notes (with code and Yara rule):Emotet 64-bit Notes
Live Stream VOD: Emotet Deobfuscation Part 4 - IDA Python Binary Patching
In this Twitch stream we create a binary patching script using IDA Python to patch our obfuscated Emotet sample.In the end we determine that directly patching the end of each state is not going to work since the flags we rely on may change within the state. Our workaround is to save the flags which gives us a complete solution but it still doesn't look great for the analyst. We need another solution....Sample: c7574aac7583a5bdc446f813b8e347a768a9f4af858404371eae82ad2d136a01Sample Unpacked (this is the one we use in the stream): eeb13cd51faa...
Live Stream VOD: Emotet Deobfuscation Part 3 - A Generic Algorithm and Patching
In this Twitch stream we complete our generic deobfuscation algorithm and test it on an obfuscated Emotet sample.We build off of our work from the previous stream and attempt to finally patch out the obfuscation from this sample. We almost... complete... it...Sample: c7574aac7583a5bdc446f813b8e347a768a9f4af858404371eae82ad2d136a01Sample Unpacked (this is the one we use in the stream): eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827Rough notes (with code): Emotet Deobfuscation Generic Solution
Live Stream VOD: What is Symbolic Execution and How Does it Help With Deobfuscation (Back to Basics)
In this Twitch stream we take a pause to go back and walk through the basics of what symbolic execution really is, and how it can help us with deobfuscation. This was a much requested stream, and hopefully it helps everyone is able to catch up so we all have the same base of knowledge as we continue to build our one-click easy button tool for CFF deobfuscation.Lab Notes: Symbolic Execution For Deobfuscation The Basics
Live Stream VOD: Emotet Deobfuscation Part 2 - Attempting A Generic Algorithm to Learn The Control Flow
In this Twitch stream we attempt to build a generic algorithm to separate the dispatcher basic blocks from the original basic blocks in an obfuscated Emotet sample.We build off of our work from the previous stream and attempt to convert our assembly specific algorithm to a generic algorithm that uses symbolic execution with Angr instead of direct analysis of the assembly code. Our hope is that with a generic algorithm we can remove the manual work that we had to perform as an analyst identifying the control flow assembly instructions and patter...
Live Stream VOD: Emotet Deobfuscation Part 1 - Learning The Control Flow
In this Twitch stream we begin to look at the CFF obfuscation in Emotet. Our first step is to build an algorithm to separate the dispatcher control flow blocks from the original basic blocks.We have a rough start since the function we focus on has two entry points to the dispatcher which means we can't use the same approach we used for Pandora ransomware and need to develop a more generic algorithm. To get started we decide to use use a non-symbolic-execution approach and simply analyzing the disassembly directly to separate the dispatcher ...
