MalwareMechanic's profile picture. Malware and stuff

Malchanic

@MalwareMechanic

Malware and stuff

Malchanic reposted

The #flareon10 countdown is now live at flare-on.com. Clear your weekend plans for Sept. 30th.


Malchanic reposted

capa explorer integrates capa’s automated capabilities detection seamlessly with IDA Pro. The plugin aims to focus your reverse engineering efforts, especially when analyzing malware. Check it out and let us know what you think!

Ready for a new #PluginFocus blog post? @mehunhoff, @m_r_tz and @williballenthin from the @Mandiant FLARE Team talk about the latest version of their #capaexplorer plugin, an entry in our 2020 plugin contest 🌐 hex-rays.com/blog/plugin-fo… #IDAPro #IDAPython #IDAPlugin

HexRaysSA's tweet image. Ready for a new #PluginFocus blog post? @mehunhoff, @m_r_tz and @williballenthin from the @Mandiant FLARE Team talk about the latest version of their #capaexplorer plugin, an entry in our 2020 plugin contest 🌐 hex-rays.com/blog/plugin-fo… 

#IDAPro #IDAPython #IDAPlugin


Malchanic reposted

🚨 capa v5 release is out! Great improvements with big additions for .NET binary analysis. Did you know that capa displays the method token + instruction offset for each .NET match? You can use this info to find the matched location in dnSpy helping focus your analysis!

mehunhoff's tweet image. 🚨 capa v5 release is out! Great improvements with big additions for .NET binary analysis. Did you know that capa displays the method token + instruction offset for each .NET match? You can use this info to find the matched location in dnSpy helping focus your analysis!

capa v5.0.0 is out: major improvements for .NET binary analysis, 150 new/updated rules, caching to improve performance standalone and in the IDA Pro plugin, better ELF OS detection, and a lot more. github.com/mandiant/capa/… VirusTotal integration updates are next!



What better way to finish off the year than a fresh release of FLARE VM?! 🥳 This release focuses on empowering community contributions and automation. Get it while its hot 🔥🔥🔥mandiant.com/resources/blog…


Remember to sleep! #flareon9

#flareon9 Pre-registration is now live! flare-on9.ctfd.io



Get pumped!

Don't miss the next installment of the Mandiant FLARE team's webinar series, The Sample. This week, Principal Reverse Engineer Blaine Stancill will explain the inner workings of a dropper from the #WHITEDAGGER malware family. Register now! mndt.info/3UJAUGj

Mandiant's tweet image. Don't miss the next installment of the Mandiant FLARE team's webinar series, The Sample. This week, Principal Reverse Engineer Blaine Stancill will explain the inner workings of a dropper from the #WHITEDAGGER malware family. Register now! mndt.info/3UJAUGj


Malchanic reposted

🚨 Today we're excited to release Ghidrathon, a Ghidra extension that adds modern Python 3 scripting (including Python 3.10) to Ghidra! Blog 👉 mandiant.com/resources/blog… GitHub 👉 github.com/mandiant/Ghidr…


Malchanic reposted

For people learning malware evasion techniques, the #UnprotectProject can often provide you the answer 😊 #infosec #malware cf: @DarkCoderSc unprotect.it/technique/ntse…


Malchanic reposted

[2/2] you got last native loader which will be hosting .NET to be able to load "redline" code which is written in .NET. If you want to process the unpacking of these sh*t loading .NET payload really quickly use DNSpy. Load the original native sample, set module breakpoint - bam

vinopaljiri's tweet image. [2/2] you got last native loader which will be hosting .NET to be able to load "redline" code which is written in .NET. If you want to process the unpacking of these sh*t loading .NET payload really quickly use DNSpy. Load the original native sample, set module breakpoint - bam
vinopaljiri's tweet image. [2/2] you got last native loader which will be hosting .NET to be able to load "redline" code which is written in .NET. If you want to process the unpacking of these sh*t loading .NET payload really quickly use DNSpy. Load the original native sample, set module breakpoint - bam
vinopaljiri's tweet image. [2/2] you got last native loader which will be hosting .NET to be able to load "redline" code which is written in .NET. If you want to process the unpacking of these sh*t loading .NET payload really quickly use DNSpy. Load the original native sample, set module breakpoint - bam
vinopaljiri's tweet image. [2/2] you got last native loader which will be hosting .NET to be able to load "redline" code which is written in .NET. If you want to process the unpacking of these sh*t loading .NET payload really quickly use DNSpy. Load the original native sample, set module breakpoint - bam

FLOSS v2.0 just dropped!! This release is packed full of updates and deobfuscates even more strings! mandiant.com/resources/flos…


Malchanic reposted
rivitna2's tweet image. For #APT #PlugX lovers ;-)
github.com/rivitna/APT/tr…

Malchanic reposted

#flareon8 Pre-registration is live for all you speed-runners out there: 2021.flare-on.com


Do you hear that?... It's almost here!! Get ready to: - 🍴Eat - 😴Sleep - 👾Reverse - ♾Repeat 👾🥳👾 #FLAREOn8 👾🥳👾

Get excited! #FLAREOn8 kicks off this Friday 8PM ET/5 PM PT at flare-on[dot]com. This year’s contest will consist of 10 challenges and feature a variety of formats, including Windows, Linux, and JavaScript. Learn more: feye.io/3zIuwnG



Malchanic reposted

Malware using CLFS logs to hide a payload? Check out this analysis by myself and @MalwareMechanic on some tricky malware we named PRIVATELOG and a related utility/installer called STASHLOG. fireeye.com/blog/threat-re…


Malchanic reposted

The FLARE Team & @Mandiant now have Summer 2022 #internships open! The FLARE Team is specifically looking for the following roles: 🔸Malware Reverse Engineer: jobs.smartrecruiters.com/FireEyeInc1/74… 🔸Research Engineer: jobs.smartrecruiters.com/FireEyeInc1/74… 🔸Vulnerability Engineer: jobs.smartrecruiters.com/FireEyeInc1/74…


Malchanic reposted

after months of development, capa v2.0 is released! new features make it easier than ever to contribute rules that describe capabilities seen in malware. particular thanks to @m_r_tz @mehunhoff @anamma_06 and @_re_fox for dozens of features & rules each fireeye.com/blog/threat-re…


Where will you be tonight?! 🧐 Don't. Miss. Out! 🥳 🎉 Preview the hype: soundcloud.com/jordanaofficial

MalwareMechanic's tweet card. Jordana

soundcloud.com

SoundCloud: The Music You Love

Jordana

TODAY! Celebrate LGBTQIA Pride with us, as @jordanalesesne throws down a 90-minute DJ set of swung #UKG + blistering #DnB with novel visualizations by @djjulia 🤟🌈🌴 Friday June 25th 7 PM PT / 9 CT / 10 ET m.mixcloud.com/live/FireEyeCy…



Loading...

Something went wrong.


Something went wrong.