seanmw's profile picture. UnpacMe | OALABS | Security Researcher

sean

@seanmw

UnpacMe | OALABS | Security Researcher

Pinned

Let the unpacking begin!! Looking forward to working on some cool @unpacme features for 2025!! 👾🚀🚀🚀

seanmw's tweet image. Let the unpacking begin!! Looking forward to working on some cool @unpacme features for 2025!! 👾🚀🚀🚀

sean reposted

We've uploaded our stream from Oct 24 where we continued analyzing the SORVEPOTEL infection chain, including shellcode, Maverick.Agent.StageTwo, Maverick Agent, and a PowerShells WhatsApp worm. Big shout out to @dodo_sec, @washi_dev and @unpacme for helping with this stream.

InvokeReversing's tweet image. We've uploaded our stream from Oct 24 where we continued analyzing the SORVEPOTEL infection chain, including shellcode, Maverick.Agent.StageTwo, Maverick Agent, and a PowerShells WhatsApp worm. Big shout out to @dodo_sec, @washi_dev and @unpacme for helping with this stream.

sean reposted

The CFP for RE//verse 2026 is open, but not for long! Submissions close November 14th. Share your best RE and security research with us here: sessionize.com/reverse-2026

REverseConf's tweet image. The CFP for RE//verse 2026 is open, but not for long! Submissions close November 14th. Share your best RE and security research with us here: sessionize.com/reverse-2026

sean reposted

We at @emproofsecurity open-sourced a free firmware reverse engineering workshop for self-study. Topics: ELF analysis, cracking, malware triage, embedded-Linux, bare-metal, crypto-key extraction, anti-analysis. Docker setup and solutions included. github.com/emproof-com/wo…


sean reposted

We’ve seen a spike in submissions this morning, which may cause some analysis delays. We’re working to resolve the backlog.


sean reposted

Check out our latest blog post on modeling complex control flow with function-level basic block analysis in Binary Ninja 5.1. From DSPs to Brain***k, this update makes it easier to develop plugins for tricky architectures. binary.ninja/2025/08/12/fun…

vector35's tweet image. Check out our latest blog post on modeling complex control flow with function-level basic block analysis in Binary Ninja 5.1. From DSPs to Brain***k, this update makes it easier to develop plugins for tricky architectures. binary.ninja/2025/08/12/fun…
vector35's tweet image. Check out our latest blog post on modeling complex control flow with function-level basic block analysis in Binary Ninja 5.1. From DSPs to Brain***k, this update makes it easier to develop plugins for tricky architectures. binary.ninja/2025/08/12/fun…
vector35's tweet image. Check out our latest blog post on modeling complex control flow with function-level basic block analysis in Binary Ninja 5.1. From DSPs to Brain***k, this update makes it easier to develop plugins for tricky architectures. binary.ninja/2025/08/12/fun…

sean reposted

Using the UnpacMe byte-search IDA plugin we found some Scavenger related malware dating back to October 2024. At the time the malware was dubbed ExoTickler. Analysis follows...

herrcore's tweet image. Using the UnpacMe byte-search IDA plugin we found some Scavenger related malware dating back to October 2024. At the time the malware was dubbed ExoTickler.

Analysis follows...

sean reposted

Hey all! As promised, here's the in-depth analysis @JershMagersh from @InvokeReversing and I did of the malware strain that's been spreading through NPM in the last few days following a successful phish. We present to you: Scavenger. c-b.io/2025-07-20+-+I…

cyb3rjerry's tweet image. Hey all! As promised, here's the in-depth analysis
@JershMagersh from @InvokeReversing and I did of the malware strain that's been spreading through NPM in the last few days following a successful phish.   

We present to you: Scavenger.

c-b.io/2025-07-20+-+I…

sean reposted

We've uploaded our Time Travel Debugging in Binary Ninja stream with Xusheng Li from @vector35 where we unpacked malware and analyzed anti-analysis capabilities with TTD traces. Enjoy!

InvokeReversing's tweet image. We've uploaded our Time Travel Debugging in Binary Ninja stream with Xusheng Li from @vector35 where we unpacked malware and analyzed anti-analysis capabilities with TTD traces. Enjoy!

sean reposted

May be getting time to refresh why threat actor names exist and why they are important. They're not for marketing. silascutler.com/2021/01/14/Kil…


sean reposted

Contract is signed! No confidentiality, AMD has leadership that's capable of acting. Let's make this training run happen, we work in public on our Discord.


sean reposted

UnpacMe 8.7.2 - AI Script Analysis, Hunting, and Decompilation Updates 🚀 blog.unpac.me/2025/06/05/ai-…


sean reposted

🔥 TitanHide has been updated to support the latest VMProtect 3.9.4 changes! The service name is now used as the device name as well, so the check for \\.\TitanHide will fail if you name the service differently 🧠

mrexodia's tweet image. 🔥 TitanHide has been updated to support the latest VMProtect 3.9.4 changes!

The service name is now used as the device name as well, so the check for \\.\TitanHide will fail if you name the service differently 🧠

For half of the "encrypted" strings this stealc sample checks that the decrypted value is correct??? 🤣🤣

seanmw's tweet image. For half of the "encrypted" strings this stealc sample  checks that the decrypted value is correct??? 🤣🤣

sean reposted

Unpacking VMProtect 3 (x64) 🤷‍♂️


sean reposted

Over the past year I have been working on Python bindings (icicle-python) in stealth-mode. You can try it out today! The reversing community desperately needs alternatives to unicorn. Icicile is based on Ghidra's semantics and improvements there come essentially for free!

mrexodia's tweet image. Over the past year I have been working on Python bindings (icicle-python) in stealth-mode. You can try it out today!

The reversing community desperately needs alternatives to unicorn. Icicile is based on Ghidra's semantics and improvements there come essentially for free!

My emulator now supports icicle-emu as emulation backend. It serves as an alternative to the unicorn engine. The project is written in rust and looks very promising: github.com/icicle-emu/ici… However, first tests seem to show that unicorn is still faster. github.com/momo5502/emula…



sean reposted

New YARA hunting for decompiled scripts with UNPACME... Lazy malware devs exposed 👀


sean reposted

☕ ThreatLabz has discovered a new sophisticated malware threat that we have named CoffeeLoader. The malware is a loader that implements numerous stealthy techniques to evade antivirus and EDRs via call stack spoofing, sleep obfuscation, and Windows fibers. The malware is also…

Threatlabz's tweet image. ☕ ThreatLabz has discovered a new sophisticated malware threat that we have named CoffeeLoader. The malware is a loader that implements numerous stealthy techniques to evade antivirus and EDRs via call stack spoofing, sleep obfuscation, and Windows fibers. The malware is also…

sean reposted

UPX -> PyInstaller -> PS -> Xworm Full triage with UNPACME 🚀


sean reposted

UNPACME 8.7.0 Malicious Python analysis, AI safety, binary signature hunting, and much more! blog.unpac.me/2025/02/05/unp…


Loading...

Something went wrong.


Something went wrong.