Malware Reverse Engineering

364 topics in this forum

1. 

   A blog post about Reversing Multilayer .NET Malware

   December 5, 2016 by SkyProud

   • 0 replies
   • 5.8k views

   This blog post discussed the details of analysing some .net malware: http://blogs.cisco.com/security/talos/reversing-multilayer-net-malware

   

   Last reply by SkyProud, December 5, 2016
2. 

   LeeZay sending malwares

   November 26, 2016 by TheProxy RE

   • 0 replies
   • 4.9k views

   so this guy send me actualy maware so he can export shit from my pc or get some kind of information. here is detailed info about malware + screenshots https://www.hybrid-analysis.com/sample/d3e07c339ba952865e87000636b92fe67f23e9aaf2cd24f9e4d65552e9c51526?environmentId=100 Also here is unpacked malware: http://www12.zippyshare.com/v/RnmwqGGT/file.html (Do not open if you dont have any malware checking skill) (Open at your own risk)

   

   Last reply by TheProxy RE, November 26, 2016

   • 
3. 

   write a sandbox

   September 10, 2016 by rever_ser

   • 2 replies
   • 17.8k views

   hi I want to write a sandbox. I want to know exactly what parts made up a sandbox and how to work any how. Can anyone recommend a resource in this regard?

   

   Last reply by Noteworthy, October 25, 2016

   • 
4. 

   How to decode string in malware ?

   September 26, 2016 by kb432

   • 3 replies
   • 7.2k views

   How to decode Encoded or Encrypted string in Reverse engineering a malware ? i heard there is a way using python script and Immunity debugger ? What is most effective option and which options should i try ? I looked up youtube and good but nothing useful. Help me with this. Thanks Tuts4you!

   

   Last reply by Noteworthy, October 25, 2016

   • 
5. 

   Does anyone have old Locky sample?

   October 23, 2016 by gundamfj

   • 7 replies
   • 5.7k views

   So I am doing research on Locky. I notice recent Locky sample doesn't import SMB related API. You may have heard of Locky also tries to encrypt files in network share e.g. printer. So does anyone have old Locky samples(5 months ago)? I got one old sample from one guy in this forum. But that sample crashes on InterlockedIncrement. I could only find recent samples in VirusShare.

   

   Last reply by Noteworthy, October 25, 2016

   • 
6. 

   need help to unpack .NET malware

   October 16, 2016 by gundamfj

   • 17 replies
   • 9.6k views

   I have this malware(possibly Locky variant), which is packed by an unknown packer(de4dot -d). It looks like it's packed by customized ConfuserEx, but I am not 100% sure(newbie). I have tried using tools like NoFuserEx, de4dot, UnconfuserEx, without any luck. I have this idea: maybe I could pause on some memory management API, e.g. VirtualAlloc and monitor the memory region's size it allocates. If the memory region is enough large to hold the malware actual payload, keep an eye on it, maybe I could finally get the payload. So is there any .NET debugger allowing me to pause on System API like VirtualAlloc? I know I could use debugger like Olly, but if I open…

   

   Last reply by Etor Madiv, October 19, 2016

   • 
7. 

   cerber ransomware reverse question

   August 18, 2016 by Guest kinn7s

   • 1 follower
   • 3 replies
   • 6.3k views

   Hi, I'm reversing this ransomware after an interesting reading found surfing the net. hxxps://blog.malwarebytes.com/threat-analysis/2016/03/cerber-ransomware-new-but-mature/ What I'm trying to do is reversing the file encryption routines. Found where key is generated, buffer encrypted ecc. Can't undestand how the key is encrypted and stored into the file! (decrypt the original key) If someone is really interested, I'll share my findings (malware authors read this forum too I guess...) I'm doing this only because it' become a big challange to me and can't move on... sorry for my english

   

   Last reply by Guest, August 20, 2016
8. 

   I have a malicious dotnet sample

   July 29, 2016 by Hacktreides

   • 5 replies
   • 6k views

   Hello, I have a malicious dotnet sample packer, anyone known the packer type and how to unpack it? I have try de4dot but it's failed. Thank you Dumped.zip

   

   Last reply by 0xNOP, July 31, 2016

   • 
9. 

   Research Rootkit (Linux)

   July 25, 2016 by kao

   • 0 replies
   • 4.9k views

   https://github.com/NoviceLive/research-rootkit

   

   Last reply by kao, July 25, 2016

   • 
10. 

    Reference a movie? auscultated code!

    June 12, 2016 by 0nion

    • 1 reply
    • 5.5k views

    A reference from "black hat' movie 2015. The hacker cracks Encrypted code. How a malware has Encrypted code ended in ? And how to crack that ? Any information or tutorial or article would be appreciated. I do reverse engineer using IDA pro ( static analysis ).

    

    Last reply by crystalboy, June 12, 2016

    • 
11. 

    Guide for Static malware analysis [?]

    April 20, 2016 by Cyberwarfare

    • 5 replies
    • 6k views

    Is there any Ebook or video series or tutorial on Reverse engineering using IDA Pro ( static analysis ) ? I will appreciate your concern ! Thanks

    

    Last reply by XenocodeRCE, April 20, 2016
12. 

    (Help Request) .Net Protector Identification 1 2

    April 2, 2016 by madskillz

    • 25 replies
    • 22.1k views

    Hi I tried die , peid , protecton id , rdg , but cannot detect protector. de4dot detected as deepsea , but deobfuscation ws not done. File attached FoxUserTools.zip File can be malware , etc , please use VM , protection. Need packer identification and unpack help. Regards

    

    Last reply by madskillz, April 12, 2016

    • 
13. 

    reversing industrial malwares

    February 10, 2016 by Mr.peach

    • 6 replies
    • 5.7k views

    Hi all experts I want to know what tools are used to analyze the industrial malwares

    

    Last reply by Mr.peach, February 14, 2016

    • 
14. 

    Reversing an obfuscated java malware

    October 7, 2015 by Extreme Coders

    • 1 reply
    • 7.4k views

    This document is a small write up demonstrating tools and techniques that can be used while reversing java code. The malware used for this purpose is the AlienSpy RAT (Remote Access Trojan) which has also been attached to this post. The password of the file malware sample.rar is infected. This is live malware. Secure your system before tinkering with it. Additionally, the decompiled source code of the malware has also been provided for study. Reversing an obfuscated java malware.pdf malware sample.rar decompiled malware source.rar

    

    Last reply by crystalboy, January 14, 2016

    • 
15. 

    Reverse Kaspersky Virus Signatures

    January 26, 2015 by helderc

    • 4 replies
    • 7.4k views

    Does any body know how to reverse Kaspersky virus signatures? I have looking for something like that in the leaked source code, but its huge and I couldnt find anything. Comments are welcome!

    

    Last reply by cLn, November 17, 2015
16. 

    Which Virtual Machine Software do you prefer? 1 2 3

    September 18, 2011 by deepzero

    • 1 follower
    • 61 replies
    • 35.2k views

    Hi, I have been using Microsoft VirtualPC for years now. Which Virtualization Software do you prefer?

    

    Last reply by Reasen, November 16, 2015

    • 
17. 

    Tyupkin Malware...or bank's worst nightmare

    October 27, 2015 by cucuielu

    • 1 reply
    • 6.4k views

    Can anyone fully deobfuscate theese 2 samples? MALWARE!!! It's not meant for regular PC... Tyupkin.zip

    

    Last reply by Xyl2k, October 31, 2015

    • 
18. 

    WinRAR Vulnerability...

    September 30, 2015 by Teddy Rogers

    • 6 replies
    • 6.7k views

    WinRAR Vulnerability https://blog.malwarebytes.org/security-threat/2015/09/latest-winrar-vulnerability-has-yet-to-be-patched/ Ted.

    

    Last reply by Loki, October 8, 2015

    • 
19. 

    [DecompileMe] Virus found in my PC [.NET]

    September 30, 2015 by bomblader

    • 4 replies
    • 6.8k views

    Looks like I was infected by some virus, no idea where I got it. It's .NET You have to run it like this in order to run: adobe_flash_player.exe /00000017 Anyone can decompile this and find out what's doing? Looks like a custom obfuscator was used. De4Dot is cleaning it up but strings and other data is still encrypted. Thanks! adobe_flash_player.rar

    

    Last reply by kao, September 30, 2015

    • 
20. 

    The Antivirus Hacker’s Handbook

    September 30, 2015 by kao

    • 0 replies
    • 5.8k views

    Table of contents: All I can say is that I really enjoyed the book. Get your own copy from hxxp://ifreebooks.com/book/6295/ or your favorite torrent tracker.

    

    Last reply by kao, September 30, 2015

    • 
21. 

    Tutorials About Viruses

    September 30, 2015 by CodeExplorer

    • 0 replies
    • 6.9k views

    Tutorials About Viruses Link download: http://www82.zippyshare.com/v/GFWYz9g2/file.html Tutorials list: (176 tutorials) 64-bit rugrats.pdf A Survey of Cryptologic Issues in Computer Virology.pdf Advanced Code Evolution Techniques and Computer Virus Generator Kits.pdf Advanced Metamorphic Techniques in Computer Viruses.pdf Advanced Polymorphic Techniques.pdf AGIS- Towards Automatic Generation of …

    

    Last reply by CodeExplorer, September 30, 2015

    • 
22. 

    Reverse malware PDFs

    September 26, 2015 by CodeExplorer

    • 0 replies
    • 5.2k views

    Reverse malware PDFs, Link: http://repo.hackerzvoice.net/depot_madchat/vxdevl/reverse/

    

    Last reply by CodeExplorer, September 26, 2015

    • 
23. 

    VX Reversing I, the basics & VX Reversing II, Sasser.B

    September 26, 2015 by CodeExplorer

    • 0 replies
    • 5.1k views

    VX Reversing I, the basics & VX Reversing II, Sasser.B: Tutorials about viruses. VX_Reversing_I&II.zip

    

    Last reply by CodeExplorer, September 26, 2015

    • 
24. 

    Malware Forensics- Investigating and Analyzing Malicious Code

    September 25, 2015 by CodeExplorer

    • 0 replies
    • 5.5k views

    Malware Forensics- Investigating and Analyzing Malicious Code Link download: http://www97.zippyshare.com/v/JZbv2iGo/file.html

    

    Last reply by CodeExplorer, September 25, 2015
25. 

    Identifying Malicious Code Through Reverse Engineering

    September 23, 2015 by CodeExplorer

    • 0 replies
    • 5.6k views

    Identifying Malicious Code Through Reverse Engineering Author: Sushil Jajodia Identifying Malicious Code Through Reverse Engineering.zip

    

    Last reply by CodeExplorer, September 23, 2015

    •