Recognize STL code easily
Recognizing STL code with ease 😐 During reverse engineering, we often encounter STL code whose analysis at first glance seems difficult. An inexperienced eye ma…
Again CFG
CFG again 👋 A common task when extracting malware configurations at scale is obtaining function boundaries and references. The most typical example is string de…
Click trap: not only for users, but also for link analyzers
Click trap: not only for users, but also for link analyzers 🐭 When manually analyzing links, we typically ask ourselves only one question — “is it safe?” ✔️❌ Tr…
Cyber Threat Library: Basic Minimum or Luxurious Maximum?
Cyber Threat Library: Basic Minimum or Luxurious Maximum? 🔍 In the world of information security, the term "cyber threat library" periodically appears in variou…
Sold my phone with my personal data ☹️
Sold a phone with my personal data ☹️ When purchasing donor devices on platforms for selling personal items, a negative trend is emerging: many people rarely wo…
Using IoC unconventionally. Part 2. Threat Landscape
Using IoC in a Non-Standard Way. Part 2. Threat Landscape 🧘♀️ Earlier, we discussed how to use indicators of compromise for Threat Hunting. This time, we’ll ta…
Deobfuscating .NET function names manually
Deobfuscating .NET function names manually 🙌 .NET malware loves packers, obfuscation (of names, CFG, and other things), and multi-stage reflective image loading…
Searching for phishing infrastructure at the preparation stage
Searching for Phishing Infrastructure at the Preparation Stage 🧱 In protecting an organization from phishing threats, it is useful not to limit yourself to simp…
🦈 Looking under the hood of secure connections in Wireshark. Part 3.1: MITM attack on SSL/TLS connections
In addition to the previous post we are looking at additional tools for decrypting network traffic. Let's look at an alternative to PolarProxy that is no…
🦈 Looking under the hood of secure connections in Wireshark. Part 3: MITM attack on SSL/TLS connections
MITM attack is a fairly popular feature of various sandboxes and application analysis systems. Typically, tools that enable MITM attacks are a proxy serv…
🦈Looking "under the hood" of secure connections in Wireshark. Part 2: Windows protocols
In the first part, we examined the decryption of TLS connections, which are often used on the internet. But if we move inside a corporate environment, other pro…
Looking under the hood of secure connections in Wireshark. Part 1: TLS
🦈 Looking Under the Hood of Secure Connections in Wireshark. Part 1: TLS Our network experts often need to decrypt TLS connection traffic and analyze protected…