Aug 14Thanks All!Thank you everyone who came out to my Black Hat and Defcon Presentations!1 min read1 min read
Jun 9A PCAPS TaleSo I decided to randomly grab a PCAP from https://www.malware-traffic-analysis.net/ and analyze it, specifically the sample https://www.malware-traffic-analysis.net/2022/02/23/index.html Lets get to it I guess? I started off looking directly at the HTTP queries to see what sites had been visited as a lot of malware use the HTTP protocol for communications…Malware4 min readMalware4 min read
Jun 8Black Hat Arsenal 2023Hey all, just wanted to say I got accepted to present at Black Hat Arsenal again this year so if you attend Black Hat come stop by and say hello! https://www.blackhat.com/us-23/arsenal/schedule/index.html#glyph---an-architecture-independent-binary-analysis-tool-for-fingerprinting-functions-through-nlp-33622Cyberops1 min readCyberops1 min read
May 29Hyper-V Entire Host Disk AccessSo I quickly wanted to cover a quick little issue I came across over the past week. If a general user with non-administrative privileges has an administrator open Hyper-V Manager for them to access/manage/create a VM, process inheritance can lead to entire disk access. …Hyper V3 min readHyper V3 min read
Dec 23, 2022HTTP Covert Channels — Hiding C2 and exfiltration in plain sightI put together a quick little demo of covert channels over HTTP and why they can be not exactly easy to pick out when viewing network traffic. This is obviously a toy example and should not be taken as the end all to covert channels, an expert in the field…Obfuscation3 min readObfuscation3 min read
Dec 23, 2022Self Mutating Code: Obfuscation Fun — PART 02In part 01 of this blog post, I covered how you can utilize a function overwrite with shellcode to obfuscate code to make reverse engineering more difficult and to hide capabilities from anti-virus applications. In this addition, part 02, I will be covering additional capabilities utilizing network communications to send…C Plus Plus Language5 min readC Plus Plus Language5 min read
Dec 23, 2022Self Mutating Code: Obfuscation Fun — PART 01Reverse engineering code can be complicated enough, but what can make things really weird is when the instructions you see in code being called do not execute as you expect. …Coding4 min readCoding4 min read
Dec 22, 2022Reversing A Malicious Office Document — Part 02In Part 01 we tore apart a new Emotet variant’s malicious Office document dropper file, this time in part 02, lets take a look at the binary that’s downloaded by that Office document. File MD5 — ee15dbb42e1c2d8f5b3e2a8558994d54 The first thing I started with when analyzing this file was checking its…Malware Analysis4 min readMalware Analysis4 min read
Dec 22, 2022Reversing A Malicious Office Document — Part 01So as I mentioned, I was going to tear apart a document for fun and go over it on here. I like looking at malicious Office documents, for one, they still play a large part in infections mostly as droppers, as it was reported 43% of infections in 2020 were…Malware Analysis5 min readMalware Analysis5 min read
Dec 22, 2022Wavlink Quantum D4G Zero Day — Part 04Today’s post will be covering a combination of two vulnerabilities, resulting in an admin credential dump. Before we get into it, as always this material is for educational purposes and awareness, no unethical behavior with this information is encouraged. For the first part of this let us cover once again…IoT2 min readIoT2 min read
