Skip to main content

rinse and REpeat analysis

Search This Blog

Reversing Portable Executables

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Deobfuscating/REversing Remcos - AutoIt, Shellcode, and RunPE
Reversing Cerber - RaaS
Picking Apart Poweliks - Fileless(ish) Malware

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Comments

Post a Comment

Popular Posts

Analyzing Windows shellcode - triage, disassemble, debug.

If simply put, shellcode is a piece of low-level code (in hex) carefully tailored to be directly interpreted by the CPU. The CPU executes instructions in the form of machine code, these instructions are typically referred to as opcodes or operation codes. Here are a couple popular instructions you'll often come across (1 per line): 55 8B EC These instructions will be directly executed by the CPU, which will then perform two specific tasks: 55 push ebp 8B EC mov ebp, esp The code on the right of the opcodes is the opcodes' corresponding assembly instructions. Assembly (or assembler) is a human readable representation of these opcodes. These two instructions are setting up a new stack frame, which you can equate to entering a new function in a high-level programming language like C/C++. So just think of shellcode as PIC (Position Independent Code) ready to hit the CPU. Shellcode may come in a few different flavors, here are some formats you might come acros

Deobfuscating/REversing Remcos - AutoIt, Shellcode, and RunPE

Remcos is a robust RAT actively being used in the wild. This multi-staged/evasive RAT provides powerful functionality to an attacker. Each stage is written in a different language: AutoIt -> Shellcode -> C++. I wanted to explore both the evasiveness, and core functionality of the malware. This variant is a compiled AutoIt script. AutoIt executables store their payload in the resource section, and load it at runtime via LoadResource. AutoIt is de-compilable, this can be performed by dropping the executable into Exe2Aut. The source code is obfuscated, but can be easily deobfuscated with Python. Here is a block of code obfuscated with a recurring algorithm used throughout the malware. Function and variable names are randomized, and the first line of the function begins with defining an array of 169 elements. Each element is an integer, the result of either an addition or subtraction. The malware then iterates through this array, passing each element to the ChrW()

Early Bird Injection - APC Abuse

An Asynchronous Procedure Call is basically a function/code that is set to execute (a synchronously) within the context of a specified thread. Said functions (callbacks) are added to the APC Queue of a particular thread - which will then be executed in First in First Out order once the thread enters an alertable state. Every running thread has its own APC Queue, APCs can be added to this queue via the QueueUserAPC () WinAPI call. Get additional info from the experts here: https://docs.microsoft.com/en-us/windows/desktop/sync/asynchronous-procedure-calls Malware authors can abuse APCs to get code to execute evasively. One particular APC injection technique is 'Early Bird Injection'. This technique involves creating the target process in a suspended state, injecting code into the suspended process, adding an APC (pointing to the injected code) to the target process, and finally resuming the suspended thread - allowing the malicious APC to execute. This technique allows our c

Powered by Blogger