Skip to main content

Questions tagged [malware]

Malware, a portmanteau for malicious software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to computer systems.

Filter by
Sorted by
Tagged with
0 votes
1 answer
80 views

X64DBG Conditional Breakpoint on Specific Opcode?

Is there any way to break on specific opcode in X64DBG? For example i want to break on start of a function which is 55 | push ebp 8BEC | mov ebp,esp can i set a breakpoint like opcode == 0x00EC8B55? ...
Behrooz Sohrabloo's user avatar
0 votes
0 answers
37 views

Is it possible to hide androidmanifest.xml

I heard from someone today that androidmanifest.xml is hidden by new malware. I couldn't find anything about this on the internet. Is it possible?
mustafa günel's user avatar
1 vote
0 answers
76 views

trying to understand how Redboot ransomware works

this sample is able to drop exes though I'm not sure how the report indicates it calls CreateFileW though changing the call's outcome doesn't work is Redboot using heaven's gate (or another technique) ...
ALsec's user avatar
  • 11
0 votes
1 answer
177 views

.NET Packer/Protector

I have been trying to analyse a .NET trojanized software, here is the link for reference:https://www.virustotal.com/gui/file/6186e0b5b1d820744f8f7aa682eec6b043ba11c7737a64e173522b8b55d06f81/detection ...
ElementalX's user avatar
1 vote
2 answers
243 views

Identifying file-access functions used by explorer.exe

I'm trying to write a Windows 10 64-bit rootkit that runs on userland and hides files using IAT hooking. I managed to accomplish that on cmd.exe by hooking FindFirstFileW and FindNextFileW imported ...
one_hell_of_a_guy's user avatar
3 votes
1 answer
630 views

How to reverse Engineer a Struct in IDA Pro?

How to identify and define a struct in IDA pro Decompiling during reverse engineering? Please explain the easiest way to figure out the struct in IDA Pro decompilation! To make life easier are there ...
Jose I. Hughes's user avatar
4 votes
2 answers
290 views

Malware analysis - Debugger hangs at HttpSendRequestA

I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC. I was able to replicate this behaviour with a small ...
Luca D'Amico's user avatar
4 votes
0 answers
118 views

API Breakpoints not hitting while debugging a malware using x32dbg

I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful. I am going through a malware analysis course and following the debugging ...
Daksh Kapur's user avatar
1 vote
0 answers
36 views

Yara Rules 4.3 Warnings

$hex = {CC CC CC CC CC CC CC CC} Warning : "$hex" may slow down scanning Do anyone know how to remove this warning
Satyam Singh's user avatar
2 votes
0 answers
57 views

WinDbg Preview search is not returning results

I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
Jason Crosby's user avatar
0 votes
0 answers
70 views

Why is Windows 10 still blocking me from running malware?

I am analyzing some malware on Windows 10. I installed FLARE VM, disabled tamper protection and disabled the virus scanner in the registry. However when I attempt to run a malware, Windows is still ...
Jason Crosby's user avatar
2 votes
0 answers
216 views

In IDA freeware, how to create a new database in IDC and load a file into it?

I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder. What ...
IDAIDCMalAnalysis's user avatar
1 vote
0 answers
274 views

IDA pro Error how to resolve this error

52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672) How to solve this? I have seen sandbox reports in those the ...
Satyam Singh's user avatar
2 votes
0 answers
177 views

How can i Lifting x86_64 assembly code to LLVM-IR

I'm researching of virus and I'm faced with the task of deobfuscating its virtual machine. I chose to do this through LLVM and I had a question, where can I see a simple example of lifting ...
OSPFv3's user avatar
  • 21
5 votes
1 answer
1k views

How 10 IS HEX 5 bytes?

I am stuck in this video. Please solve this issue. This video is about Encryption and Decryption using Win32 API. https://www.youtube.com/watch?v=OQuRwpUTBpQ In this video 27:07 it's saying "10 ...
David L. Wilson's user avatar
2 votes
1 answer
738 views

How to dump PE from Injected Code using x32dbg?

How do I extract or dump injected executable code/payload from malware using the x32dbg trick? My malware sample is injecting an Exe PE file in a legitimate File like "Explorer.exe". How do ...
David L. Wilson's user avatar
3 votes
1 answer
296 views

Reverse Engineering Dynamic Malware Imports?

How is it possible to reverse engineer dynamic malware imports using a debugger like x32dbg or Ollydbg? I want to dump process injection malware using a debugger trick using a breakpoint on write ...
David L. Wilson's user avatar
2 votes
0 answers
75 views

Reverse engineering of Process manager apk

Is there someone helps me to understand how to build the server of this apk https://lab52.io/blog/complete-dissection-of-an-apk-with-a-suspicious-c2-server/ ? I tried to disassemble the apk but it is ...
Gregor's user avatar
  • 37
0 votes
0 answers
35 views

Malware apk in Android [duplicate]

Is there some website where i'm able to find malware apk filtering by permission (for instance: RECORD_AUDIO)? I'm looking for website similar to pithus
Gregor's user avatar
  • 37
3 votes
0 answers
97 views

Is there a Capturebat alternative on windows 10 for file capture?

I've been looking for a capturebat alternative that will function on Windows 10 and 64 bit. I'm not interested in capturbat's network capabilities; rather, I'm interested in its capacity to capture ...
dakar111's user avatar
1 vote
2 answers
288 views

Reversing .net crypter with obfuscated imports

I have started recently with reverse engineering. I came across the linked file. It is a packed/crypted putty.exe. (WARNING: IT MAY BE BACKDOORED!!) How it's working and loading putty.exe with runpe ...
Sauseee's user avatar
  • 21
2 votes
0 answers
47 views

How to get the APIs present in a particular block in a CFG using Angr?

I'm doing binary analysis based on Control Flow Graph (CFG). As I suppose to get the APIs from every block in the CFG. I'm finding it very difficult to do so using Angr as I don't have enough grip on ...
okokok hack's user avatar
0 votes
1 answer
133 views

Malware application in Android

Is there some website that give us the possibility to download malware APK in order to study it? I’m interested to study the abuse of android.permission.RECORD_AUDIO in Android 8.
Gregor's user avatar
  • 37
1 vote
1 answer
58 views

How to know each register value instruction by instruction in a binary using radare2?

As I am using the radare2 for reverse engineering, I find it very difficult to get all the register values instruction by instruction with the help of the Radare2 tool. Could someone please help me to ...
okokok hack's user avatar
0 votes
1 answer
353 views

Hex editing an IP address of a different length

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
securityauditor's user avatar
2 votes
1 answer
427 views

x64dbg : TraceInto only in user code

The question seems pretty simple, but I can't achieve this simple thing in a reasonable time. I have a malware proceeding to deobfuscate a large amount of APIs in memory. Only the pointer to the ...
HK47's user avatar
  • 23
4 votes
0 answers
126 views

How to analyze EFI dynamically?

I'm new to reversing UEFI Malware. There is a UEFI rootkit called MoonBounce which I'm trying to analyze dynamically; It's an EFI driver. I tried a tool called efi_dxe_emulator but it needs an NVRAM ...
Raafat's user avatar
  • 163
2 votes
0 answers
132 views

CFT challenge with Trojan malware?

I am trying to solve a CTF challenge with levels with escalating difficulty. At this point, the program (PE32 executable) is detected as malware (wacatac to be more precise) by Windows Defender. It ...
Horia Pantelimon's user avatar
1 vote
1 answer
286 views

Does opening a crash dump run a file in memory?

I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
Ice_cube's user avatar
0 votes
0 answers
270 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
OneAndOnly's user avatar
0 votes
0 answers
179 views

Malware analysis of undetected NodeJS token grabber

I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'. Someone contacted me asking to playtest a game, which prompted a .exe file. I ran the file and website on ...
Louis Vanhove's user avatar
1 vote
0 answers
638 views

Decompiling a Node.js application compiled with nexe

Someone have sent a Discord token stealer and out of curiosity, I would like to decompile it, just to get some info about the attacker. Judging by folders created in my user directory, multiple ...
nolemretaW's user avatar
0 votes
1 answer
480 views

decoding thread context structure in x64dbg

Is there any way to decode the thread context structure returned by "GetThreadContext" and used by "SetThreadContext" in x64dbg?
prakashyadav008's user avatar
1 vote
1 answer
185 views

What is the meaning of SYSTEM_INFO.wProcessorLevel?

I am performing some RE on a malware sample, and they are checking the value of SYSTEM_INFO[32] which is SYSTEM_INFO.wProcessorLevel. The description MS provides is not clear to me. The malware checks ...
RiskyDiablo's user avatar
0 votes
1 answer
179 views

Decode byte numbers into string

There is this grabber called Itroublve grabber, which a lot of people use, and I wondered what it's aes encryption key is, so I looked at the code, and I found this: Key = new byte[] { ...
Nqndi's user avatar
  • 35
4 votes
1 answer
1k views

Is it possible to fake being joined to a domain in Windows 10?

I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain. Rather than standing up my own ...
Sean W.'s user avatar
  • 151
1 vote
1 answer
156 views

Problem with analyzing malware

We have a malware that blocks all analytics software in real time. This software has blacklisted a large list of software that performs analysis (x64dbg, ida, serialport monitor, etc.) This software ...
ILYA20's user avatar
  • 31
0 votes
2 answers
362 views

Format of data in the .code/.text section

I'm attempting to dissect/disassemble a windows PE file under Linux using objdump. On surface analysis, the .code section was disassembled to : tmp.exe: file format pei-i386 Disassembly of ...
ewokx's user avatar
  • 135
1 vote
0 answers
43 views

Capturing created and deleted files from a Java file

I am new to the malware analysis field but I do have an issue, a file I am working on creates 2 vbs files, reads from them and deletes them, this all happens in around 2 seconds. Also this is a Java ...
Tyler Edmonds's user avatar
2 votes
1 answer
668 views

Want to use win API hooking to detect wmi query string? But can't find IWbemServices::ExecQuery in fastprox.dll

I want to implement WMI query detection function using apimon plugin in sandbox https://github.com/tklengyel/drakvuf To do it,I have to get the DLL symbol file. But I can't locate the IWbemServices::...
jacoblin's user avatar
0 votes
1 answer
151 views

Understanding the basics of Reverse Engineering a segment of code

Currently trying to understand the following code and what it is doing. mov eax, 1 test eax, eax jz loc_411503 mov esi, esp call ds:_kbhit cmp esi, esp call sub_411159 test ...
Michael Reyes's user avatar
2 votes
1 answer
261 views

Analyzing a possibly malware sample

I am trying to analyze a possible malicious sample. It's a windows executable e3f04124e2e26f8f030f6845086875a9 Md5sum Intel 386 or later processors and compatible processors File 2464.exe 2464.exe: ...
pensee's user avatar
  • 129
2 votes
0 answers
278 views

Anti-Reversing: Unable to patch memory/set breakpoints of process with x64, unusual memory segment

I'm working on a sample that contains packing and anti-analysis measures. Using ScyllaHide plugin for x64dbg currently with all checks enabled (not sure if this would affect anything, I've tried ...
user3238415's user avatar
2 votes
1 answer
1k views

How to mark data as pointer to external functions in ghidra

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in ...
Petrarch's user avatar
0 votes
0 answers
262 views

new to malware analysis and disassembly. dotpeek has been helpful. is this unreadable code due to SuppressIldasmAttribute?

just getting into rev engineering malware. i want to get to source on my own. i could use run.any or VT but that's no fun. any reason why this is unreadable the way it is? is it due to the module ...
ringXzero's user avatar
0 votes
1 answer
290 views

Is there any way to STOP the loop of the IDApython?

Is there any way to STOP the loop of the IDApython ? I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
rou qwers's user avatar
1 vote
3 answers
2k views

CaptureBAT equivalent on Windows 10?

Hello RE community on stack ! I am a beginner, so please pardon any commonplace errors I am looking to run CaptureBAT on a Windows 10 VM, to capture network activity of different kinds of Malwares I ...
Muhammad Yasir's user avatar
1 vote
0 answers
131 views

Best way from high level software developer to malware analyst

I am a software developer with commercial experience in Python and mainly Scala working on high level programming, e.g. REST APIs, and only personal/university projects experience in C++. I would like ...
Giulia Ippoliti's user avatar
2 votes
1 answer
509 views

The Knowledge of Compiler for becoming a good Reverser

I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
Ramesses II's user avatar
2 votes
1 answer
269 views

Is there an easier way to break on a rootkit driver load, other than disassembling IopLoadDriver?

The only method i know to break on a DriverEntry of a rootkit driver when its loaded is to disassmble nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on ...
Notoriouss's user avatar

1
2 3 4 5
7