Post

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @embee_research

Matthew

@embee_research

May 28

Three Simple Methods For Analysing Malicious Documents

A quick overview of olevba, Microsoft Word, and Procmon for analysing malware documents and extracting embedded macro content.

[1/10] 🧵

#malware #maldocs

2/ You first need to obtain a maldoc.

For this analysis we'll be using a malicious document related to #MuddyWater. Which was initially shared in a post by @suyog41.

bazaar.abuse.ch/sample/d2809e3…

3/ Obtaining Macros With Olevba

The most simple method for maldoc analysis is to use the olevba tool provided with FlareVM.

This tool will automatically extract macro content and highlight any relevant IOC's. All in one short and simple command.

github.com/decalage2/olet…

Read 9 tweets

Matthew

@embee_research

May 21

🚩Malware Analysis - Decoding a Latrodectus Loader Script

➡️Let's look at a recent Latrodectus loader that uses junk comments to confuse analysis and hide malicious code.

[1/11] 🧵
#malware #cyberchef

2/ Obtaining The Sample

The initial script can be found on Malware Bazaar with SHA256: 71fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9

3/ Opening the script in a text editor reveals a large number of junk comments.

In-between comments, are occasional lines of "real" code which make up the malware functionality.

Your first step is to remove the junk comments so that you can focus on the "real" code.

Read 11 tweets

Matthew

@embee_research

Mar 24

Malware Deobfuscation With DnSpy and CyberChef 👨‍🍳

Let's look at some beginner tips for identifying encrypted data with DnSpy.

We'll then utilise CyberChef to recreate the decryption and obtain the address of the C2 server.

[1/12] 🧵

#malware #cyberchef

[2/] Finding encrypted strings

Config values are often initialised (and decrypted) early in execution. Hence the Entry Point is a great place to begin looking.

(In Dnspy, we can select a loaded file and use "Go To Entry Point")

3/ Identifying Config Values

After locating the entry point, we can begin looking for signs of encrypted or obfuscated values.

The first method "Run" contains suspicious references to “”, as well as Arguments.IP and Arguments.Key StringDecrypt.Read

Read 13 tweets

Matthew

@embee_research

Jan 2

🔥Lumma Stealer - Manually Unpacking and Extracting C2's 🔥

Let's analyse a Lumma malware sample and manually unpack it with Dnspy and x32dbg.

We'll then leverage Ghidra and x32dbg to locate and decrypt four C2 addresses.

[1/24] 🖊️

#Malwareanalysis #Ghidra

1/ The initial sample can be found on Malware Bazaar

You can download it here if you'd like to follow along

bazaar.abuse.ch/sample/0ee580f…

2/ Checking What Were Up Against

Prior to manual analysis, we can submit the hash on @unpacme. This gives us an idea of how many "layers" of packing are present.

The initial sample is .NET based, but the payload is not. (This means we'll need both Dnspy and #Ghidra)

Read 25 tweets

Matthew

@embee_research

Dec 30, 2023

How to Increase Your Engagement on Cyber-related Twitter Content ✏️

Tips and tricks learnt from writing about #malware on Twitter for 18 months😄

[1/9]

1/ Optimal Post Structure

Statement -> Explanation -> Conclusion

I've found this general flow is the easiest to create and for readers to follow. It follows the 1-2-1 structure by @Nicolascole77

If you don't yet have a post style/structure, this is a great place to start.

2/ Aim for Reposts Over Followers

The highest engagement posts are those that get reshared by large accounts.

You don't need a lot of followers for high engagement, as long as you can get reposted by someone who does.

Read 10 tweets

Matthew

@embee_research

Dec 21, 2023

🔬Defeating Obfuscated .HTA Scripts to Obtain Cobalt Strike Shellcode 🔬

Let's look at Cyberchef, Manual Deobfuscation, Multi-stage script analysis and finally emulation to obtain a decoded C2.

[1/17]

2/ The analysis begins with obfuscated .hta script obtained from Malware Bazaar.

You can obtain the file here if you want to follow along.

bazaar.abuse.ch/sample/2c683d1…

3/ Initial Script Review.

The initial script contains multiple obfuscated strings, a partial powershell command, and a large blob of base64 text.

Read 17 tweets

Share this page!

Enter URL or ID to Unroll

Matthew

Try unrolling a thread yourself!

More from @embee_research

Matthew

Matthew

Matthew

Matthew

Matthew

Matthew

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Send Email!