Content Paint
Embee Research

Malware Analysis

How To Use Ghidra For Malware Analysis - Establishing Context on Imported Functions
How To Use Ghidra For Malware Analysis - Establishing Context on Imported Functions

Leveraging Ghidra to establish context and intent behind imported functions.

Ghidra For Malware Analysis - Pivoting from String Cross References
Ghidra For Malware Analysis - Pivoting from String Cross References

Leveraging Ghidra to establish context and intent behind suspicious strings.

Beginner Ghidra Guide - Manual Shellcode Decryption
Beginner Ghidra Guide - Manual Shellcode Decryption

Manually Reversing a decryption function using Ghidra, ChatGPT and CyberChef.

How To Use Garbageman To Extract C2's From Dotnet Malware
How To Use Garbageman To Extract C2's From Dotnet Malware

Extracting C2 configuration using the Garbageman .NET analysis tool

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader
Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

Unpacking a simple Cobalt Strike loader using Debuggers and Hardware breakpoints.

Malware Unpacking With Memory Dumps - Intermediate Methods (Pe-Sieve, Process Hacker, Hxd and Pe-bear)
Malware Unpacking With Memory Dumps - Intermediate Methods (Pe-Sieve, Process Hacker, Hxd and Pe-bear)

Demonstrating three additional methods for obtaining unpacked malware samples. Using Process Hacker, Pe-sieve, Hxd and Pe-bear.

Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Great! You've successfully signed up.
Great! You've successfully signed up.
Welcome back! You've successfully signed in.
Success! You now have access to additional content.