Reverse Engineering

Demonstrating three additional methods for obtaining unpacked malware samples. Using Process Hacker, Pe-sieve, Hxd and Pe-bear.

Unpacking an Asyncrat loader using Process Hacker and Dnspy

Decoding a Remcos Loader, leveraging regex, python and Cyberchef to identify IOCs.

Improving Malware Analysis Workflows by Modifying the default Ghidra UI.

Manually decoding a Cobalt Strike .vbs Loader utilising advanced CyberChef and Shellcode Emulation.

Decoding a .hta script with CyberChef and analysing Shellcode with the SpeakEasy Emulator.

Using Ghidra Entropy Analysis to Identify a decryption function.

Demonstrating basic techniques for decoding a darkgate .vbs loader.

Introduction to dotnet configuration extraction. Leveraging RevengeRat and Python.