7 posts · filtered by *
Walking one Silver Fox sample from MalwareBazaar through every stage. Encrypted SFX, two signed-binary sideload hops, an 111 MB Rust loader with obfstr-style string XOR, a hardware-breakpoint VEH that finds 0F 05 opcodes for direct syscalls, and a custom-base64 carrier disguised as a Windows MUI.
Event ID 1102 catches the loud version of attacker log tampering. Selective deletion of individual records inside an EVTX, the technique DanderSpritz's eventlogedit module made famous, doesn't fire it. Walking through the gap, who exploits it, and the analyse gaps subcommand landing in Chainsaw.
Walking one MalwareBazaar Lumma sample from password-protected zip to a deployable IOC list. Static-only path: 9 hardcoded .shop C2s, the Lumma 4.0 protocol surface, the Chrome 127 App-Bound Encryption bypass, and a YARA rule for the build family.
Hunting fileless WMI persistence on a dead-disk Windows 11 image. From ASEP-sweep through XOR'd C2 to the flag.
A one-click NTLM coercion in the Windows Snipping Tool. The ms-screensketch URI handler accepts an unvalidated UNC path in filePath and opens it directly, leaking the user's Net-NTLMv2 response to any reachable SMB server. Walkthrough, working PoC, and detection.
A persistence technique that loads keys into HKCU without ever calling a registry API. How the mechanism works, why it's a blind spot for callback-based EDR, and what to actually hunt for.