Reverse engineering, vulnerability research, and malware analysis write-ups.
Cybercriminals continue to employ sophisticated tactics intended to evade traditional Endpoint Detection and Response (EDR), while maintaining a low profile and limiting the noise created by these activities. A recent…
I performed root cause analysis for a vulnerability found in Okta Verify for Windows in versions prior to 4.10.7 and thought I would share some of the details.
I recently completed an iOS mobile application capture the flag challenge created by Corellium and I wanted to briefly share my analysis and thoughts on it.
Oftentimes I am asked how I got into reverse engineering and the steps one should take to do the same. I wanted to take some time to create a resource that will serve as guidance for entering the world of software…
In this blog post, I’m going to show you how I used the CVE-2023–36802 vulnerability in MSSKSRV.sys to elevate privileges on a Windows 11 system. I wrote my own proof-of-concept, taking inspiration from @benoitsevens of…
In Part III we learned how to use x32dbg and performed code analysis on our malicious specimen which uncovered several indicators of compromise. We discovered the purpose of multiple undocumented functions and labeled…
In Part II we concluded our static analysis by becoming familiar with IDA Pro and using it to confirm one of our previous findings and to examine obfuscated strings on the stack. In this article, we will be conducting…
In Part I we conducted static analysis using basic tools and techniques on a malicious Windows portable executable and came up with several findings. In this article, we will continue our analysis using IDA Pro to see…
In this article I will be examining a Windows executable malware specimen. Based on a couple reports from automated malware sandboxes, the specimen drops multiple files to disk and calls out to multiple domains and IP…