Malware analysis series by John Hammond

John Hammond, a YouTuber and Cybersecurity researcher, has a series on Youtube where he analyses malware artifacts and discerns their purpose and method of attack. For most of these, he gets access to known malware files, and then blindly goes through them, de-obfuscating and cleaning them up, in order to present a readable version that can be analyzed. I personally find these videos very exciting and entertaining, as well as incredibly educating. He also has several other series and interesting videos on his channel that I highly recommend for anyone interested in software security and other general security topics.

Link: https://www.youtube.com/watch?v=MJBKxs8UnFE

Comments

Using PGPy to encrypt and decrypt files and messages

PGPy is a library for python that enables the creation, storage, and encryption/decryption of PGP keys and files in python. Recently, in a small project to reacquaint myself with python, I used PGPy for key generation and encryption and decryption. That project can be found in my github at https://github.com/lpowell . The goal of the project was to use command-line switches to control the program, and to provide basic encryption and decryption capabilities, along with rot13 and base64 encoding. First, to load in a key use key, _ = pgpy.PGPKey.from_file(keyfilename) . This loads the key from either a binary or ASCII armored file. You can swap out .from_file for .from_blob , if you plan on using a key stored in a string or bytes object rather than a file. In my example code, I pull the key from a file, as I found it to be the simpler method. Next, you'll need to open a file or create a string or bytes object that contains the message you wish to encrypt. We'll cal...

Huntress CTF Challenge Writeups: HumanTwo: MoveIt IoC Analysis Challenge

HumanTwo: MoveIT IoC Analysis Challenge The HumanTwo challenge is a malware CTF from the 2023 Huntress CTF. This write-up walks through the initial discovery, de-obfuscation, and solving of the challenge. The actual flag will be redacted from the document, but interested parties should be able to follow the steps and derive it themselves. While the write-up assumes a base level of knowledge regarding the command line and Linux. Most tools and commands will be accompanied by short explanations. Step 1: Initial Analysis To start off, we are given an archive with 1000 files named after their file hash. The hint we are given is that there are minor differences between each file. We also know that HumanTwo relates to the MoveIT vulnerability and exploit. The easy way to progress is to look up articles that tell you about the vulnerability and what stands out in each exploit script. However, I didn’t do that, so I’ll put the process I followed down instead. First, because I knew that...

Huntress CTF Challenge Writeups: Snake Eater: A Malware Analysis Challenge

Snake Eater: A Malware Analysis Challenge Snake Eater provided an executable file with the comment “I’ve never seen an executable file that looks like this. Can you check it out and see what it’s doing”. The comment is the hint to finding the flag. This challenge requires a Virtual Machine, as the executable is based on live malware and Defender may delete it or prevent it from running. First, we’ll need to get our hands on Sysinternals tools. These can be downloaded from Microsoft. After getting all of the Sysinternals tools, we need to go back to our hint. The line “Can you check it out and see what it’s doing” is a hint that we need to run the malware and see what changes it’s enacting on the system. One way to do this is to use Process Monitor from Sysinternals. We can run the Process Monitor executable and start capturing with no filters enabled. Then, we can execute the snake_eater.exe file and wait for it to close. After it closes, we can stop the Process Monitor c...

Blog.Bajiri

Search This Blog