The Anti-VM trick that is kinda… personal
I have written a lot about anti-vm tricks, and while this topic is so worn out that almost feels like kicking a dead horse I felt there is still a […]
View ArticleWine tasting, again
In my old post I have listed a number of wine functions that are exported in that environment and are not present in Windows libraries. 5 years later I decided […]
View ArticleYet another secret of hosts file
In my old post I mentioned not a very well known hosts.ics file. Today I cover one more secret that I stumbled upon while digging inside DNS API internals. Turns […]
View ArticleA few more anti-sandbox tricks…
Today I spotted an article comparing various sandboxes being posted on Twitter. I noticed many of sandboxes present on VirusTotal were not covered in that article so I reviewed a […]
View ArticleGenuine Anti-sandbox trick
This a bit unusual trick, because it relies on a test if Windows version that sample is running on is… legitimate/genuine. Yes.. we live in these times. Lots of pirated […]
View ArticleGoing BAT…mode crazy
What will the following bat file print? Foo, or Bar? Here’s the answer: Batch files can be saved as text files using different encodings, including UTF7, and UTF8 as well […]
View ArticlePotential tricks using new(?) APIs
Every once in a while I go on a hunt for new APIs. This is an impossible task, because I often discover APIs that are 10 years old, but I […]
View ArticleAnti- techniques refresh A.D. 2019
The old-school malware used to detects Reverse Engineering tools by looking for artifacts created by this type of software. The most common artifacts include Process Names, DLL Names, mutexes, files, […]
View Article‘Plata o plomo’ code injections/execution tricks
This post is not about a single injection. It is about a class on its own. At the moment I know of only two instances of code injection/execution that fit […]
View ArticleInserting data into other processes’ address space
Code Injection almost always requires some sort of direct inter-process communication to inject the payload. Typically, the injecting process will first plant the shellcode inside other process’...
View ArticleToo much % makes Event Viewer drunk
Update: After I posted it Daniel Bohannon provided a link to his earlier research (March 2018) where he described the very same problem. He has some interesting examples so please […]
View ArticleDon’t stress about a bit of stress testing #2
Yesterday I tested 100K Run keys, today I test 100K Sysmon rules. Sysmon is visibly struggling: The CPU goes high, and the logs are not being added. I let it […]
View ArticleDon’t stress about a bit of stress testing
What if… we added 100K HKCU\…\Run keys to the Registry? What will be the impact on the system? What will be impact on the EDR tools? Sysmon? Windows Event Logs? […]
View ArticleBeyond good ol’ Run key, Part 100
It’s actually 99th, because I forgot one part on the way 🙂 This is one more persistence method based on a built-in set of features. This time the culprit is […]
View ArticleBeyond good ol’ Run key, Part 99
It’s probably not an understatement if I say that for every single DLL that Windows OS ships with, and one that functionality it provides I sort of understand (at least […]
View ArticleBeyond good ol’ Run key, Part 98
Scanning the Windows files for possible persistence mechanisms I came across a few interesting strings inside the Natural Language Development Platform 6 library (NaturalLanguage6.dll):...
View ArticleBeyond good ol’ Run key, Part 97
When I explore new persistence mechanisms, I usually try to focus on a native OS functionality. The main reason for such approach is the omnipresence of these mechanisms – they […]
View ArticleUsing Virtual Machine tools for Guest OS fingerprinting
A popular way of binding samples to a specific machine is by taking a hardware fingerprint of the system, and sending it to the server. The server then encrypts the […]
View ArticleSysmon and an accidental anti-disassembling trick
This is one of these cases where you don’t plan for the outcome, yet you stumble upon something interesting, and then you just… describe it. When you launch IDA and […]
View ArticleTrivial Anti-BlueTeam trick for 32-bit systems
I love evasion tricks of any sort. Sometimes they can be very elaborate, and sometimes… incredibly trivial, almost stupid really. Such is the trick I am describing below. It works […]
View Article
![ONEW – KAKERA -Unmei no Piece- – EP [iTunes Plus M4A]](http://is1-ssl.mzstatic.com/image/thumb/Music221/v4/d0/fb/86/d0fb86a5-ba60-4bea-41fb-7f54c125f518/VEATP-45908.jpg/296x296bb.webp)
/pic9814888.png)
