datadome-vm-internals

DataDome VM DataDome embeds a custom VM in their bundle to hide what they're actually doing. I got curious and pulled it apart. Sharing it here for anyone who's interested in the same kind of reverse engineering puzzle. DataDome ships a heavily obfuscated JavaScript bundle to your browser. Inside...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

LeetObfuscator

LeetObfuscator root@kitploit: ██╗ ███████╗███████╗████████╗ ██║ ██╔════╝██╔════╝╚══██╔══╝ ██║ █████╗ █████╗ ██║ ██║ ██╔══╝ ██╔══╝ ██║ ███████╗███████╗███████╗ ██║ ╚══════╝╚══════╝╚══════╝ ╚═╝ ██████╗ ██████╗ ███████╗██╗ ██╗███████╗ ██████╗ █████╗ ████████╗ ██████╗ ██████╗...

JObfuscator

JObfuscator — Java 源代码混淆与保护 JObfuscator 是一款面向 Java 编程语言的源代码混淆器。它可以保护您的 Java 源代码和算法免受黑客攻击、破解、逆向工程、反编译以及技术窃取。 JObfuscator 采用多种混淆技术来保护并隐藏您 Java 源代码的真实功能。 它会重命名所有变量和方法，通过使代码流非线性化来混淆代码执行流程，并使用我们尖端的多态字符串加密引擎对所有字符串进行加密。 更多技术细节、下载及文档，请访问： https://www.pelock.com/products/jobfuscator 支持 Windows 和 Linux（需...

AutoIt-Obfuscator

AutoIt Obfuscator — AutoIt 脚本源代码混淆工具 AutoIt Obfuscator 是一种以这种方式修改 AutoIt 脚本源代码的工具，使得对混淆代码的分析变得非常困难。 更多技术细节、下载和文档，请访问： https://www.pelock.com/products/autoit-obfuscator 在线界面： https://www.pelock.com/autoit-obfuscator/ 什么是源代码混淆？ 混淆是将 AutoIt...

XorStringsNET

XorStringsNET Una herramienta para el cifrado simple y rápido de cadenas basado en XOR en binarios .NET XORStrings implementa un cifrado simple basado en XOR, que denomino RXOR. RXOR no solo cifra la cadena, sino que también invierte el orden de sus caracteres. Cada cadena se cifra con una clave...

PT-2024-9958 · Ca · Ca Client Automation

Name of the Vulnerable Software and Affected Versions: CA Client Automation ITCM affected versions not specified Description: The issue is related to insecure privilege management in the CA Client Automation software, which allows non-admin or non-root users to encrypt strings using the CAF CLI a...

GuLoader: The NSIS Vantage Point

GuLoader: The NSIS Vantage Point By Nico Paulo Yturriaga · January 24, 2023 GuLoader is an advanced shellcode downloader infamous for using anti-analysis tricks to evade detection and obstruct reverse engineering. As of this writing, the GuLoader campaign is aggressively ongoing. Trellix’s...

CB Threat Analysis Unit: Technical Analysis of “Crosswalk”

The technical analysis is related to the TAU-TIN for the same malware which can be located in this post. FireEye recently reported on APT41, a Chinese state sponsored espionage group. The group has been documented as targeting healthcare, high-tech, and telecommunications companies for traditiona...

DanaBot Adds Ransomware to its Arsenal

A new sample of the DanaBot trojan spotted in a recent campaign reveals that operators behind the malware have now included a ransomware component into its code, along with new string encryption and communications protocols. The update, wrote Check Point researchers on Thursday, represents a...