VMUnprotect.Dumper

VMUnprotect.Dumper VMUnprotect.Dumper é um projeto dedicado a caçar assemblies VMProtect adulterados. Ele utiliza AsmResolver para descompactar dinamicamente assemblies protegidos por VMP. Funciona no VMProtect 3.7.0 mais recente e algumas versões anteriores. Antes do uso do VMUnprotect.Dumper Ap...

VMDragonSlayer

VMDragonSlayer Das Projekt wird Mitte Oktober veröffentlicht. Refactoring läuft. Fortschrittliches Framework zur Erkennung und Analyse von Virtuellen Maschinen VMDragonSlayer ist ein umfassendes Framework zur Analyse von Binärdateien, die durch VM-basierte Schutzhüllen wie VMProtect 2.x/3.x,...

vmpdump

VMPDump Ein dynamischer VMP-Dumper und Import-Fixer, angetrieben von VTIL. Funktioniert für VMProtect 3.X x64. Vorher vs Nachher Verwendung VMPDump.exe "" -ep= -disable-reloc Argumente: : Die ID des Zielprozesses, in dezimaler oder hexadezimaler Form. : Der Name des Moduls, das gedumpt und gefixt...

VMProtect-devirtualization

Desvirtualização do VMProtect Uma abordagem dinâmica experimental para desvirtualizar funções puras protegidas por VMProtect 3.x Resumo Introdução A abordagem Exemplo 1: Uma operação bitwise simples protegida Exemplo 2: Uma operação MBA protegida Exemplo 3: Mais de um bloco básico Conclusão e...

vmprotect-research

VMP डिवर्चुअलाइज़र - उत्पादन रिलीज़ सामान्यीकृत VMProtect डिवर्चुअलाइज़र जो संस्करण 1.x, 2.x और 3.x का समर्थन करता है। स्वतंत्र CLI टूल + Ghidra प्लगइन। स्थिति: ✅ उत्पादन के लिए तैयार | सत्यापन: 22/22 नमूने 100% | दायरा: VMP ≤3.6 3.7+ के लिए रिवर्स इंजीनियरिंग आवश्यक विशेषताएँ बहु-संस्करण समर्थन:...

vmp2

परिचय यह रिपॉज़िटरी VMProtect 2 -संरक्षित बाइनरी के साथ काम करने के लिए विरासती legacy टूलों का संग्रह है। ये टूल VMProtect 2 से संरक्षित सॉफ़्टवेयर को अनपैक करने, विश्लेषण करने और प्रयोगात्मक डीवर्चुअलाइज़ेशन devirtualization को सक्षम बनाते हैं। इस संग्रह के मूल में vmprofiler है, एक उपयोगिता...

0xGUARD

📄 Recursos Remapeamento de módulo Filtragem de threads Ocultação de módulo Verificação de memória Verificação de integridade Anti-injeção de DLL Anti-debugging Política de processo Ofuscação de strings literais Compatibilidade com Themida/VMProtect ✔️ Dependências Windows 711 Visual Studio 2019 🔧...

Old certificate, new signature: Open-source tools forge signature timestamps on Windows drivers

Cisco Talos has observed threat actors taking advantage of a Windows policy loophole that allows the signing and loading of cross-signed kernel mode drivers with signature timestamp prior to July 29, 2015. Actors are leveraging multiple open-source tools that alter the signing date of kernel mode...

WINTAPIX Kernel Driver Targeting Middle Eastern Nations

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The WINTAPIX driver, protected by VMProtect, targets Saudi Arabia and other Gulf countries, possibly linked to Iranian threat actors exploiting Exchange servers for malware deployment. To receive real-ti...

APT15 enhanced its arsenal with an updated variant of the Turian backdoor

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary APT15 has modified its toolkit to include new variants of the Turian backdoor, as well as new command and control infrastructure. The malware contains VMProtect, which obfuscates all API calls within the...

RangnarLocker Ransomware hits Critical Infrastructure Compromising 50+ Organizations

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Federal Bureau of Investigation FBI has released an alert on Ragnarlocker campaign that has affected nearly 52 organizations encompassing 10 critical infrastructure sectors, including entities in significant manufacturing,...

Metamorfo Returns with Keylogger Trick to Target Financial Firms

Researchers have discovered a recent spate of phishing emails spreading a new variant of Metamorfo, a financial malware known for targeting Brazilian companies. Now, however, it’s expanding its geographic range and adding a new technique. Metamorfo was first discovered in April 2018, in various...

Adobe Flash Zero-Day Leveraged Via Office Docs in Campaign

An Adobe Flash Player zero-day exploit has been spotted in the wild as part of a widespread campaign, researchers said on Wednesday. Adobe has just issued a patch for the previously unknown critical flaw. The vulnerability, CVE-2018-15982, is a use-after-free flaw enabling arbitrary code executio...

Analyzing malware by API calls

Over the last quarter, we've seen an increase in malware using packers, crypters, and protectors—all methods used to obfuscate malicious code from systems or programs attempting to identify it. These packers make it very hard, or next to impossible to perform static analysis. The growing number o...

Threat Actors Target Chinese Language News Sites

A California-based news website covering China, called China Digital Times, was targeted in a spying campaign that involved phishing lures and the use of the NetWire remote access Trojan. The attacks began in February 2017 and were part of a wider campaign of phishing, reconnaissance and malware...

Any combination of instructions to achieve free kill-vulnerability warning-the black bar safety net

Note:writing flower instructions,refer to the following pairs of instructions,can be arbitrary free combination. Free to killeffect. push ebp pop ebp push eax pop eax push esp pop esp push 0 push 0 push 1 0 -------which numbers can be arbitrary,note the following correspondence push -10...

PcShare full free kill processing ideas-vulnerability warning-the black bar safety net

PcShare fullfree killprocessing ideas Pcshare software package within update 1 3 files 8 of which have the color of the icon is the function of the plug-in generally combined with good shell Beidou 2. 6 like a good Shell you can. 关键 处理 PcClient.dll PcInit.exe PcHide. sys three files. These days 0...