pridelocker-analysis

PrideLocker ESX encryptor analysis This repository contains resources related to the analysis made on PrideLocker and available on this blog post: https://www.synacktiv.com/publications/pridelocker-a-new-fork-of-babuk-esx-encryptor.html. an IDA Python script to deobfuscate strings embedded in the...

Sojobo

Sojobo - A binary analysis framework Sojobo is an emulator for the B2R2 framework. It was created to easier the analysis of potentially malicious files. It is totally developed in .NET so you don't need to install or compile any other external libraries the project is self contained. With Sojobo...

FLOSS - FireEye Labs Obfuscated String Solver (Automatically extract obfuscated strings from malware)

Rather than heavily protecting backdoors with hardcore packers, many malware authors evade heuristic detections by obfuscating only key portions of an executable. Often, these portions are strings and resources used to configure domains, files, and other artifacts of an infection. These key...