VMDragonSlayer

VMDragonSlayer Проект будет опубликован к середине октября. Рефакторинг в процессе. Продвинутая платформа для обнаружения и анализа виртуальных машин VMDragonSlayer — это комплексная платформа для анализа бинарных файлов, защищённых протекторами на основе виртуальных машин VM, такими как VMProtec...

vmpdump

VMPDump Un dumper VMP dynamique et réparateur d'importations, propulsé par VTIL. Fonctionne pour VMProtect 3.X x64. Avant vs Après Utilisation VMPDump.exe "" -ep= -disable-reloc Arguments : : L'ID du processus cible, sous forme décimale ou hexadécimale. : Le nom du module qui doit être dumpé et...

VMProtect-devirtualization

Виртуализация VMProtect Экспериментальный динамический подход к девиртуализации чистых функций, защищённых VMProtect 3.x TL;DR Введение Подход Пример 1: Простая битовая операция под защитой Пример 2: MBA-операция под защитой Пример 3: Более одного базового блока Заключение и ограничения Ссылки...

vmprotect-research

VMP 디버추얼라이저 - 프로덕션 릴리스 VMProtect 1.x, 2.x, 3.x 버전을 지원하는 범용 디버추얼라이저. 독립형 CLI 도구 + Ghidra 플러그인. 상태: ✅ 프로덕션 준비 | 검증: 22/22 샘플 100% | 범위: VMP ≤3.6 3.7+는 리버스 엔지니어링 필요 특징 멀티 버전 지원: VMP 1.x, 2.x, 3.x 1.1 → 3.10.5 버전 탐지: 휴리스틱을 통한 자동 식별 디스패치 테이블 추출: 암호화된 테이블을 위한 Unicorn XOR 키 캡처 핸들러 분류: 모든 버전에 걸친 256개 핸들러...

0xGUARD

📄 Возможности Переназначение модулей Фильтрация потоков Скрытие модулей Проверка памяти Проверка целостности Анти-инъекция DLL Анти-отладка Политика процессов Обфускация строковых литералов Совместимость с Themida/VMProtect ✔️ Зависимости Windows 711 Visual Studio 2019 🔧 Как использовать 1. Задайт...

VMUnprotect.Dumper

VMUnprotect.Dumper VMUnprotect.Dumper — это проект, занимающийся поиском модифицированных сборок VMProtect. Он использует AsmResolver для динамической распаковки сборок, защищённых VMP. Работает с VMProtect 3.7.0 последней версией и несколькими более ранними версиями. До использования...

unicorn_pe

Unicorn PE Unicorn PE — это проект/фреймворк для инструментирования на основе unicorn, предназначенный для эмуляции выполнения кода PE-файлов Windows, особенно упакованных. Этот проект заархивирован и больше не поддерживается. В качестве преемника рекомендуется sogen. Возможности Дамп PE-образа и...

vmp2

Introduzione Questo repository è una raccolta di strumenti legacy per lavorare con binari protetti da VMProtect 2. Questi strumenti consentono l'unpacking, l'analisi e la devirtualizzazione sperimentale di software protetti con VMProtect 2. Al centro di questa raccolta c'è vmprofiler , una librer...

Old certificate, new signature: Open-source tools forge signature timestamps on Windows drivers

Cisco Talos has observed threat actors taking advantage of a Windows policy loophole that allows the signing and loading of cross-signed kernel mode drivers with signature timestamp prior to July 29, 2015. Actors are leveraging multiple open-source tools that alter the signing date of kernel mode...

WINTAPIX Kernel Driver Targeting Middle Eastern Nations

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The WINTAPIX driver, protected by VMProtect, targets Saudi Arabia and other Gulf countries, possibly linked to Iranian threat actors exploiting Exchange servers for malware deployment. To receive real-ti...

APT15 enhanced its arsenal with an updated variant of the Turian backdoor

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary APT15 has modified its toolkit to include new variants of the Turian backdoor, as well as new command and control infrastructure. The malware contains VMProtect, which obfuscates all API calls within the...

RangnarLocker Ransomware hits Critical Infrastructure Compromising 50+ Organizations

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here The Federal Bureau of Investigation FBI has released an alert on Ragnarlocker campaign that has affected nearly 52 organizations encompassing 10 critical infrastructure sectors, including entities in significant manufacturing,...

Metamorfo Returns with Keylogger Trick to Target Financial Firms

Researchers have discovered a recent spate of phishing emails spreading a new variant of Metamorfo, a financial malware known for targeting Brazilian companies. Now, however, it’s expanding its geographic range and adding a new technique. Metamorfo was first discovered in April 2018, in various...

Adobe Flash Zero-Day Leveraged Via Office Docs in Campaign

An Adobe Flash Player zero-day exploit has been spotted in the wild as part of a widespread campaign, researchers said on Wednesday. Adobe has just issued a patch for the previously unknown critical flaw. The vulnerability, CVE-2018-15982, is a use-after-free flaw enabling arbitrary code executio...

Analyzing malware by API calls

Over the last quarter, we've seen an increase in malware using packers, crypters, and protectors—all methods used to obfuscate malicious code from systems or programs attempting to identify it. These packers make it very hard, or next to impossible to perform static analysis. The growing number o...

Threat Actors Target Chinese Language News Sites

A California-based news website covering China, called China Digital Times, was targeted in a spying campaign that involved phishing lures and the use of the NetWire remote access Trojan. The attacks began in February 2017 and were part of a wider campaign of phishing, reconnaissance and malware...

Any combination of instructions to achieve free kill-vulnerability warning-the black bar safety net

Note:writing flower instructions,refer to the following pairs of instructions,can be arbitrary free combination. Free to killeffect. push ebp pop ebp push eax pop eax push esp pop esp push 0 push 0 push 1 0 -------which numbers can be arbitrary,note the following correspondence push -10...

PcShare full free kill processing ideas-vulnerability warning-the black bar safety net

PcShare fullfree killprocessing ideas Pcshare software package within update 1 3 files 8 of which have the color of the icon is the function of the plug-in generally combined with good shell Beidou 2. 6 like a good Shell you can. 关键 处理 PcClient.dll PcInit.exe PcHide. sys three files. These days 0...