ChatCrawlersearch across public Telegram Open the app
R

Reverse Engineering Chat

snapshot for March 2025
‹ March 2025 ›×
31 March 2025
:3
you got the binary and if its java you easily look at it
:
apk are either java or kotlin either way unzip and then dex to jar and then cfr should give the java code
T
tim
Question for malware analysts out there, do you usually detonate the malware in a sandboxed environment to perform some sort of basic dynamic analysis before going through the assembly, ghidra, and Ida? I watched a course suggesting that path, but im more inclined to avoid malware execution before knowing more about It. From beginner point of view Pros Getting good faster info from execution Cons Dunno how good bad guy Is at pwning my setup or escape the sandbox What do you suggest?
.
.J.
timQuestion for malware analysts out there, do you usually detonate the malware in a sandboxed environment to perform some sort of basic dynamic analysis before going through the assembly, ghidra, and Ida? I watched a course suggesting that path, but im more inclined to avoid malware execution before k
Why are you reversing the malware? For most people, most of the time, the answer is "to understand as much as I can with the least amount of effort". So sure, running in a sandbox might give you quick answers that saves hours/days/weeks.
K
K
Well for the first look it seems crypted not obsfucated or there may be an encoding error or lastly there may be an extra bit(s) that spoils the text. >> or << should be tried
Get the hex code of the return paste it here ^^
K
You can easly manupilate the string with this web tool
L
timQuestion for malware analysts out there, do you usually detonate the malware in a sandboxed environment to perform some sort of basic dynamic analysis before going through the assembly, ghidra, and Ida? I watched a course suggesting that path, but im more inclined to avoid malware execution before k
If you're doing it as a hobby, you can use free public sandboxes. That should absolve you from the worry if your infrastructure is getting owned. Chances of that happening are low, especially if you give the VM no outside (nor local) connection. Anyway, context is key. So if you get a totally random sample, you will need to figure out what the context is. A sandbox can easily provide you with sufficient context. With sufficient experience, you can forego the sandbox analysis and dive straight into static analysis, but this can also waste your time to a certain extend. If I load a file directly into Ghidra, I need to wait until its analysed. If the file turns out to be packed, I'd need to run it in a debugger first to dump the payload I'm looking for. Had I done that directly, I'd be ahead of where I am with the static-first approach. I always advise people to throw a sample into a sandbox, just so you have context as to what you are going to be looking at and into. You can also opt to not do it, its up to you. With the outsourcing of files to public sandboxes, you can use sandboxes with limited hardware at home, without the need to maintain a sandbox set-up, and without a worry in the world. Granted, your file is public, but if you are looking at a file which is public anyway, there's nothing lost. Hope my two cents help
Libra
KIn my opinion, if an admin asks for the future of the group with a poll and pins it , at least 200 votes should be used as there is about 400 online ppl. But very huge part of this group just “watches”. Not participating in any means. If they are like “ghosts” then why are they in?
The total number of people in the group is not a metric we look to in- or decrease as a metric in and on itself. About 1% from a community tends to be active within said community. The activity of this group tends to increase during univeristy holidays, and it dwindles in-between those holidays. There are professionals, hobbyists, and anything in-between in this group. As to why people lurk: I lurk in quite some groups as well, its a way to get passive knowledge of the topic by just reading a bit every so often. I'd like to foster an environment where people can learn something and help others, I am not interested in increasing or decreasing the number of people in the group
L
LibraIf you're doing it as a hobby, you can use free public sandboxes. That should absolve you from the worry if your infrastructure is getting owned. Chances of that happening are low, especially if you give the VM no outside (nor local) connection. Anyway, context is key. So if you get a totally rando
To add to this @TimDelahunt: context can also be coming by the person who shares the sample with you: we found this file which we believe is the ransomware, left on an encrypted system or along those lines. You just need to know what you can expect before you dive in, how you know is irrelevant (though, if you can just vibe it, you solved the billion security industry)
L
Libra
timMany thanks yes to both. For what I get from your response time is crucial. Thus the idea is to expand knowledge about the sample as possible without following rigid scheme.
Yes, time is always the pressing matter. If your employer wants you to look into something, then its better to be done yesterday than tomorrow, assuming you do not lose accuracy in your analysis by shortening the time. On a personal basis, you probably prefer to learn more in a shorter amount of time, so you'd like to be done quicker
T
tim
MarcФайл
For example I was approaching this trying to unpack the payload as you said before. Long run. But probably would have been better testing the binary in a sandbox first. Looking for some ioc indicating the discord token exfiltration suspect. E.g. some network request, access to browser cached data etc. Many many thanks helpful advices
L
Libra
timFor example I was approaching this trying to unpack the payload as you said before. Long run. But probably would have been better testing the binary in a sandbox first. Looking for some ioc indicating the discord token exfiltration suspect. E.g. some network request, access to browser cached data et
Yes, then based on the context (i.e. network requests) you can set breakpoints and let the debugger run until they are hit. If they aren't hit, you need to find out why (other functions are called instead? Debugger detection? Etc)
Open in Telegram Каталог площадок Искать в ChatCrawler

A snapshot of an open public feed from the search index ChatCrawler — “Google for public Telegram”; refreshed as the venue is crawled. Times are UTC.

Public content only, official Telegram API. About · FAQ · What we do not do · Remove a page · Catalog