Tools

Tools e.g. Wireshark, tshark, Strings, CyberChef

Deobfuscate PowerShell using subtract – CyberChef Recipe 0x4

January 10, 2024

CyberChef, CyberChef Recipe, Infostealer, PowerShell, RedLine

In this quick blog post, we’ll explore the various combination of CyberChef operations e.g Generic code Beautify, Subsection, Fork, Subtract etc. to deobfuscate the second-stage PowerShell script used in the RedLine stealer infection chain. The PowerShell contain multiple array consist of integer. It employs a straightforward function to decode the…

Deobfuscate Script using CyberChef – Recipe 0x3

October 17, 2023

CyberChef, CyberChef Recipe, Infostealer, RedLine, VBScript

In this quick blog post, we’ll explore the various combination of CyberChef operations e.g Subsection, From Base, Fork etc for deobfuscating VBScript used in the RedLine stealer infection chain. VBScript often employs the ‘chr’ function to obfuscate its code, where ‘chr’ converts Ascii codes to characters e.g. Chr(65) will return…

AsyncRAT config decryption using CyberChef – Recipe 0x2

August 7, 2023

.NET, AsyncRAT, Config, CyberChef, CyberChef Recipe, RAT, Remote Access Tool

In the realm of malware analysis, tools like CyberChef play a pivotal role. One of the challenges that malware analysts often face is decrypting configurations of Remote Access Trojans (RATs) like AsyncRAT. This article provides a step-by-step guide on how to decrypt AsyncRAT configurations using CyberChef. Decrypting AsyncRAT ConfigurationsAsyncRAT is…

Converting Integers to Hex with CyberChef – Recipe 0x1

July 14, 2023

.NET, AMSI, AsyncRAT, CyberChef, CyberChef Recipe, RAT

While analyzing malware, it’s common to encounter situations where you need to disassemble code sourced from an integer array. However, when you attempt to use the ‘To Hex’ function in CyberChef, it won’t work. The solution is to employ the ‘To Base’ operation with a radix value of 16. I…

Important Wireshark filters

May 5, 2018

Filter, Video Tutorial, Wireshark

We will look into some of the Wireshark display filters which can be used in malware analysis. We can use this Wireshark display filter after we capture pcap during dynamic malware analysis. Why do we need to do this? Help us to remove the noise from pcap Easy to extract…