estrellas @CryptDeriveKey

Reverse engineer mostly interested in SAT/SMT solvers, Program Analysis, and Obfuscation. Views are my own. deobfuscation.club Joined March 2020

Tweets

542
Followers

295
Following

810
Likes

4K

смех @0x6D6172636F

4 weeks ago

Additional info on the Fancy Bear kit being reported on. Cheers to @Laughing_Mantis for writing backdoors so good that APTs plagiarize it. kroll.com/en/publication…

0 11 28 5K 12

estrellas @CryptDeriveKey

a month ago

My latest analysis of #XWORM's new delivery method just got published! You can read it at: kroll.com/en/publication…

0 0 4 125 0

estrellas @CryptDeriveKey

4 months ago

Our ongoing research about a drive-by compromise that affects even pre-installed versions of the application just had its first part released! You can read it at: kroll.com/en/insights/pu…

0 1 7 436 1

Maiden Labs 🧠 @maidenlabsAI

4 months ago

maiden :3

7 17 166 11K 26

Download Image

remy🐀 @_mattata

5 months ago

Graph Theory for Reverse Engineers Or “everything actually is a nail, you just need a bigger hammer” remyhax.xyz/posts/graph-th…

4 54 228 14K 185

CAPE Sandbox exposes an HTTP endpoint (http://localhost:8000/browser_extension) used to log HTTP trafifc. You can detect CAPE by sending a dummy HTTP request to this endpoint and checking the response. You can then craft fake HTTP data and it’ll show up on VirusTotal.

1 6 55 6K 35

Download Image

смех @0x6D6172636F

5 months ago

SE resulting in substantial crypto theft. Initial payload was a very large (700mb+) .msi. Two new samples named, some oleview.exe sideloading fun as well. Little shoutout to @C5pider 's HavocFramework project. kroll.com/en/insights/pu…

1 3 17 1K 3

estrellas @CryptDeriveKey

5 months ago

0 3 11 449 0

Download Image

remy🐀 @_mattata

6 months ago

@0x6D6172636F @CryptDeriveKey

1 5 27 2K 3

Download Image

estrellas @CryptDeriveKey

6 months ago

Spent the last week working on a tool to help the process of manually deobfuscating obfuscator.io's output... github.com/estr3llas/clr-…

2 8 39 2K 16

HSVSphere @HSVSphere

7 months ago

STOP DOING LISP

44 33 656 33K 100

Download Image

spq @spq

7 months ago

Here are the details about the AMD Signature verification vulnerability we worked on, Enjoy! bughunters.google.com/blog/542484235…

2 57 234 23K 82

Matteo Rizzo @_MatteoRizzo

8 months ago

github.com/google/securit… Our newest research project is finally public! We can load malicious microcode on Zen1-Zen4 CPUs!

13 282 818 117K 267

nicolodev @nicolodev

8 months ago

Disassembly algorithms are often a trade-off. My new blog post analyzes linear sweep and recursive traversal, exploring their strengths and weaknesses in a self-built disassemblers. nicolo.dev/en/blog/disass…

3 50 230 22K 176

naci @_nnaci

8 months ago

I discuss the creation of Mergen, VM based obfuscations, and explore how compiler techniques are used for reverse engineering and deobfuscation. nac-l.github.io/2025/01/25/lif…

2 70 275 14K 150

DebugPrivilege @DebugPrivilege

8 months ago

For the hardcore reverse engineers and malware analysts out there, my ex-colleague just dropped a deep dive into 'Scatterbrain,' the obfuscator behind PoisonPlug malware. If you're into long technical breakdowns, this one's worth a read. cloud.google.com/blog/topics/th…

3 77 291 33K 198

Moonlock Lab @moonlock_lab

8 months ago

1/8: Did someone just add #CTF code to the #AMOS stealer?.. After analysis of a yet undetected ‘lobsterstealer’ sample discovered by @suyog41, we found a few noticeable things that differentiate it from regular filegrabbers we’ve seen before.

3 14 46 9K 14

Download Image

Mya Project @mya_project

8 months ago

We are making a new language to write specifications of an ISA called Mya. Based on the Mya specification, we will automatically generate an assembler and disassembler for the ISA. See: github.com/mya-project/my…