estrellas @CryptDeriveKey

Reverse engineer mostly interested in SAT/SMT solvers, Program Analysis, and Obfuscation. Views are my own. estr3llas.github.io Joined March 2020

Tweets

541
Followers

292
Following

808
Likes

4K

смех @0x6D6172636F

3 days ago

Additional info on the Fancy Bear kit being reported on. Cheers to @Laughing_Mantis for writing backdoors so good that APTs plagiarize it. kroll.com/en/publication…

0 11 24 4K 11

estrellas @CryptDeriveKey

2 weeks ago

My latest analysis of #XWORM's new delivery method just got published! You can read it at: kroll.com/en/publication…

0 0 4 101 0

estrellas @CryptDeriveKey

4 months ago

Our ongoing research about a drive-by compromise that affects even pre-installed versions of the application just had its first part released! You can read it at: kroll.com/en/insights/pu…

0 2 7 423 1

Maiden Labs 🧠 @maidenlabsAI

4 months ago

maiden :3

7 17 167 11K 26

Download Image

remy🐀 @_mattata

4 months ago

Graph Theory for Reverse Engineers Or “everything actually is a nail, you just need a bigger hammer” remyhax.xyz/posts/graph-th…

4 54 228 14K 183

CAPE Sandbox exposes an HTTP endpoint (http://localhost:8000/browser_extension) used to log HTTP trafifc. You can detect CAPE by sending a dummy HTTP request to this endpoint and checking the response. You can then craft fake HTTP data and it’ll show up on VirusTotal.

1 6 55 6K 35

Download Image

смех @0x6D6172636F

4 months ago

SE resulting in substantial crypto theft. Initial payload was a very large (700mb+) .msi. Two new samples named, some oleview.exe sideloading fun as well. Little shoutout to @C5pider 's HavocFramework project. kroll.com/en/insights/pu…

1 3 17 1K 3

estrellas @CryptDeriveKey

4 months ago

0 3 11 447 0

Download Image

remy🐀 @_mattata

5 months ago

@0x6D6172636F @CryptDeriveKey

1 5 27 2K 3

Download Image

estrellas @CryptDeriveKey

5 months ago

Spent the last week working on a tool to help the process of manually deobfuscating obfuscator.io's output... github.com/estr3llas/clr-…

2 8 39 2K 16

HSVSphere @HSVSphere

6 months ago

STOP DOING LISP

44 33 657 33K 99

Download Image

spq @spq

6 months ago

Here are the details about the AMD Signature verification vulnerability we worked on, Enjoy! bughunters.google.com/blog/542484235…

2 56 232 23K 83

Matteo Rizzo @_MatteoRizzo

7 months ago

github.com/google/securit… Our newest research project is finally public! We can load malicious microcode on Zen1-Zen4 CPUs!

13 284 820 116K 268

nicolodev @nicolodev

7 months ago

Disassembly algorithms are often a trade-off. My new blog post analyzes linear sweep and recursive traversal, exploring their strengths and weaknesses in a self-built disassemblers. nicolo.dev/en/blog/disass…

3 50 230 22K 177

naci @_nnaci

7 months ago

I discuss the creation of Mergen, VM based obfuscations, and explore how compiler techniques are used for reverse engineering and deobfuscation. nac-l.github.io/2025/01/25/lif…

2 70 276 14K 150

DebugPrivilege @DebugPrivilege

7 months ago

For the hardcore reverse engineers and malware analysts out there, my ex-colleague just dropped a deep dive into 'Scatterbrain,' the obfuscator behind PoisonPlug malware. If you're into long technical breakdowns, this one's worth a read. cloud.google.com/blog/topics/th…

3 77 291 33K 200

Moonlock Lab @moonlock_lab

7 months ago

1/8: Did someone just add #CTF code to the #AMOS stealer?.. After analysis of a yet undetected ‘lobsterstealer’ sample discovered by @suyog41, we found a few noticeable things that differentiate it from regular filegrabbers we’ve seen before.

3 14 46 9K 14

Download Image

Mya Project @mya_project

8 months ago

We are making a new language to write specifications of an ISA called Mya. Based on the Mya specification, we will automatically generate an assembler and disassembler for the ISA. See: github.com/mya-project/my…