Matthew (@embee_research) / X

Matthew

1,160 posts

Matthew

@embee_research

Security Researcher, Creating and Sharing Educational Content.

Australia

Joined July 2022

Pinned
Matthew
@embee_research
Feb 10, 2024
A Beginners Guide to Tracking Malware Infrastructure New post with 11 Examples (Including Cobalt Strike and Qakbot) that you can use to query and track C2’s, Open Directories and More🔥 (Special thanks to @censysio 🥳) censys.com/a-beginners-gu… #threatintel #malware
A Beginner's Guide to Tracking Malware Infrastructure - Censys
From censys.com
75K
Matthew
@embee_research
Oct 18, 2022
🐲 Ghidra Tips🐲For Beginner/Intermediate analysts interested in RE. These tips are aimed at making Ghidra more approachable and usable for beginners and intermediate analysts 😄 [1/9] 🧵 #Malware #RE #Ghidra
Matthew
@embee_research
Sep 11, 2022
Reverse Engineering a #CobaltStrike #malware sample and extracting C2's using three different methods. We'll touch on #cyberchef, #x64dbg and Speakeasy from fireeye to perform manual analysis and emulation of #shellcode. A (big) thread ⬇️⬇️ [1/23]
Matthew
@embee_research
Jan 3, 2023
Setting up an analysis VM for reverse engineering? Here are a few good tools (with short demos) that I recommend after running the Mandiant/FLARE script, (which installs 99% of tooling for you) 🔥 TLDR: Garbageman, SpeakEasy, BlobRunner, Dumpulator #Malware #RE #Analysis
81K
Matthew
@embee_research
Nov 14, 2022
🐲 Ghidra Tips 🐲- Malware Encryption and Hashing functions often produce byte sequences that are great for #Yara rules. Using #Ghidra and a Text Editor - You can quickly develop Yara rules to detect common malware families. (Demonstrated with #Qakbot) [1/20] #Malware #RE
Matthew
@embee_research
Jan 16, 2023
Malware Analysis Tip - Use Process Hacker to watch for suspicious .NET assemblies in newly spawned processes. Combined with DnSpy - it's possible to locate and extract malicious payloads without needing to manually de-obfuscate. 1/ #Malware #dnspy #analysis #RE
81K
Matthew
@embee_research
Mar 2, 2023
#Malware Downloader retrieving an encoded powershell via DNS records. + Quick demo on how to deal with this and extract the final content using #CyberChef 👇👇
77K
Matthew
@embee_research
Mar 22, 2023
🐀 AsyncRAT 🐀 - Defeating Obfuscation Using CyberChef An overview of some advanced CyberChef tricks for decoding malware [1/12] 🧵 #AsyncRAT #Decoding #CyberChef #Malware
69K
Matthew
@embee_research
Jun 28, 2023
A collection of incredible (non-corporate) malware analysis and reverse engineering blogs that I have personally enjoyed over the years. All focused on education and knowledge sharing of malware/RE topics. [1/14] 🧵 (In no particular order) #malware #education
84K
Matthew
@embee_research
Jul 14, 2022
When analysing suspicious commands using #cyberchef, you can utilise #regex to save time copy and pasting between windows. In this case, combining "From Decimal" with the regex "(\d\d+)+" enabled a quick decoding without needing to change tabs.
Matthew
@embee_research
Dec 20, 2023
🥷Defeating Obfuscated Malware 🥷 Today we take a look at a heavily obfuscated visual basic script containing Shellcode. We'll use Regex, #Cyberchef and a Text Editor to deobfuscate #malware. [1/18]
50K
Matthew
@embee_research
Dec 21, 2023
🔬Defeating Obfuscated .HTA Scripts to Obtain Cobalt Strike Shellcode 🔬 Let's look at Cyberchef, Manual Deobfuscation, Multi-stage script analysis and finally emulation to obtain a decoded C2. [1/17]
44K
Matthew
@embee_research
Mar 24, 2024
Malware Deobfuscation With DnSpy and CyberChef 👨‍🍳 Let's look at some beginner tips for identifying encrypted data with DnSpy. We'll then utilise CyberChef to recreate the decryption and obtain the address of the C2 server. [1/12] 🧵 #malware #cyberchef
37K
Matthew
@embee_research
Feb 8, 2024
Decoding a Cobalt Strike Loader with Cyberchef and Emulation A short video looking into a common CS loader and methods for extracting C2 addresses from Shellcode 😁 youtu.be/YDtLmhw_nTo?fe… #Malwareanalysis #Cobaltstrike
29K