Sign in

qutluch.bsky.social

@qutluch.bsky.social
174 followers 828 following 21 posts

When these frail shadows we inhabit now have quit the stage, we'll meet and raise a glass again together in Valhalla.

PostsRepliesMedia
Reposted by @qutluch.bsky.social
Wesley Shields @wxs.bsky.social · 16/10/2025
Thanks to @xorhex for an interesting discussion that is worth sharing here. I knew I read this somewhere but here's a fun thing you can do in YARA-X: 2 of ($a*, $b*, 3 of ($c*)) This is documented but not widely known: virustotal.github.io/yara-x/docs/...
virustotal.github.io
Differences with YARA
Documents the differences between YARA-X and YARA.
264 0
Reposted by @qutluch.bsky.social
Simon McGarr @tupped.bsky.social · 13/07/2025
New Gist: Age Verification is an Epic fail On Bluesky's introduction of age verification, selling us to the Fortnite guys, and how the arrogance of Ireland's regulator has seen it deliver the very outcomes it once called "bonkers". www.thegist.ie/the-gist-age...
thegist.ie
The Gist: Age Verification is an Epic fail
From the 21st July 2025, Ireland’s regulator will be enforcing age checks at the door for social media sites in the EU. This is the Gist.
511578 0
qutluch.bsky.social @qutluch.bsky.social · 22/05/2025
This entire thread is head shot nerd sniping, Greg. I'll brb. Need more time to reply. Keep UNCs. Keep APTs or named actors. There's valid uses but I have strong feelings for how they're used & how people merge groups and/or attribute into a group to say it's them rather than admit it's similar.
010 0
qutluch.bsky.social @qutluch.bsky.social · 29/01/2025
We're guilty of it too. It happens. Keeping up to date with the code families &automating the plugin extraction is a full time job. The automation is important but lowering the bar & time required to do the RE to identity plugins & capability is great. Nino's work helped crush that analysis time.
010 0
qutluch.bsky.social @qutluch.bsky.social · 29/01/2025
It's always bothered me when I read a report saying "It was <pluggable code family PLUGDOOR>" but not always listing the minimum set of plugins (features) a sample was shipped with. Even if it supports loading further modules, clients should be informed of the minimum a threat actor had to hand.
120 0
qutluch.bsky.social @qutluch.bsky.social · 29/01/2025
Thanks. I've spent a lot of time working on pluggable code families like this & SOGU (PlugX). Ultimately the obfuscation defeated me. Nino did such an amazing job. I spent last year working a lot on making sure we can easily identify or at least extract and analyse plugins shipped with pplug.
120 0
qutluch.bsky.social @qutluch.bsky.social · 23/01/2025
@github.com With regards actions could you please review this issue regarding #FreeBSD support. Maybe now that @netflix.com is reporting an impact to them you'll take it seriously. github.com/actions/runn...
github.com
FreeBSD support · Issue #385 · actions/runner
Describe the enhancement Support building the runner on FreeBSD Additional information I think FreeBSD has all the libraries that the runner needs. And while the dotnet-sdk isn't availble from Micr...
020 0
Reposted by @qutluch.bsky.social
Max 'Libra' Kersten @maxkersten.nl · 16/01/2025
My reverse engineering workflows survey is still ongoing! In less than 3 minutes, you can fill it in and help out: docs.google.com/forms/d/e/1F...
docs.google.com
Reverse Engineering Survey
My name is Max 'Libra' Kersten and I'm a malware analyst. This survey will collect the answers you provide without the need for any personal information. The goal of this survey is to get a better und...
011 0
qutluch.bsky.social @qutluch.bsky.social · 14/01/2025
100 0
Reposted by @qutluch.bsky.social
Baptiste Robert @fs0c131y.com · 08/01/2025
Hackers claim to have breached Gravy Analytics, a US location data broker selling to government agencies. They shared 3 samples on a Russian forum, exposing millions of location points across the US, Russia, and Europe.
15226 0
Reposted by @qutluch.bsky.social
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 05/01/2025
#100DaysofYara Day 5 My first ELF binary: github.com/augustvansic... I also learned how to use x64dbg to attach to a process and follow the kernel32.dll WriteProcessMemory stack call to find where the EDR DLL gets a handle on the process.
022 0
Reposted by @qutluch.bsky.social
100 Days Of YARA @100daysofyara.bsky.social · 05/01/2025
x: @RustyNoob619 #100DaysofYARA Day 5 Added a couple of new YARA rules for TTPs 🐧 First is to detect embedded Windows PE payloads in a file as Base 64 encoding Second is to spot modification of memory protect flags which is typically used for code injection/unpacking github.com/RustyNoob-61...
github.com
100-Days-of-YARA-2025/Day5.yara at main · RustyNoob-619/100-Days-of-YARA-2025
100 Days of YARA is a challenge to write a YARA rule every day for 100 days - RustyNoob-619/100-Days-of-YARA-2025
021 0
Reposted by @qutluch.bsky.social
Matt Green @mgreen27.bsky.social · 05/01/2025
crossposting here #100daysofyara continuing to explore yara-x today I tried to detect a renamed QEMU exe using pe attributes and a dynamic variable.
173 0
Reposted by @qutluch.bsky.social
Karsten Hahn @struppigel.bsky.social · 07/12/2024
🦔 📹 Video: Learn how to write code based signatures ➡️ using privateloader as example ➡️ what to detect ➡️ where to set wildcards ➡️ how to test your rule on unpac me www.youtube.com/watch?v=oxC9... #MalwareAnalysisForHedgehogs #privateloader
youtube.com
Malware Analysis - Writing Code Signatures
YouTube video by MalwareAnalysisForHedgehogs
197 0
Reposted by @qutluch.bsky.social
Tony Lambert @forensicitguy.bsky.social · 03/01/2025
New blog post for #100DaysofYARA , in this one I look at a VenomRAT sample and create rules based on PE metadata and an encryption salt value. forensicitguy.github.io/exploring-ve... #malware
forensicitguy.github.io
Exploring VenomRAT Metadata and Encryption with YARA - #100DaysOfYara
It’s that time of year again - 100 Days of YARA! In this post I want to walk through how I use YARA to document malware analysis findings. YARA has loads of different use cases:
0134 0
Reposted by @qutluch.bsky.social
Greg Lesnewich @greg-l.bsky.social · 03/01/2025
#100DaysofYARA we're brute forcing Steve's prompt with regular expressions :P github.com/100DaysofYAR...
3142 0
Reposted by @qutluch.bsky.social
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 03/01/2025
#100DaysOfYara Day 3 Thought this was an meterpreter implant but I compared it to an implant I made; much more functionality for the ITW sample. Rule = unique win32 api calls, IP’s, imports.
053 0
Reposted by @qutluch.bsky.social
Tony Lambert @forensicitguy.bsky.social · 02/01/2025
#100daysofyara I like taking the approach of having multiple YARA rules to detect the same thing from different perspectives, like these rules for Cronos Crypter. One looks for just strings, another a string + encryption salt, 3rd for assembly name
083 0
Reposted by @qutluch.bsky.social
Greg Lesnewich @greg-l.bsky.social · 02/01/2025
#100DaysofYARA day 2 - one cluster in my portfolio, TA427 really likes to use password-protected ZIP files with an MSC file as the only embedded file (used to use .VBS files) lets look for ZIPs that match those features! github.com/100DaysofYAR...
1102 0
Reposted by @qutluch.bsky.social
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 02/01/2025
#100DaysOfYara Day 2: LBB.exe, Lockbit 4 PE github.com/augustvansic...
063 0
qutluch.bsky.social @qutluch.bsky.social · 02/01/2025
media.tenor.com
a man is standing in a store with his arms outstretched and says `` who 's comin ' with me ? ``
ALT: a man is standing in a store with his arms outstretched and says `` who 's comin ' with me ? ``
000 0
qutluch.bsky.social @qutluch.bsky.social · 01/01/2025
Configured my neovim conform.nvim to run "yr fmt" on save. Looking forward to "yr lint" and hoping someday for a yara-x LSP.
media.tenor.com
a man with a beard is making a funny face with his eyes closed and says `` click '' .
ALT: a man with a beard is making a funny face with his eyes closed and says `` click '' .
040 0
qutluch.bsky.social @qutluch.bsky.social · 01/01/2025
I'm on the same page though. That's why I have tried a few options and always come back to an rcs. I've even worked on deduplication methods but it's not worth it. I have what works for me but experimenting is worth while and fun.
110 0
qutluch.bsky.social @qutluch.bsky.social · 01/01/2025
www.gameoftrees.org
gameoftrees.org
Game of Trees
the main Game of Trees page
000 0
qutluch.bsky.social @qutluch.bsky.social · 01/01/2025
Here she is during Christmas after a hard night drinking imperial stout & reviewing yara rules.
120 0
qutluch.bsky.social @qutluch.bsky.social · 01/01/2025
Gitea self-hosted at home right now. I guess my playing with a new service was more a yara-x Golang bindings project than anything else. Probably won't be useful to anyone else. I write plenty of rules at homes & my dog reviews them all. She says they're all quality.
130 0
qutluch.bsky.social @qutluch.bsky.social · 01/01/2025
Also not sure what platform I'll post on. Shitter, BSky, Mastodon or if I'll just PR on GitHub. I was also working on a new service at home for storing my rules. I tried synapse for rule management but in the end I prefer something standalone / decoupled from everything else.
130 0
qutluch.bsky.social @qutluch.bsky.social · 01/01/2025
Gonna take a hangover day & start #100DaysOfYara late. Couldn't keep up last year & I'll see how it goes this year. I don't have the creativity of @greg-l.bsky.social Might do some scripting & play more with yara-x like @stvemillertime.bsky.social I have a half written gRPC service for file scanning
291 0
Reposted by @qutluch.bsky.social
Humphr3y_H3lld0gg$ @lordofthenazgul.bsky.social · 01/01/2025
Ok day 1 of #100DaysofYara: I assigned some strings based on the less common lines from the Lockbit 4 loader that would likely be common in malicious code and not typically in normal admin, as well as a hex string for the PE itself
143 0
Reposted by @qutluch.bsky.social
Greg Lesnewich @greg-l.bsky.social · 01/01/2025
#100DaysofYARA day 1 - the Amos stealer is regularly evolving and updating its obfuscation techniques You know what isn't changing? the dylibs it depends on and the entitlements it requests from the OS. Combined, they give us excellent signal github.com/100DaysofYAR...
2165 0
Reposted by @qutluch.bsky.social
Greg Lesnewich @greg-l.bsky.social · 31/12/2024
#100DaysofYARA 2025 edition begins tomorrow! Any #CTI or #detectionengineering folks looking for a self-paced challenge to start the year with a laid back & fun community? Look no further! The challenge is simple - write a YARA rule every day for 100 days
1219 0
Reposted by @qutluch.bsky.social
Rob Joyce @rgblights.bsky.social · 01/01/2025
For all my math peeps out there: 2025 is pretty amazing mathematical arrangement. 1. 2025 is a perfect square (45×45=2025) 2. 2025 is the sum of digits of cubes from 1 to 9 (1³ + 2³ + 3³ + ... + 9³ = 2025) 3. 2025 is the first square year after 1936 (Cont…)
19350129 0
qutluch.bsky.social @qutluch.bsky.social · 19/12/2024
A friend recently had the flu, got sinusitis and went temporarily blind in one eye. Freaked me the fuck out. Didn't know that could happen.
110 0
qutluch.bsky.social @qutluch.bsky.social · 13/12/2024
I use capstone and python to generate my rules from bytes. I usually mask out immediate or displacement values. Capstone exposes the offset into the bytes of the disassembled instruction for either value. github.com/capstone-eng...
github.com
capstone/bindings/python/capstone/x86.py at 0a29bf80017b8422c79ba51e3ad5c34ba5ee6142 · capstone-engine/capstone
Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, T...
030 0
qutluch.bsky.social @qutluch.bsky.social · 29/11/2024
Saw that. I'm dying to try the Pseudo Rust representation on a rust binary. Someone a few months back handed me a control-flow flattened Rust binary obfuscated with rust obfuscator... I literally just didn't reply hoping they'd forgotten they had asked me to look at it.
media.tenor.com
a cartoon of a man falling on the floor
ALT: a cartoon of a man falling on the floor
010 0
qutluch.bsky.social @qutluch.bsky.social · 29/11/2024
Exactly. Wondering if the author rolled their own rand() & if I need to sig on it. InvokeRE does some nice streams showcasing BN features youtube.com/@invokerever...
youtube.com
Invoke RE
Welcome to Invoke RE! We are a small startup that provides malware analysis training and content surrounding the malware analysis and reverse engineering field. We hope you enjoy our videos!
110 0
qutluch.bsky.social @qutluch.bsky.social · 29/11/2024
Yeah I'm just lazy. The day it's feature parity I'm gone. There's definitely places where Binja is winning but the areas it let's me down inconvenience me too much. I must check in on the FLIRT plugins again. Was pretty old the last time I looked.
110 0
qutluch.bsky.social @qutluch.bsky.social · 29/11/2024
Love Binja but I still return to Ida regularly. Just has some better support when it comes to PE files. Better types & function signatures. I don't want to find DllMain, I want to be dropped into it. I don't want to RE rand() I want Binja to recognise it. I can't use SideKick in work but it's great.
100 0
qutluch.bsky.social @qutluch.bsky.social · 26/11/2024
I never knew about math.sed either. awesome. The Towers Of Hanoi is incredible. Anytime I run into heap exploitation in a CTF I disappear slowly back into the hedge.
000 0