Jul 7Eyes on Android/S.O.V.A botnet sampleSummary Sample c1642ac3f729701223043b16ac2c6c5f64adc7080f474c181067b0f1335218f2 Poses as a Minecraft app Malicious Android/S.O.V.A botnet client Packed Implemented in Kotlin Uses Retrofit2 for communication with C2 The C2 is down currently An excellent analysis here. I try to highlight different aspects: How to unpack with Medusa How the malware sets up on first launch How…Sova4 min readSova4 min read
Jun 23Inside KangaPack: the Kangaroo packer with native decryptionIn this blog post, we unpack a malicious sample sha256: 2c05efa757744cb01346fe6b39e9ef8ea2582d27481a441eb885c5c4dcd2b65b . The core decryption of the payload is implemented at native level. I named the packer KangaPack (you’ll understand why when reading this article), it also goes under the name Packed.57103, I am unaware of any other name. Teaser…Android6 min readAndroid6 min read
Jun 20Reversing Flutter apps: Dart’s Small IntegersThis article delves into the reverse engineering of Dart executable or Flutter release applications. We focus on the reverse engineering of byte arrays. No type for bytes Dart does not have a specific type for bytes, it only has integers (int). Byte arrays are typically coded as Uint8List objects, a class dedicated to representing…Dart4 min readDart4 min read
Jun 15Dart’s custom calling conventionContext Dart is an object-oriented programming language with a C-style syntax, and a few features like sound null safety. The language is used Flutter, a cross-platform framework to build apps with the same codebase on various platforms such as Android, iOS, Windows, Linux… Dart can be compiled in various formats with…Dart4 min readDart4 min read
Jun 8“What’s a CTF? Is it interesting?Will I enjoy it? Do I have the skills for a CTF?”Nearly every CTF newcomer wonders about this and, as one of the organizers of Ph0wn CTF, I often get the question. So I decided to write about it. A “CTF” is a shortcut for “Capture The Flag”. It’s a hacking competition where you have hacking/cyber-security challenges to solve. The “flag”…Ctf6 min readCtf6 min read
Oct 4, 2022Virus Bulletin Conference 2022 — Day 3Personal notes and comments of the last day of Virus Bulletin. This conference is a treasure + I like the fact that if I miss something during the talk, I can read the paper and understand. The att&ck DarkHotel playbook [..] Keeping up with the Emotets [..] Modern threat hunting…Conference4 min readConference4 min read
Sep 30, 2022Virus Bulletin Conference 2022— Day 2Oct 4, 2022. Adding links for Day 1 and Day 3 + Best Paper Day 1 Day 3 + Best Paper EVILPLAYOUT: ATTACK AGAINST IRAN’S STATE TV AND RADIO BROADCASTER Alexandra Gofman, Israel Gubi & Itay Cohen The presentation had lots of new research, not included in the paper. I hope they’ll publish that soon. Several different hacktivist groups managed to perform wide-range attacks in Iran…Conference3 min readConference3 min read
Sep 30, 2022Virus Bulletin Conference 2022 — Day 1For each talk/paper I attended, I try to highlight the main takeaways and my personal comments. So, this is not a summary of the paper, but rather my personal interest to it. At the end of the conference, I will nominate the best paper. …Conference3 min readConference3 min read
Jul 5, 2022Master English Accent for Frogsoù comment présenter en anglais et être compris (par des anglophones), à l’usage des speakers français de conférences de sécurité informatique/hacking… Parler anglais avec l’accent français, ça arrive à beaucoup de monde et ce n’est pas forcément un “gros” problème tant qu’on est compris par les anglophones. …Pronunciation7 min readPronunciation7 min read
Jun 28, 2022AndroscopeMotivation Main links How to submit a sample: check admissibility, upload or insert Search or Refine your search FAQ: when will my sample get reviewed, I am trustworthy, can my sample be automatically accepted please?, I submitted an entry, and after pending review my submission was erased, why?, can I…Android7 min readAndroid7 min read
