secrary [dot] com – All Content

We’re getting very good at remembering where the answer lives This isn’t a new problem just because the interface now has chat bubbles.

The Mistakes That Shaped My Backup Strategy The first time I installed a Linux distro as a kid, I accidentally wiped our entire hard drive.

Introduction You don’t appreciate keyboard-driven workflows until you commit to them.

Hi, Hello.

Introduction APK - Android Application Package Android Manifest File Package Name Activities Services Broadcast Receivers Content Providers Application Element Introduction Android applications are distributed in the form of Android Application Package (.…

Introduction Runtime Environment on Android Dalvik bytecode - Dex Code Dalvik VM and ART Dalvik and ART Optimization Introduction Let’s start our journey by exploring the architecture of the Android operating system and its internals.

If you have an unsigned binary that requires administrator privileges, when a target runs the binary, the following window will show up: The window’s header is yellow, indicating that the binary is not signed, and in this example, the publisher is unknown.

Most #EPP (Endpoint Protection Platforms) products offer dynamic monitoring capabilities such as sandboxing, emulation, and hooking.

When your product injects a module into a target process, the target process can call the FreeLibrary function to unload your module, assuming the reference count is one.

I want to write about a very interesting epilogue hooking method presented by Alex Ionescu at REcon 2015.

SHA-256 Hash SHA-256: 963f1735e9ee06c66fdf3a831d7c262bc8bce0d7155e37f9a5aa2677e0a6090c You can download the malware sample from malware-traffic-analysis.net.

Mastermind Crackme Analysis Introduction This article explores the solution to a challenging crackme created by Spider.

Introduction The crackme is created by @MalwareTechLab, you can download the sample from here.

Introduction The crackme was created by @hasherazade to test malware analysis skills.

Overview This post provides a detailed analysis of the Bandios/Colony malware, exploring its behavior and the techniques it employs.

SHA1: FA40B39B5E3755A3AB58634DBF0BAF4B0E0E3659 I obtained the sample from ANY.RUN.

Overview Imagination is a medium-difficulty crackme challenge from the crackmes.de archive designed to test a researcher’s reverse engineering skills.

These techniques are not complicated, but they can still confuse beginner malware analysts and reverse engineers.

Introduction User-mode hooks are unreliable and can be bypassed in various ways.

WSL enables native Linux ELF64 binaries to run on Windows through the Windows Subsystem for Linux (WSL).

In this post, I delve into the interseting aspects of the Windows kernel, specifically focusing on the concept of creating unkillable processes.

Introduction In this post, we will explore a relatively new sample of the GandCrab ransomware, which I obtained from ANY.RUN.

I’m trying to unpack the Shade ransomware.

Introduction CrackMes are executable programs designed to teach reverse engineering concepts.

You can get the sample from theZoo.

WMIGhost / Wimmie sample is from theZoo.

Introduction Remcos Remote Control - Control your computers remotely, anywhere in the world.

SHA256 of sample.exe: 98199294da32f418964fde49d623aadb795d783640b208b9dd9ad08dcac55fd5 Today, I’m analyzing #CoinMiner.