ePsiLoN's Information Security Blog

Malware and Reverse Engineering

DLink dir655 rev B firmware reverse engineering – part 1
ePsiLoN
09/08/2014
Malware and Reverse Engineering
Intro Recently I stumbled upon Paul dot com blog post Reverse Engineering Firmware Primer and decided to see if I could repeat the process and to test my newly installed Debian VM packed with RE tools. Here is my take on the task. To repeat the steps one generally needs binwalk and cpio. Walk through…
Setting up capstone (Debian Wheezy)
ePsiLoN
09/07/2014
Malware and Reverse Engineering
Intro Recently I’ve decided to dedicate a fresh Debian environment for my RE tools and having binwalk seemed as a good idea so I can play with firmware binaries. I followed the general install instructions from the project wiki and it seemed that all the dependencies were installed. On starting the executable however I got…
Practical Reverse Engineering Exercises – Ch1-Ex2 – Write-Up
ePsiLoN
07/17/2014
Malware and Reverse Engineering
Intro This is the second post of a blog series following my progress with the “Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation”, Bruce Dang, Alexandre Gazet, Elias Bachaalany, Sebastien Josse, ISBN: 978-1-118-78731-1. The book includes number of exercises and the authors encourage the people to blog their solutions. The solutions…
Practical Reverse Engineering Exercises – Ch1-Ex1 – Write-Up
ePsiLoN
07/07/2014
Malware and Reverse Engineering
Intro This is the first post of what should be a blog series following my progress with the “Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation”, Bruce Dang, Alexandre Gazet, Elias Bachaalany, Sebastien Josse, ISBN: 978-1-118-78731-1. The book includes number of exercises and the authors encourage the people to blog their…
Malware Sandbox – Free Public Cuckoo instance
ePsiLoN
04/24/2013
Malware and Reverse Engineering, Security tools
I’m writing this down for my own reference and if someone else benefits this I’ll be more than happy. Here is the URL (https://malwr.com/) to the public cuckoo sandbox – free to submit executables for malware analysis. Enjoy
An Introduction To Keyloggers, RATS And Malware – book review
ePsiLoN
06/16/2012
Malware and Reverse Engineering, Reviews
Yesterday I stumbled across yet another “hacking” site. My curiosity motivated me to mirror the site content and go through all the files. Most of them were books and tutorials. After I finished reviewing some of them I realised that I hadn’t include any book reviews in this blog so far and that may be…
Kaspersky Lab source code analysis of Duqu
ePsiLoN
03/12/2012
Malware and Reverse Engineering
Kaspersky Lab has been analysing the infamous duqu worm code for several months. In one of the latest writeups, Igor Soumenkov describes part of Duqu code – for which there is an open debate around what language was used for its development. The discussion is quite interesting so I compiled a list of the relevant…
Anubis sandbox or “Analyse this!”
ePsiLoN
08/28/2011
Malware and Reverse Engineering, Security tools
If you would like to know more about the behavior of a particular malware, but you do not want to build your own sandbox or you just have not the resources to build it then may be you can find Anubis service suitable for your needs and pretty convenient. Anubis had been developed by IsecLab.…
First look at the Zeus source code – leak 2
ePsiLoN
05/17/2011
Attacks, Malware and Reverse Engineering, News, Random
So the first thing I did was to search the source code to see which banks had been targeted and for my surprize – one of the Bulgarian banks was targeted – ProCredit. The link to the e-banking login page thou is invalid, but the name of the password field is correct 🙂 Stay tuned…
Zeus code posted online
ePsiLoN
05/17/2011
Forensics, Malware and Reverse Engineering, News
So … Here it is Zeus source code is online! It’s already few days old info, but I just red about it and luckily the download links were still alive. I was able to find information about the both leaks on http://pastebin.com/VqHq9WeD. Enjoy!