Did you know you can combine REMnux and SIFT Workstation on one system and have all their forensics and malware analysis tools at your fingertips?
#malwareanalysis — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #malwareanalysis, aggregated by home.social.
-
RE: https://infosec.exchange/@ESETresearch/117591559869846560
For malware REs the interesting parts are at the end:
The use of Vtable Fixups to provide unmanaged exported functions from .NET binaries. As usual @washi has a good example of how to do this here, and more information: https://github.com/Washi1337/AsmResolver/issues/63
Loading a malicious assembly by placing it in the .NET Native Image cache
Adding malicious code around Exchange Transport Agents, by directly hooking them inside the transport agent management process EdgeTransport.exe