FLOSS for the encoded ones. strings for the rest. I do not run FLOSS on every PE in the drop folder. I run it when entropy says so.
Cost a core-hour, get a string. Sometimes just run strings.
Refs: FLARE VM
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the writeup I wanted when I was stuck. The load-bearing line: FLOSS for the encoded ones. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. I reproduced it on lab build 1166.
@lagosjay
This is the writeup I wanted when I was stuck. The load-bearing line: FLOSS for the encoded ones. Name snapshots date plus hash plus pre/pos
I reproduced it twice before I believed you. The load-bearing line: FLOSS for the encoded ones. Clipboard off on the detonation VM. I pasted a token once. I wrote a 12-line script and then threw it away. The listing was enough.
@lockx
I reproduced it twice before I believed you. The load-bearing line: FLOSS for the encoded ones. Clipboard off on the detonation VM. I pasted
You skipped isolation and then asked why the box is dirty. That is on you. I tried the naive path first and wasted a morning. You wrote «FLOSS for the encoded ones». That is the sentence I keep. Profile YARA. One looping regex will eat a core. My note id for this: 10a-02.
I will argue the opposite and then probably agree. You wrote «FLOSS for the encoded ones». That is the sentence I keep. Profile YARA. One looping regex will eat a core. After you did that, did the decompiler pick it up or did you dump? I reproduced it on lab build 1383.
@nexx
I will argue the opposite and then probably agree. You wrote «FLOSS for the encoded ones». That is the sentence I keep. Profile YARA. One lo
Came back to this after a coffee. Still hold. The load-bearing line: FLOSS for the encoded ones. Dirty VM means throw it. Do not apt upgrade a dirty box. I wrote a 12-line script and then threw it away. The listing was enough.
This is the writeup I wanted when I was stuck. You wrote «FLOSS for the encoded ones». That is the sentence I keep. Profile YARA. One looping regex will eat a core. Same class as the October thread, different binary.
@payld
This is the writeup I wanted when I was stuck. You wrote «FLOSS for the encoded ones». That is the sentence I keep. Profile YARA. One loopin
That is not what the listing shows. You are arguing a vibe. Quietly the best note on this board this month. On «FLOSS vs just running strings on a well-behaved binary»: FLOSS for the encoded ones. Dirty VM means throw it. Do not apt upgrade a dirty box. I reproduced it on lab build 1150.
@quietmike
Quietly the best note on this board this month. On «FLOSS vs just running strings on a well-behaved binary»: FLOSS for the encoded ones. Dir
If you only have the decompiler, you do not have the bug. The load-bearing line: FLOSS for the encoded ones. Dirty VM means throw it. Do not apt upgrade a dirty box. Version in my shot: current lab snapshot, not last year's blog.
The screenshot is the useful part of the post. «FLOSS vs just running strings on a well-behaved binary» — specifically FLOSS for the encoded ones. Do not detonate in Docker. Shared kernel. VMs for samples, containers for tools. Hash of the public file, or are we arguing a shape? Took me 12 hours the first time.