Decrypting APT33’s Dropshot Malware with Radare2 and Cutter – Part 2
+Prologue Previously, in the first part of this article, we used Cutter, a GUI for...
+ Read More +diff --git a/.nojekyll b/.nojekyll new file mode 100644 index 000000000..e69de29bb diff --git a/.well-known/org.flathub.VerifiedApps.txt b/.well-known/org.flathub.VerifiedApps.txt new file mode 100644 index 000000000..a81ca70f8 --- /dev/null +++ b/.well-known/org.flathub.VerifiedApps.txt @@ -0,0 +1 @@ +efb814da-3214-4d9a-ba87-1f438b0cc23e diff --git a/.well-known/security.txt b/.well-known/security.txt new file mode 100644 index 000000000..1af298168 --- /dev/null +++ b/.well-known/security.txt @@ -0,0 +1,3 @@ +Contact: mailto:security@cutter.re +Preferred-Languages: en, ru, hi, fr, de, he +Canonical: https://cutter.re/.well-known/security.txt diff --git a/2019/07/26/index.html b/2019/07/26/index.html new file mode 100644 index 000000000..0293793b1 --- /dev/null +++ b/2019/07/26/index.html @@ -0,0 +1,242 @@ + + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +Prologue Previously, in the first part of this article, we used Cutter, a GUI for...
+ Read More +Prologue As a reverse engineer and malware researcher, the tools I use are super important...
+ Read More +Prologue Previously, in the first part of this article, we used Cutter, a GUI for...
+ Read More +Prologue As a reverse engineer and malware researcher, the tools I use are super important...
+ Read More +Last week I attended the r2con conference for the first time (for those who haven't...
+ Read More +Last week I attended the r2con conference for the first time (for those who haven't...
+ Read More +I recently watched a video by LiveOverflow in which he showed how different tools are...
+ Read More +I recently watched a video by LiveOverflow in which he showed how different tools are...
+ Read More +I recently watched a video by LiveOverflow in which he showed how different tools are...
+ Read More +Last week I attended the r2con conference for the first time (for those who haven't...
+ Read More +Prologue Previously, in the first part of this article, we used Cutter, a GUI for...
+ Read More +Prologue As a reverse engineer and malware researcher, the tools I use are super important...
+ Read More +The Cutter team is working hard to create a free and open-source reverse engineering framework...
+ Read More +The Cutter team is working hard to create a free and open-source reverse engineering framework...
+ Read More +My name is Nirmal Manoj. I am a second-year CS undergraduate student at IIIT Hyderabad,...
+ Read More +My name is Nirmal Manoj. I am a second-year CS undergraduate student at IIIT Hyderabad,...
+ Read More +My name is Nirmal Manoj. I am a second-year CS undergraduate student at IIIT Hyderabad,...
+ Read More +The Cutter team is working hard to create a free and open-source reverse engineering framework...
+ Read More +We are excited to release Cutter v2.0 — the first release of Cutter that is...
+ Read More +We are excited to release Cutter v2.0 — the first release of Cutter that is...
+ Read More +We are excited to release Cutter v2.0 — the first release of Cutter that is...
+ Read More +I recently watched a video by LiveOverflow in which he showed how different tools are used to patch binaries. By demonstrating some of the features that Radare2, Ghidra, and Binary Ninja offer for the task, the viewer can get some sense of the things they can get from using these tools.
+While all these tools are great, and although Radare2 was showed there (and oh boy, things went wrong), there was one tool, which is dear to my heart, that wasn’t there – Cutter. Notwithstanding that it is the youngest member of the pack, Cutter is growing up very fast and when it has to do with binary patching – it does not stay behind.
+“Binary Patching”, for those the term is unfamiliar, is the process of applying small changes and modifications to a binary file, usually in order to change its behavior. By modifying data or code, the user can change certain values in the program or specific instructions, and adjust the binary to their desired outcome.
+ +Cutter makes patching binaries a simple task - here are 5 ways to do so.
+ + +Cutter is a Qt and C++ GUI powered by [Rizin](https://rizin.re). Its goal is making an advanced, customizable and FOSS reverse-engineering platform while keeping the user experience at mind. Cutter is created by reverse engineers for reverse engineers.
+Cutter is actively maintained by its developer team and releases a new feature every ~5 weeks. Naturally, Cutter enjoys the fast paced development of its core, Rizin. This makes the project one of the most actively developed RE frameworks.
+ +As a reverse engineer and malware researcher, the tools I use are super important for me. I have invested hours and hours in creating the best malware analysis environment for myself and chose the best tools for me and my needs. For the last two years, radare2 is my go-to tool for a lot of reverse-engineering tasks such as automating RE related work, scripting, CTFing, exploitation and more. That said, I almost never used radare2 for malware analysis, or more accurately, for analysis of malware for Windows.
+The main reason was that radare2 command-line interface felt too clumsy, complicated and an over-kill. IDA Pro was simply better for these tasks, a quick inspection of functions, data structures, renaming, commenting, et cetera. It felt more intuitive for me and that what I was searching for while doing malware analysis. And then came Cutter.
+ + +Previously, in the first part of this article, we used Cutter, a GUI for radare2, to statically analyze APT33’s Dropshot malware. We also used radare2’s Python scripting capabilities in order to decrypt encrypted strings in Dropshot. If you didn’t read the first part yet, I suggest you do it now.
+Today’s article will be shorter, now that we are familiar with cutter and r2pipe, we can quickly analyze another interesting component of Dropshot — an encrypted resource that includes Dropshot’s actual payload. So without further ado, let’s start.
+ + +