Posts

Showing posts with the label polymorphic

New 2017 Shellcode | Titles -- Link Direct to Code

Image
I've compiled a list of the most current shellcodes and linked each directly to their raw code. I am providing this list for analytical purpose to those that may be interested. Enjoy and use responsibly... Windows x64 password protected bind shellcode. Windows x64 CreateRemoteThread() DLL injection shellcode. Linux/x86_x64 mkdir("ajit", 755) shellcode. Linux/x86_64 shellcode that binds to TCP/5600. Linux/x86_64 execve /bin/sh shellcode. Linux multi/dual mode execve("/bin/sh", NULL, 0) shellcode. Linux multi/dual mode reverse shell shellcode. Linux/x86 reverse TCP alphanumeric staged shellcode. Linux dual / multi mode bind shell shellcode. Windows x86 protect process shellcode. Linux reverse shell shellcode. Linux x86-64 egghunter shellcode. Linux x86_64 random listener Windows x86 executable directory search shellcode. RSA Asymmetric Polymorphic Shellcode. Windows x86 reverse TCP staged alphanumeric shellcode. Linux x86_64 polymorphic setui...

Hidden in Plain Sight - Uncovering the 'New' Malware.

Over the years I have seen and worked on my share of malware, watched as the vulz and exploits come and go. After a few years in frey, one becomes very attuned to the world that's surrounds them. This sixth sense is an asset and more valuable now than any other time, welcome to the new era of malz. This is a hidden world, where silence, stealth and pure imagination contribute to what is normally a quiet infection. Distinguished with highly-complex coding, persistence and it's signature polymorphic design. Those involved in cybersec know of this new breed, stealth and delivery, as well as those who design and code them. This is a journey leading to, and the analysis of a recent live malware discovery by myself. This write-up will highlight the importance of a full skill set and how that sixth sense comes into play. I am, however, leaving out some crucial information on certain parts. This is in consideration that the malware and delivery structure is still in the wild. We hav...