A blog about malware and file formats

Welcome to malcat official blog. Click on the links below to filter by article category:
cobalt strike (1) dbatloader (1) dotnet (1) dridex (1) emulation (2) exploit (1) forensic (1) lnk (1) loki (1) lokibot (1) malware analysis (5) news (6) nsis (1) office (1) powershell (1) tutorial (1) unpacking (4) x86 (1)
New release: 0.9.0

New release: 0.9.0

Mon 23 January 2023
Malcat version 0.9.0 is out! You can now open multiple files in parallel, scan for FLIRT signatures, analyse onenote files and enjoy quick bookmarks handling, in addition to the usual bug fixing and various QOL improvements
Read more →
New release: 0.8.5

New release: 0.8.5

Mon 03 October 2022
New version 0.8.5 is out! Enjoy the new "big file" mode, an improved disassembly view, advanced Yara integration and VHD + FAT filesystem support, as well as many other improvements.
Read more →
LNK forensic and config extraction of a cobalt strike beacon

LNK forensic and config extraction of a cobalt strike beacon

Thu 11 August 2022
Windows shortcut files can contain valuable data. We will see how to extract the most information out of a .lnk downloader and will manually extract the configuration file of the final cobalt strike beacon using malcat
Read more →
New release: 0.8.4

New release: 0.8.4

Mon 18 July 2022
New version 0.8.4 is out! Enjoy support for ubuntu 22.04 / python 3.10! We've also improved the analysis of LNK and NSIS files, added more than 400000 API hashes in our constant database and malcat can now identify and parse Cobalt strike configuration files.
Read more →
New release: 0.8.2

New release: 0.8.2

Sun 08 May 2022
New version 0.8.2 is out! Enjoy blazing fast stack strings detection for x86/x64, CD/DVD file system browsing, Py2Exe scripts disassembly and lzma streams detection.
Read more →
Reversing a NSIS dropper using quick and dirty shellcode emulation

Reversing a NSIS dropper using quick and dirty shellcode emulation

Sun 17 April 2022
We will statically unpack and emulate a malicious NSIS installer running multiple shellcodes, up to the final Lokibot password stealer and its configuration.
Read more →
logo

New release: 0.8.0

Tue 22 March 2022
New version 0.8.0 is out! New RTTI analysis, VTGrep integration, improved python + Golang disassembly, color themes and advanced selection.
Read more →
Cutting corners against a Dridex downloader

Cutting corners against a Dridex downloader

Sun 13 March 2022
When one faces obfuscated code, it is sometimes more efficient to focus on the data instead. By using Malcat's different views and analyses (and a bit of guessing as well), we will show how to statically unpack an excel downloader and the following obfuscated native dropper without (much) reverse engineering.
Read more →
logo

New release: 0.7.88

Fri 18 February 2022
New version 0.7.88 is out! Added MSI installer decompiler, improved scripting documentation and added Joe Sandbox threat intelligence lookup.
Read more →
Exploit, steganography and Delphi: unpacking DBatLoader

Exploit, steganography and Delphi: unpacking DBatLoader

Tue 07 December 2021
We will unroll a maldoc spam exploiting CVE-2018-0798 leading to a multi-staged Delphi dropper abusing steganography and cloud services to conceal its payload
Read more →
Statically unpacking a simple .NET dropper

Statically unpacking a simple .NET dropper

Mon 16 August 2021
Our target is a 2-layers .NET dropper using multiple cipher passes (XOR, AES ECB and AES CBC + PBKDF2) to finally drop a Loki sample. Without even starting a debugger, we will show how to unpack it 100% statically using Malcat's builtin transformations and the python scripting engine.
Read more →