<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Reversing &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/category/reversing/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Wed, 17 May 2023 07:41:37 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.0</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Reversing &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>Extreme PowerShell Obfuscation</title>
		<link>https://blog.cerbero.io/extreme-powershell-obfuscation/</link>
					<comments>https://blog.cerbero.io/extreme-powershell-obfuscation/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 17 May 2023 07:41:37 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Deobfuscation]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2709</guid>

					<description><![CDATA[We recently stumbled upon an old article by Daisuke Mutaguchi explaining an extreme technique for PowerShell obfuscation. The article is in Japanese, so you may have to use Google translate. Here&#8217;s the final example provided by the author of the article: ${;}=+$();${=}=${;};${+}=++${;};${@}=++${;};${.}=++${;};${[}=++${;}; ${]}=++${;};${(}=++${;};${)}=++${;};${&#38;}=++${;};${&#124;}=++${;}; ${&#34;}=&#34;[&#34;+&#34;$(@{})&#34;[${)}]+&#34;$(@{})&#34;[&#34;${+}${&#124;}&#34;]+&#34;$(@{})&#34;[&#34;${@}${=}&#34;]+&#34;$?&#34;[${+}]+&#34;]&#34;; ${;}=&#34;&#34;.(&#34;$(@{})&#34;[&#34;${+}${[}&#34;]+&#34;$(@{})&#34;[&#34;${+}${(}&#34;]+&#34;$(@{})&#34;[${=}]+&#34;$(@{})&#34;[${[}]+&#34;$?&#34;[${+}]+&#34;$(@{})&#34;[${.}]); ${;}=&#34;$(@{})&#34;[&#34;${+}${[}&#34;]+&#34;$(@{})&#34;[${[}]+&#34;${;}&#34;[&#34;${@}${)}&#34;]; &#34;${&#34;}${.}${[}+${&#34;}${)}${@}+${&#34;}${+}${=}${+}+${&#34;}${+}${=}${&#38;}+${&#34;}${+}${=}${&#38;}+${&#34;}${+}${+}${+}+${&#34;}${[}${[}+${&#34;}${.}${@}+${&#34;}${+}${+}${&#124;}+${&#34;}${+}${+}${+}+${&#34;}${+}${+}${[}+${&#34;}${+}${=}${&#38;}+${&#34;}${+}${=}${=}+${&#34;}${.}${.}+${&#34;}${.}${[}&#124;${;}&#34;&#124;&#38;${;}; Yes, this is valid PowerShell. Although there are &#8230; <a href="https://blog.cerbero.io/extreme-powershell-obfuscation/" class="more-link">Continue reading<span class="screen-reader-text"> "Extreme PowerShell Obfuscation"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/extreme-powershell-obfuscation/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2709</post-id>	</item>
		<item>
		<title>PowerShell Malware with x64 Shellcode</title>
		<link>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/</link>
					<comments>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 10 May 2023 08:05:21 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Silicon]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2682</guid>

					<description><![CDATA[This malware gives us a chance to see the recently introduced Silicon Shellcode Emulator in action. SHA256: 8CF1E49C74FB05DE954A6B70281F47E3CBD021108B0EE11F4A59667FF28BFEE9 The PowerShell code is not obfuscated: it decodes a base64 encoded string, decrypts the result with a xor operation, allocates memory with VirtualAlloc, copies the shellcode to the allocated memory and then executes it. If ([IntPtr]::size -eq &#8230; <a href="https://blog.cerbero.io/powershell-malware-with-x64-shellcode/" class="more-link">Continue reading<span class="screen-reader-text"> "PowerShell Malware with x64 Shellcode"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2682</post-id>	</item>
		<item>
		<title>OneNote Malware With ISO File</title>
		<link>https://blog.cerbero.io/onenote-malware-with-iso-file/</link>
					<comments>https://blog.cerbero.io/onenote-malware-with-iso-file/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 09 May 2023 09:56:37 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[ISO]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2675</guid>

					<description><![CDATA[We recently stumbled upon this tweet by @Cryptolaemus1 about a malicious OneNote document with an embedded ISO file. Because of our recently released ISO Format package, we thought it would be interesting to analyze this malware sample with Cerbero Suite. SHA256: 2B0B2A15F00C6EED533C70E89001248A0F2BA6FAE5102E1443D7451A59023516 The unidentified embedded object in the OneNote document is an ISO file. We &#8230; <a href="https://blog.cerbero.io/onenote-malware-with-iso-file/" class="more-link">Continue reading<span class="screen-reader-text"> "OneNote Malware With ISO File"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/onenote-malware-with-iso-file/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2675</post-id>	</item>
		<item>
		<title>RedLine Stealer Dropper</title>
		<link>https://blog.cerbero.io/redline-stealer-dropper/</link>
					<comments>https://blog.cerbero.io/redline-stealer-dropper/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 07 Mar 2023 11:53:28 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Deobfuscator]]></category>
		<category><![CDATA[Dropper]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2542</guid>

					<description><![CDATA[An interesting sample containing a number of different obfuscation techniques. In this article we analyze the dropper in detail and reach the final stage. SHA256: 0B93B5287841CEF2C6B2F2C3221C59FFD61BF772CD0D8B2BDAB9DADEB570C7A6 The first file we encounter is a OneNote document. If the &#8220;OneNote Format&#8221; package is installed, all files are automatically extracted. Among the extracted files there are two unidentified &#8230; <a href="https://blog.cerbero.io/redline-stealer-dropper/" class="more-link">Continue reading<span class="screen-reader-text"> "RedLine Stealer Dropper"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/redline-stealer-dropper/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2542</post-id>	</item>
		<item>
		<title>UPX Unpacker Package</title>
		<link>https://blog.cerbero.io/upx-unpacker-package/</link>
					<comments>https://blog.cerbero.io/upx-unpacker-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Mon, 30 May 2022 00:00:19 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[Packer]]></category>
		<category><![CDATA[Unpacker]]></category>
		<category><![CDATA[UPX]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2415</guid>

					<description><![CDATA[We created an UPX Unpacker package for the upcoming 5.6 version of Cerbero Suite. From the UPX web-site: &#8220;UPX is a free, portable, extendable, high-performance executable packer for several executable formats.&#8221; By installing the UPX Unpacker package, binaries compressed with UPX are automatically identified and unpacked as child objects. PE, ELF and Mach-O binaries are &#8230; <a href="https://blog.cerbero.io/upx-unpacker-package/" class="more-link">Continue reading<span class="screen-reader-text"> "UPX Unpacker Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/upx-unpacker-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2415</post-id>	</item>
		<item>
		<title>String Decrypter Package</title>
		<link>https://blog.cerbero.io/string-decrypter-package/</link>
					<comments>https://blog.cerbero.io/string-decrypter-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 15 Mar 2022 10:59:42 +0000</pubDate>
				<category><![CDATA[Action]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[Cryptography]]></category>
		<category><![CDATA[Strings]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2356</guid>

					<description><![CDATA[We have just released our String Decrypter package on Cerbero Store for all licenses of Cerbero Suite. The String Decrypter package is very useful for reversing malware and during CTFs. This utility can be invoked as an action from a hex view or a Carbon disassembly. It can be used to brute-force the decryption of &#8230; <a href="https://blog.cerbero.io/string-decrypter-package/" class="more-link">Continue reading<span class="screen-reader-text"> "String Decrypter Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/string-decrypter-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2356</post-id>	</item>
	</channel>
</rss>
