<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Emulator &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/emulator/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Wed, 24 May 2023 08:09:37 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Emulator &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>Obfuscated Batch Scripts in OneNote Document</title>
		<link>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/</link>
					<comments>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 24 May 2023 08:09:37 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[OneNote]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2696</guid>

					<description><![CDATA[This malicious OneNote document contains two obfuscated batch scripts and we&#8217;ll be using our commercial Simple Batch Emulator package to understand what they do. SHA256: 46149F56028829246628FFAFC58DF81A4B0FF1C87ED6466492E25AD2F23C0A13 We open the first batch script and decode its data to text with the action &#8220;Conversion -> Bytes to text&#8221; (Ctrl+R). This is the batch script and as we &#8230; <a href="https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/" class="more-link">Continue reading<span class="screen-reader-text"> "Obfuscated Batch Scripts in OneNote Document"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/obfuscated-batch-scripts-in-onenote-document/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2696</post-id>	</item>
		<item>
		<title>PowerShell Malware with x64 Shellcode</title>
		<link>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/</link>
					<comments>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 10 May 2023 08:05:21 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Silicon]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2682</guid>

					<description><![CDATA[This malware gives us a chance to see the recently introduced Silicon Shellcode Emulator in action. SHA256: 8CF1E49C74FB05DE954A6B70281F47E3CBD021108B0EE11F4A59667FF28BFEE9 The PowerShell code is not obfuscated: it decodes a base64 encoded string, decrypts the result with a xor operation, allocates memory with VirtualAlloc, copies the shellcode to the allocated memory and then executes it. If ([IntPtr]::size -eq &#8230; <a href="https://blog.cerbero.io/powershell-malware-with-x64-shellcode/" class="more-link">Continue reading<span class="screen-reader-text"> "PowerShell Malware with x64 Shellcode"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2682</post-id>	</item>
		<item>
		<title>Video: Silicon Shellcode Emulator Introduction</title>
		<link>https://blog.cerbero.io/video-silicon-shellcode-emulator-introduction/</link>
					<comments>https://blog.cerbero.io/video-silicon-shellcode-emulator-introduction/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 02 May 2023 09:07:33 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Video]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Shellcode]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2671</guid>

					<description><![CDATA[A quick 70-seconds introduction to Silicon Shellcode Emulator: a lightweight x86/x64 emulator designed for Windows shellcode. This package is available to all commercial licenses of Cerbero Suite Advanced.]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-silicon-shellcode-emulator-introduction/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2671</post-id>	</item>
		<item>
		<title>RedLine Stealer Dropper</title>
		<link>https://blog.cerbero.io/redline-stealer-dropper/</link>
					<comments>https://blog.cerbero.io/redline-stealer-dropper/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 07 Mar 2023 11:53:28 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Deobfuscator]]></category>
		<category><![CDATA[Dropper]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2542</guid>

					<description><![CDATA[An interesting sample containing a number of different obfuscation techniques. In this article we analyze the dropper in detail and reach the final stage. SHA256: 0B93B5287841CEF2C6B2F2C3221C59FFD61BF772CD0D8B2BDAB9DADEB570C7A6 The first file we encounter is a OneNote document. If the &#8220;OneNote Format&#8221; package is installed, all files are automatically extracted. Among the extracted files there are two unidentified &#8230; <a href="https://blog.cerbero.io/redline-stealer-dropper/" class="more-link">Continue reading<span class="screen-reader-text"> "RedLine Stealer Dropper"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/redline-stealer-dropper/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2542</post-id>	</item>
		<item>
		<title>Simple Batch Emulator Package</title>
		<link>https://blog.cerbero.io/simple-batch-emulator-package/</link>
					<comments>https://blog.cerbero.io/simple-batch-emulator-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 09 Feb 2023 12:24:40 +0000</pubDate>
				<category><![CDATA[Engine]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2524</guid>

					<description><![CDATA[To help in the analysis of malware which uses Windows batch scripts we just released a package on Cerbero Store called &#8220;Simple Batch Emulator&#8221;. The name of the package is self-explanatory as it provides a basic emulator for batch scripts. The package is available to all commercial licenses of Cerbero Suite Advanced. The following is &#8230; <a href="https://blog.cerbero.io/simple-batch-emulator-package/" class="more-link">Continue reading<span class="screen-reader-text"> "Simple Batch Emulator Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/simple-batch-emulator-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2524</post-id>	</item>
		<item>
		<title>Video: 1.5-Minutes QakBot Excel Malware Analysis (2nd sample)</title>
		<link>https://blog.cerbero.io/video-1-5-minutes-qakbot-excel-malware-analysis-2nd-sample/</link>
					<comments>https://blog.cerbero.io/video-1-5-minutes-qakbot-excel-malware-analysis-2nd-sample/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 10 Mar 2021 09:00:04 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Excel]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Office]]></category>
		<category><![CDATA[XLS]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1973</guid>

					<description><![CDATA[The script extends the Silicon Excel Emulator by implementing th &#8220;FORMULA&#8221; function: from Pro.SiliconSpreadsheet import * from Pro.UI import proContext class EmulatorHelper(SiliconExcelEmulatorHelper): def __init__(self): super(EmulatorHelper, self).__init__() def evaluateFunction(self, emu, ctx, opts, depth, e): function_name = e.toString() if function_name == "FORMULA": if emu.expectedArguments(e, 2, 2): ve = emu.argToValue(ctx, opts, depth, e, 0) v = emu.valueToSpreadsheetValue(ve) idxstr &#8230; <a href="https://blog.cerbero.io/video-1-5-minutes-qakbot-excel-malware-analysis-2nd-sample/" class="more-link">Continue reading<span class="screen-reader-text"> "Video: 1.5-Minutes QakBot Excel Malware Analysis (2nd sample)"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-1-5-minutes-qakbot-excel-malware-analysis-2nd-sample/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1973</post-id>	</item>
		<item>
		<title>Video: 2-Minutes QakBot Excel Malware Analysis</title>
		<link>https://blog.cerbero.io/video-2-minutes-qakbot-excel-malware-analysis/</link>
					<comments>https://blog.cerbero.io/video-2-minutes-qakbot-excel-malware-analysis/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 09 Mar 2021 13:38:38 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Excel]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Office]]></category>
		<category><![CDATA[XLS]]></category>
		<guid isPermaLink="false">https://cerbero-blog.com/?p=1971</guid>

					<description><![CDATA[The script extends the Silicon Excel Emulator by implementing the &#8220;NOW&#8221; and &#8220;FORMULA.FILL&#8221; functions: from Pro.SiliconSpreadsheet import * from Pro.UI import proContext class EmulatorHelper(SiliconExcelEmulatorHelper): def __init__(self): super(EmulatorHelper, self).__init__() def evaluateFunction(self, emu, ctx, opts, depth, e): function_name = e.toString() if function_name == "FORMULA.FILL": if emu.expectedArguments(e, 2, 2): ve = emu.argToValue(ctx, opts, depth, e, 0) v = &#8230; <a href="https://blog.cerbero.io/video-2-minutes-qakbot-excel-malware-analysis/" class="more-link">Continue reading<span class="screen-reader-text"> "Video: 2-Minutes QakBot Excel Malware Analysis"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-2-minutes-qakbot-excel-malware-analysis/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1971</post-id>	</item>
	</channel>
</rss>
