JTJeff Tonginwind010.hashnode.dev·Jun 15 · 8 min readMalware DetectionWhat is YARA? How do we detect if a system is infected? Typically, cybersecurity defenders use YARA rules for malware detection. YARA is the engine that runs these rules. The modern engine is YARA-X w00
JTJeff Tonginwind010.hashnode.dev·Jun 12 · 15 min readMalicious Binary Reverse EngineeringI'm no Low Level (Ed) or John Hammond. I'm at the point where it's a skills issue. I need some guidance. Initially, I tried to get have Claude Codede to analyze the malicious repository with instructi00
JTJeff Tonginwind010.hashnode.dev·Jun 12 · 13 min readDeeper Malware Binary AnalysisWe've setup the docker container with disassemblers like radare2 in the previous post. Separation of Concerns I'm going to use radare2 to slice out by offset/size from the header. We used file and obj00
JTJeff Tonginwind010.hashnode.dev·Jun 11 · 10 min readMalicious Binary Analysis In Malicious IPs and Domain Reconnaissance we trace the endpoints where the suspicious code is coming from. We're going to dive deeper, but I need some protections. The DNS, registry, and endpoint rec00
JTJeff Tonginwind010.hashnode.dev·Jun 10 · 2 min readMalicious IPs and Domain ReconnaissanceIn Malicious Github Repository Analysis we discovered a malicious GitHub repository then analyzed and de-obfuscated the code using an LLM/Gemini. As with any investigation we gather more information a00