Ghidra

Manual analysis of Cobalt Strike Shellcode with Ghidra. Identifying function calls and resolving API hashing.

Manual identification, decryption and fixing of encrypted strings using Ghidra and x32dbg.

Leveraging Ghidra to establish context and intent behind imported functions.

Leveraging Ghidra to establish context and intent behind suspicious strings.

Manually Reversing a decryption function using Ghidra, ChatGPT and CyberChef.

Unpacking a simple Cobalt Strike loader using Debuggers and Hardware breakpoints.

Improving Malware Analysis Workflows by Modifying the default Ghidra UI.

Using Ghidra Entropy Analysis to Identify a decryption function.

Practical examples and breakdowns of indicators that can be used to produce effective yara rules.