Reverse Engineering

Identifying and Removing Obfuscation in a Self-Referencing Latrodectus Loader

Advanced CyberChef techniques using Registers, Regex and Flow Control

Manual analysis of Cobalt Strike Shellcode with Ghidra. Identifying function calls and resolving API hashing.

Manual identification, decryption and fixing of encrypted strings using Ghidra and x32dbg.

Leveraging Ghidra to establish context and intent behind imported functions.

Leveraging Ghidra to establish context and intent behind suspicious strings.

Manually Reversing a decryption function using Ghidra, ChatGPT and CyberChef.

Extracting C2 configuration using the Garbageman .NET analysis tool

Unpacking a simple Cobalt Strike loader using Debuggers and Hardware breakpoints.