#deobfuscation

The LummaC2 obfuscator employs a novel control flow protection scheme designed specifically for its stealer component, which is part of a broader set of transformations, making it difficult for analysts to reverse engineer the binary.  It introduces obfuscated code that is mixed with the original compiler-generated code, requiring a specialized deobfuscator for analysis. The obfuscator’s […] The…

Deobfuscating Emotet’s powershell payload

( Original text by malfind )

Emotet is a banking trojan, targeting computer users since around 2014. During that time it has changed its structure a lot. Lately we see massive emotet spam campaigns, using multiple phishing methods to bait users to download and launch a malicious payload, usually in the form of a weaponized Word document.

Emotet’s chain of infection

First user receives a…

Fixed Concept behind these four lines of tricky C code #dev #it #asnwer

Concept behind these four lines of tricky C code

Why does this code give the output C++Sucks? What is the concept behind it?

#include <stdio.h> double m[] = {7709179928849219.0, 771}; int main() { m[1]?m[0]*=2,main():printf((char*)m); }

Test it here.

Answer: Concept behind these four lines of tricky C code

Perhaps the easiest way to understand the code is to work through things in reverse.…

How to: Concept behind these four lines of tricky C code

Concept behind these four lines of tricky C code

Why does this code give the output C++Sucks? What is the concept behind it?

#include <stdio.h> double m[] = {7709179928849219.0, 771}; int main() { m[1]?m[0]*=2,main():printf((char*)m); }

Test it here.

Answer: Concept behind these four lines of tricky C code

It is just building up a double array (16 bytes) which – if interpreted as a char array –…

How to: Obfuscated C Code Contest 2006. Please explain sykes2.c

Obfuscated C Code Contest 2006. Please explain sykes2.c

How does this C program work?

main(_){_^448&&main(-~_);putchar(_%64?32|-~7[__TIME__-_/8%8][">'txiZ^(~z?"-48]>>";;;====~$::199"[_*2&8|_/64]/(_&2?1:8)%8&1:10);}

It compiles as it is (tested on gcc 4.6.3). It prints the time when compiled. On my system:

!! !!!!!! !! !!!!!! !! !!!!!! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !! !!!!!! !!…