Sept. 3, 2023, 5:37 p.m. | /u/0xd3xt3r

For [Blue|Purple] Teams in Cyber Defence www.reddit.com

During my journey into reverse engineering, I stumbled upon a valuable technique: partial binary emulation while dissecting the Mirai IoT Botnet. This malicious software utilized a custom algorithm to obfuscate both its configuration and all strings within it. As the malware executed, it dynamically decrypted these strings through a specific function.
As I delved deeper into the project, a thought crossed my mind: Could I decode all the obscured strings without having to run the malware itself? Was it possible …

algorithm analysis binary blueteamsec botnet configuration emulation engineering function iot iot botnet journey malicious malicious software malware malware analysis mirai partial reverse reverse engineering software strings

Product Regulatory Compliance Specialist

@ Avery Dennison | Oegstgeest, Netherlands

Cyber Security Analyst

@ FinClear | Melbourne, Australia

Senior Application Security Manager, United States-(Virtual)

@ Stanley Black & Decker | New Britain CT USA - 1000 Stanley Dr

Vice President - Information Security Management - FedRAMP

@ JPMorgan Chase & Co. | Chicago, IL, United States

Vice President, Threat Intelligence & AI

@ Arctic Wolf | Remote - Minnesota

Cybersecurity Analyst

@ Resource Management Concepts, Inc. | Dahlgren, Virginia, United States