Security Researcher | YARA-Rules for @malpedia using YARA-Signator
Bonn, Germany
Joined September 2015
- Tweets111
- Following553
- Followers312
- Likes870
Felix Bilstein retweeted
I've been happily and productively collaborating with @radareorg and the team for a while now, and I'm excited to announce that **r2xsql is finally live!**
R2 was already incredibly feature-rich and AI-friendly, but now you can also let your AI agents interact with R2 databases using SQL queries compatible with the xSQL family (like IDASQL, GhidraSQL and Binary Ninja SQL)
github.com/radareorg/r2xsql/
Huge thanks to @radareorg and the team for this opportunity!
Felix Bilstein retweeted
💀 DEATHCon Bonn, 13-14 Nov at Fraunhofer FKIE in Bonn, Germany: two days of hands-on detection engineering and threat hunting workshops (YARA, NetBIOS pivoting, Graph API hunting, and more). Regular tickets end Fri 16 Oct and only a few are left!🎟️ eventbrite.de/e/deathcon-bon…
Felix Bilstein retweeted
Hello Scotland 🏴
The Phrack team was also there, same rules: Send proof to [email protected] for a chance of getting a Phrack 73 copy!
Two of the locations might be quite challenging.
And for the ones that found the stickers in London: we got your email and we will get in touch when Phrack 73 officially lands to send you a copy :)
Felix Bilstein retweeted
GhidraSQL 0.0.4 is out with tons of bug fixes
github.com/0xeb/ghidrasql
Felix Bilstein retweeted
Slides are out. Please grab them from here: github.com/allthingsida/allt…
Felix Bilstein retweeted
This is it folks! This is the last weekend to submit a DEATHCon workshop CFP proposal if you want to get in the first round of acceptance! We've got a lot of great submissions already but there's room for yours too! deathcon.io Click on CFP. Conf can pay for travel!
Felix Bilstein retweeted
I have just published a new data set revision of MalpediaFLOSSed, now aggregating 5.6m unique strings gathered from 2.100 malware families. github.com/malpedia/malpedia…
Felix Bilstein retweeted
I have spent way too much time on writing this #GootLoader JS unpacker and C2 extractor with abstract syntax tree manipulation. 🌳
But I could not stop at having it half done and this malware has 6 layers.
I am sorry for the terrible code.
github.com/struppigel/hedgeh…
Felix Bilstein retweeted
Awesome project by malpedia creator @push_pnx presented at VB2023
Applied one-to-many code similarity analysis using MCRIT
Talk:
youtube.com/watch?v=CMu1r5Ih…
Felix Bilstein retweeted
Extractor updated 🎉 Should now support recent #DarkGate samples and can dump complete config and strings. Still some more Ghidra sessions needed to find out what all the new flags do 😂 github.com/telekom-security/…
Felix Bilstein retweeted
I wrote a blog on new features in the IDA plugin for MCRIT, most notably being able to query basic blocks or the whole currently viewed function against a dataset like Malpedia in mere seconds, making it viable as a live companion while analyzing malware.
Felix Bilstein retweeted
As a follow-up to my previous response, I have now started populating another Github repo with ready-to-use reference data: github.com/danielplohmann/mc… I'm currently running automated extraction for all available MinGW versions and back-process my MSVC symbols for a first milestone.
Felix Bilstein retweeted
I wrote a tool to find #YARA matches in #Ghidra using #Ghidrathon and Python, get it here! 👇
gist.github.com/c3rb3ru5d3d5…
Felix Bilstein retweeted
I wrote a short blog post on MCRIT, the one-to-many code similarity analysis framework that we released as open source recently at @Botconf.
[blog post] MCRIT: The MinHash-based Code Relationship & Investigation Toolkit
danielplohmann.github.io/blo…
Felix Bilstein retweeted
We live in the automation era, recently I played with one of my favorite tools @radareorg main developers Mr. @trufae to automate the #malware analysis using it with @OpenAI
Felix Bilstein retweeted
After years of hard work, we finally open-sourced Wattson, our research testbed for investigating and analyzing the effects of cyberattacks on power grids: github.com/fkie-cad/wattson
Kudos to @bader_lennart and team @RWTH @Fraunhofer_FKIE @Fraunhofer_FIT
