Christian W (@_Wra7h) profile picture

Christian W

@_Wra7h

maldev hobbyist. glasses. mustache.

Joined October 2019
  • Tweets104
  • Following272
  • Followers651
I assume this has something to do with the cert not being included during hash generation for signing. So the underlying logic probably excluded the "DataDirectory[4].Size" amount of bytes starting from the cert offset when the call checks the modified dll - but could be wrong.
Image from Christian W (@_Wra7h)
1
3
240
Replying to @Octoberfest73
@Octoberfest73
Image from Christian W (@_Wra7h)
5
111
Replying to @vxunderground @MalDevAcademy @mrd0x
@vxunderground @MalDevAcademy @mrd0x
2
154
Replying to @VK_cyber_
@Valcan_K
1
74
Image from Christian W (@_Wra7h)
1
361
To start, I thought I needed a license for "MATLAB Compiler" to make a standalone executable and I was wrong. All I actually needed was the "MATLAB Coder" add-on to make an executable, mex, static lib, or dll. 2/?
Image from Christian W (@_Wra7h)
1
1
181
Replying to @PerS1541026
I wasn't worried too much about the thread handle at the time. Though I did just test/update the gist to call CloseHandle.
Image from Christian W (@_Wra7h)
1
218
vx-underground (@vxunderground) profile picturevx-underground
@vxunderground11 Sep 2023
We will gift free vx-underground swag to the first person to write malware in MATLAB. MATLAB supports invocation of WINAPI functions by invoking loadlibrary. - Must be open source - Windows ONLY - Code must work (compiled as .exe) - Basic malware, nothing fancy, no ransomware
Image from vx-underground (@vxunderground)
2
8
847
Matlab shellcode loader. ew.
Image from Christian W (@_Wra7h)
6
13
2
116
22,163
:|
Image from Christian W (@_Wra7h)
8
2,196
Load more