// session active :: [email protected] // cogito ergo sum et memento mori
 ▄████▄  ▄▄▄█████▓ ██▀███   ██▓    ▓█████   ██████  ▄████▄  
▒██▀ ▀█  ▓  ██▒ ▓▒▓██ ▒ ██▒▓██▒    ▓█   ▀ ▒██    ▒ ▒██▀ ▀█  
▒▓█    ▄ ▒ ▓██░ ▒░▓██ ░▄█ ▒▒██░    ▒███   ░ ▓██▄   ▒▓█    ▄ 
▒▓▓▄ ▄██▒░ ▓██▓ ░ ▒██▀▀█▄  ▒██░    ▒▓█  ▄   ▒   ██▒▒▓▓▄ ▄██▒
▒ ▓███▀ ░  ▒██▒ ░ ░██▓ ▒██▒░██████▒░▒████▒▒██████▒▒▒ ▓███▀ ░
░ ░▒ ▒  ░  ▒ ░░   ░ ▒▓ ░▒▓░░ ▒░▓  ░░░ ▒░ ░▒ ▒▓▒ ▒ ░░ ░▒ ▒  ░
  ░  ▒       ░      ░▒ ░ ▒░░ ░ ▒  ░ ░ ░  ░░ ░▒  ░ ░  ░  ▒   
░          ░        ░░   ░   ░ ░      ░   ░  ░  ░  ░        
░ ░                  ░         ░  ░   ░  ░      ░  ░ ░      
░                                                  ░
--------------------------------------------------------------------------------
// cogito ergo sum && memento mori | cybersecurity engineer :: security researcher :: amateur radio op
--------------------------------------------------------------------------------
[home] // [blog] // [writeups] // [hardware] // [software] // [tags] // [about]

memory_leak

--------------------------------------------------------------------------------

can it happen with a closed mind?

// memcpy() >

don’t be so opened minded that your brain falls out.

i just finished reformatting two of my main machines with arch linux. i’ve been spending most of my time configuring shit, so i haven’t had much time for anything else.

// malwarez >

i downloaded a js file the other day that ended up being an extremely obfuscated qakbot dropper. i wanted to keep it to try deobfuscating it to see what it was ultimately doing, but i felt like i didn’t have the time. aside from that, stupid defender ate it, so i lost the file and couldn’t remember where i downloaded it from. i definitely won’t miss out on another opportunity to de-obfuscate and analyze something like that again.

qakbot_dropper

i made a malware repository to keep any samples i come across archived. you can find that here: malwarez

at some point, i’ll get around to deobfuscating this thing to pull some info out of it. for now, i just created a separate branch in the local repo so i can have a look at it.

// block_list >

i created a blocklist for pihole. these are just random domains that i have come across and decided to block becasue they are likely malicious.

check the repository out here: pihole blocklist

i’ll continue to update this list as i come across more malicious domains.

// eof >

i’ll keep this one short and sweet.