Jesko Hüttenhain

@rattle@infosec.exchange
109 Followers
27 Following
95 Posts
Too much technology, in too little time.
My Homepagehttps://huettenhain.net/
Binary Refineryhttps://github.com/binref
Me on BlueSkyhttps://bsky.app/profile/rattle.im

“Oh. Oh, no”

“What?”

“I think this is a simulation.”

“What is?”

“THIS. Everything. The universe. Us.”

“What, like _The_Matrix_?”

“Yea, but not as trans.”

“Wait, the Matrix is trans?”

“Where have you been. Anyway, Simulation panic!”

“How can you tell?”

“I’m thinking about aliens. Like, if you were trying to communicate science to another planet, how would you deal with measurements. Meters and seconds and yes even your goddamn inches are based on properties of the Earth, aliens aren’t gonna know the circumference of the planet or the length of its day or the diameter of some president’s brain. So how do you talk about the mass of the proton or the speed of light or the hubble constant in a way that aliens can recognise?”

“I dunno, there must some natural unit system that is based on a common property of space that we can both derive…”

“You’re on the right track. Forget about Meter Kilogram Second or Furlong Firkin Fortnight and convert to Planck Proton Periwinkle or whatever. So I started trying to come up with the One True Unit system.”

“And did you?”

“Duh. Yes. It uses the fine structure constant and the strength of the electromagnetic force and the planck interval that inevitably derives from the uncertainty principle.”

“You think that’s obvious?”

“Once you get into this headspace, yes. So i started making a cheat sheet of all the key parameters of the universe in my OTU system. That’s where it turned ugly…”

“Ugly how?”

“The speed of light in this system is 2³¹-1”

“Oh. Oh, no.”

#Tootfic #MicroFiction #PowerOnStoryToot

Good news, the intermediate malware analysis course is almost finished.

I have currently a test student working through the course to get rid of mistakes that I do not notice.

The course will not be hosted on Udemy. I am very unhappy with it.

The Beginners' course will also be moved to the new platform.

So #BinaryRefinery 0.8.25 is out with support for the latest Inno Setup installer files, but more importantly the repo has 4000 commits!!

Tips for newcomers to malware blog articles:

➡️You don't need to document every malware function. Focus on key areas
➡️Your text must be factually correct and it is okay to skip those details you are unsure about
➡️When you are done, just stop writing

Regarding the last point:

A conclusion makes sense if you have something to add that wasn't there before.

But if you just repeat what you wrote before, it is very boring. In those instances it is better to not add it at all. A blog is not a thesis.

@SebastianWalla, Steffen Haas, @tillmannwerner, and myself will present a .NET instrumentation framework tomorrow at @recon 2025 in Montreal. Here's a humble brag sneak peek demo-ing how easy it is to write a function tracer!
A colleague and me wrote an article about EvilConwi -- signed ConnectWise remote access software being abused as malware
#GDATATechblog
https://www.gdatasoftware.com/blog/2025/06/38218-connectwise-abuse-malware
Threat Actors abuse signed ConnectWise application as malware builder

Since March 2025, there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. We reveal how bad signing practices allow threat actors to abuse this legitimate software to build and distribute their own signed malware and what security vendors can do to detect them.

We (Steffen Haas, Sebastian Walla, Lars Wallenborn, and Yours Truly) built a dynamic binary instrumentation framework for .NET that gives malware analysts the power of transparent assembly patching at runtime, invisible to the target. With just a few lines of C#, reverse engineers can write their own custom analyzers that instantiate an instrumenter for the heavy lifting, allowing them to focus on the task at hand. We are excited to present our work at @recon next week: https://cfp.recon.cx/recon-2025/talk/PDBLYM/
Breaking Obfuscated .NET Malware with Profiler-Based Dynamic Binary Instrumentation Recon 2025

As malware authors increasingly adopt .NET for its ease of development and stability, they rely on sophisticated obfuscation techniques to thwart analysis. Traditional static deobfuscation approaches often fail against modern protections that incorporate runtime integrity checks. This presentation introduces a framework that leverages .NET profilers to perform dynamic binary instrumentation at the MSIL level. We demonstrate how this approach can bypass dynamic checks in obfuscation schemes, extract encrypted strings, and trace execution flows—all without modifying the original binary. Through real-world case studies and live demonstrations, we show how this technique provides reverse engineers with a powerful new tool to analyze obfuscated .NET malware.

https://github.com/alexander-hanel/pwinfected

For anyone else tired of having to start a VM to download a file.

GitHub - alexander-hanel/pwinfected: 7zip Password Protect File in Memory

7zip Password Protect File in Memory. Contribute to alexander-hanel/pwinfected development by creating an account on GitHub.

GitHub

I just pushed out #BinaryRefinery v0.8.24 which fixes all the issues I encountered during my recent live stream =D.

The main problems were caused by running an old version of pip in WSL, which caused an old version of LIEF to be installed, hence failing to parse executable formats. The 'solution' is to add a stricter version requirement for LIEF and improve the documentation to include a pip update.

Finally, I have finally fixed the annoying issue that I ran into on the stream with passing arguments to path extractor units that match a file on disk. Starting with v0.8.24, these arguments will no longer read file contents by default.

I will be doing a live stream [stream] later today, kindly hosted by the amazing Dr. Josh Stroschein! I will be using #BinaryRefinery to replicate an analysis that Josh previously presented [source], of a download chain going from exploit document all the way to the AgentTesla payload itself.

[stream]: https://www.youtube.com/live/HuLONk0Rt98
[source]: https://www.youtube.com/playlist?list=PLHJns8WZXCdvfqIp9m0kkjsbg9G8YWdSH

Unraveling a Multi-Stage Downloader with Binary Refinery - Guest Jesko Hüttenhain

YouTube