We added support for detecting executables ciphered with bitwise shift ciphers - ROR (shift right) and ROL (shift left) which was first reported from a sample from Mila's blog (contagiodump). Bitwise shifts are similar to multiple or division by 2's. This sample used a shift left of one position (rol 1) along with a 256byte XOR key.
Posts
Update: format-bytes.py Version 0.0.11
-
As announced in my previous blog post, this new version of format-bytes.py
adds a pack expression (#p#) and other features and (Python 3) bug fixes. A
pack...
6 hours ago
No comments:
Post a Comment