Amethyst Basilisk

God the VShell crew is constantly updating their Go payload loader. Makes me annoyed since I was so accustomed to their current loader.

Seeing a significant uptick in VShell campaigns on MalwareBazaar. I think I see an opportunity to report on this malware family!

I'm happy to report that after my recent spat of MS attacks I can use chopsticks again! @Mirage@vulpine.club made ramen and it was tasty.

Major headway! I found the bootstrapping function where it eventually transfers to the pure Go routine. Now to find where it stored the pclntab.

Has anyone else seen this before? Shellcode written in CGo that bootstraps a Go environment. I'm struggling to reverse the loader because I'm not very well versed in Go reversing. And before you ask, GoReSym is failing too! #malware #malware_analysis

VShell is fucking with me. It loads a position-independent shellcode with Go artifacts that loads from the DOS header that's also a valid PE file. I think it loads its Go runtime in the shellcode loading process. This is fun, but confusing!

Puppy was wagging his little nub while I was making coffee, then leaned against my leg. I don't know why, but I appreciate the show of affection!

Just saw Hard Candy for the first time. That is a very cathartic movie for a certain audience. I loved it.

Last night's brain vibes were so bad I felt no interest in studying malware. That's like my whole thing and I just felt nothing for it. Just went to bed. Truly bad vibes last night.

I'm doing actual reverse engineering and I'm getting mad at my depression for telling me I can't do it. I can clearly do it, I won an award for completing a Flare-On competition! Fuck depression so much, it's a dirty liar.

Getting really tired of this depression. I hate getting pangs of negative thoughts and a lack of motivation to do anything constructive. I need to ask my psychiatrist for an adjustment.

Do I look at Phorphiex next or DarkTortilla? DarkTortilla is calling out to me because of it's funny name.

Recruiter just informed me the biggest problem he sees is filtering out the real candidates. So on top of having to deal with ATS, the roles are flooded with AI fake candidates. Fuck AI, man.

Gonna try freelancing, see if this leads to anything. Got a nasty virus and wanna know what it does? I'm offering my services for cheap to gain rep! https://www.upwork.com/services/product/2043959850762621529?open-share=1&frkscc=DBvPPUX5YAoT

I've used Claude for a significant project while I'm disabled with an MS attack. While it is impressive, you lose a lot of the joy of coding and the memory retention you would get from coding it yourself. Reviewing diffs is not enough. AI haters win this round.

Happy trans day of visibility. If you havent figured it out yet (I am quiet about it), I am trans.

Just applied for an infosec teaching role. With my ATS-fighting fu, I hope to hear back. Fingers crossed!

My partner is cooking corned beef in the crock pot and it smells like White Castle burgers. It's fucking with me.

Redline stealer is more sophisticated than I knew. The tech involved with unraveling to its packed .NET code was entertainingly formiddable, last time I had this much fun reversing malware was when I was taking apart SmokeLoader.

I'm so tired of applying to jobs and hearing nothing back. I feel like a bad candidate for everything. Very demoralizing.

Security analysts aren't getting paid enough, from all the jobs I've looked at. It's an important SOC job that deserves better pay!

Rereading the article I wrote for Phrack, I'm actually pretty proud of it. VX and good build practices in C. Read it here: https://phrack.org/issues/71/9_md#article

Paying off medical debt is so bittersweet. It's not an accomplishment, it's an albatross being finally released from your neck. Fuck this country so much,

If I didn't have antipsychotics this would fuck with me. My torrent tracker has been uploading high quality torrents of movies my partner suggests after we've already downloaded them. They even have one pinned to the top not a day after we finally watched it. This is like the Google effect man.

There's nothing more disappointing when you're taking an eLearning course and they only have videos for you to watch. My kingdom for a course that will let me fucking read.

I have been won over by Claude code. You'll never sell me on ignorance-driven vibe code, but it's really helpful for finding and solving subtle bugs. It's like having a pair programming buddy.

Trying out the whole vibe coding thing with local LLMs. If you don't pay enough attention to the diffs, it'll sneak bugs past you. I can see it's usefulness, but I can't imagine using LLMs without knowing how to code originally.

We are watching a playthrough of Double-D dinosaur on Twitch. We did a doubletake because the double D dino looks like my character. It's a funny dating sim.

Report sent off to the requester, I wouldn't be surprised if they requested a deeper dive into some stuff since I couldn't get to some parts because my .NET analysis-fu is kind of weak and could use some exercise, but ultimately I think the report is useful for remediation of infection.

That story about the FBI getting hacked just reminds me of how they run for profit pedosites as "stings" for longer than they really need to. There's seriously some corrupt pedo shit at the heart of our government. Crazy to think about.

I have never seen a shellcode payload with such a huge ass fucking nop sled. I think it's to make room for packed code? No idea, it's late.

The one thing I like about steroid infusion treatment for MS-- beside the healing properties-- is the optimism side effects. A role opened up in the Bay Area that's perfect for me and a recruiter is gunning for me for. I think we're gonna be okay.

Does anyone know where a furry shitpost drawing is? It features a headshot of a dog with a collar that says "dog," then a dog without a collar that says "naked dog." I worry what might come up if I search Google Images for these search terms.

Massive refactor of exe-rs in the works to deal with the new undefined behavior bug introduced by Rust 1.94. It was an unaligned mess and needed fixing.

Jesus, thank God for LLMs, I wouldn't know if my generated resume was passing ATS without it. Fuck ATS though, pissed all my applications were going into a black hole.

Finally saw Blackhat. I don't remember why hackers were salty about it, it was a solid hacker thriller!

It's very demoralizing that recruiters are harassing me for this Android malware role, I keep applying through them, then never hear back. It's happened multiple times now. I told the recruiters I'm not qualified for Android and I think the client knows that too. Everyone's time is getting wasted.

With multiple sclerosis, you will sometimes be amazed when you manage to type a password correctly. Can't wait for them to figure out how Epstein-Barr causes it.

The torrent tracker I use actually uploaded the RiffTrax-infamous Fungicide. Only 480p. I think they air it in higher quality on RiffTrax lol

Getting back to doing actual reverse engineering is like giving myself whiplash from the sudden speed change from just detonating samples in a sandbox and analyzing logs that come from it. I miss the reversing part though! Taking apart DonutLoader samples.

Disappointed to discover the new show CIA is just coppaganda. Should have figured since apparently Dick Wolf is behind it. Season 2 of The Agency can't come fast enough.

Updated my copy of GoReSym, magically recovered more obfuscated symbols. Here I was banging my head against the wall because it kept saying it couldn't find the pclntab. I guess Mandiant is looking at the same malware I was!

A recruiter ghosted me this morning after waking me up early to await her call. I can see why my partner hates them so much right now.

The lingering side effects of the corticosteroids have me questioning if I'm a good reverse engineer. Apparently in the come-down cognitive side effects are apparent, hence why I've been having a hard time reversing. Apparently this will clear up eventually, but I need to attract businesses!

Feeling incredibly depressed right now. Oral corticosteroids are not like the euphoric infusions.

Failed someone in helping them out with malware because I don't know how to deobfuscate Java. Feels bad man. At least I have a sample to learn from.

Hmm... ValleyRAT started getting wise to sandboxing and is querying Direct3D for the video card. I don't want to migrate my sandbox to my media center that has a video card, but I might have to eventually.

Oh. The GHOUL log. Like a Yule Log. I thought it was a movie. Well I guess we have something Fallout themed for the holidays now.

God, why did I apply for a Forensics job? I barely remember forensics from my training! I need to brush up with LetsDefend challenges.