Loading story…
Reverse-engineering researcher Tim Blazytko published two complementary binary-analysis approaches aimed at speeding malware triage and firmware investigation. One method identifies likely API or otherwise central routines by ranking functions based on how many distinct callers invoke them, a heuristic designed for stripped or statically linked binaries where symbols and library boundaries are missing. In testing on Linux Coreutils ls, an ARMv8-M firmware image, a statically linked XOR DDoS sample, and PlugX malware, the technique surfaced memory, string, logging, cryptographic, and interrupt-related routines, and in PlugX highlighted an API-hashing workflow involving LoadLibraryA, a modified CRC32 routine, and resolution of GetProcAddress from kernel32.
Blazytko also released Obfuscation Detection v2.4, a Binary Ninja plugin that flags obfuscated or otherwise unusual code constructs to help analysts prioritize suspicious functions. The plugin uses heuristics to detect patterns such as state machines, cryptographic routines, string decryption logic, overlapping instructions, uncommon instruction sequences, recursive functions, functions without callers, high-entropy sections, and potential RC4 implementations, and it supports both GUI and headless use with JSON output for automation. Together, the releases provide architecture-agnostic techniques for identifying important code paths and obfuscation artifacts in malware samples and embedded firmware.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The GitHub repository for Obfuscation Detection v2.4 documented a Binary Ninja plugin by Tim Blazytko for identifying obfuscated code and unusual constructs in binaries. The documented heuristics included state machine, complex function, uncommon instruction sequence, overlapping instruction, and most-called-function detection, along with headless and JSON output support.
Tim Blazytko published a blog post describing a reverse-engineering heuristic that ranks functions by the number of distinct callers to identify important API-related routines in binaries. The post evaluated the approach on Linux Coreutils, XOR DDoS malware, embedded firmware, and PlugX malware samples.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Darktrace published a technical walkthrough of unpacking and analyzing **SnappyBee** (aka **Deed RAT**), a modular backdoor previously reported in China-linked espionage activity attributed to **Salt Typhoon** (aka *Earth Estries*). The write-up describes SnappyBee as typically deployed **post-compromise** to establish persistence and enable follow-on tooling (including **Cobalt Strike** and the **Demodex** rootkit), and highlights its use of a **custom packing routine** intended to obscure the payload and hinder static analysis. Zscaler ThreatLabz detailed **GuLoader**’s evolving **obfuscation** methods designed to evade detection and frustrate reverse engineering. Techniques described include **polymorphic “dynamic constant construction”** (building constants at runtime via instruction sequences like `mov`, `xor`, `add`, `sub`) and **exception-based control-flow redirection** that replaces normal `jmp` logic with deliberately triggered CPU exceptions handled by custom exception handlers (e.g., `0x80000003` `STATUS_BREAKPOINT`, `0x80000004` `STATUS_SINGLE_STEP`, `0xC0000005` `STATUS_ACCESS_VIOLATION`), complicating automated tracing and signature-based detection.
Jun 29, 2026
Palo Alto Networks Unit 42 detailed how analysts defeated anti-analysis protections in **BazarLoader**, a Windows backdoor linked to multiple ransomware operations, to accelerate reverse engineering and expose its behavior. The research focused on two obfuscation methods in a BazarLoader sample: API function hashing that concealed Windows API calls and opaque predicates that distorted control-flow analysis and decompilation. By reversing those protections, analysts were able to recover hidden functionality and better map the malware’s execution path. The team used **IDAPython** with IDA Pro’s Appcall feature to invoke BazarLoader’s own API-decoding routine during debugging, automatically recover dynamically resolved API names, and annotate calls. They also identified and patched opaque predicates so dead code blocks were removed and decompiled output became clearer. After applying those techniques, the researchers identified behaviors including **code injection** and determined that one heavily obfuscated routine acted as a wrapper for `GetModuleFileNameW()`, with accompanying GitHub-hosted scripts provided to automate API deobfuscation and opaque-predicate patching.
Aug 14, 2026
Researchers published proof-of-concept tooling to deobfuscate **Nymaim** malware, showing how analysts can recover cleaner code and improve reverse engineering in **IDA Pro**. One GitHub project, **Nymaim deobfuscation**, uses **miasm** for emulation and **grap** for graph-pattern matching to identify and patch common Nymaim obfuscation routines such as `push_reg`, `detour_call`, and `detour_jmp`, then generates an IDA script to rename functions and produce a cleaned sample. A related Bitbucket project, **Patchwork**, was built to demonstrate malware deobfuscation against the same malware family inside IDA using a modified **PyEmu** engine. The author described upgrades including stronger memory management, better support for uncommon x86 instructions, and a Python 2.7-compatible rebuild of **pydasm**, alongside setup guidance for loading Nymaim samples and running the deobfuscation workflow, underscoring a broader effort to automate analysis of heavily obfuscated Nymaim binaries.
Aug 15, 2026