Loading story…
A reverse-engineering walkthrough showed how Ghidra can be scripted to automatically recover obfuscated strings from Amadey 1.09, replacing repetitive manual analysis with automated annotation inside the disassembler and decompiler. The script targets the malware's __Z8aDecryptPc routine, reproduces its repeating-key subtraction logic in Java, identifies references to the function through Ghidra's decompiler and P-code APIs, and then writes recovered plaintext back into the project as comments and bookmarks.
The published results indicate the workflow decrypted 47 strings, reused 11 cached values, added 210 comments, and created 47 bookmarks in about 16 seconds, illustrating how scripting can accelerate malware triage. The approach aligns with earlier Amadey string-decryption tooling built for IDA Pro/Hex-Rays, including a Python script that extracts encrypted operands, derives a key, decrypts strings, and annotates disassembly, showing that analysts are increasingly codifying Amadey deobfuscation across multiple reverse-engineering platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A public GitHub repository shows the file "Amadey/amadey_string_decryptor.py" with the latest commit labeled "update." The repository view dates that commit to Aug. 24, 2023.
The article notes the walkthrough used a Ghidra build from December 21, 2020, described as slightly ahead of Ghidra 9.2.1.
The analyzed article states that the U.S. National Security Agency released Ghidra as a free and open-source reverse engineering tool on March 21, 2019.
The Max Kersten article says the Amadey sample it analyzes was the unpacked stage originally referenced from a KrabsOnSecurity blog post in February 2019.
Max Kersten published a technical walkthrough showing how to build a Ghidra Java script to automatically decrypt and annotate encrypted strings in an Amadey 1.09 sample. The completed script reportedly decrypted 47 strings, reused 11 cached results, placed 210 comments, and created 47 bookmarks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
maxkersten.nl
Open sourcegithub.com
Open sourceghidra-sre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers published proof-of-concept tooling to deobfuscate **Nymaim** malware, showing how analysts can recover cleaner code and improve reverse engineering in **IDA Pro**. One GitHub project, **Nymaim deobfuscation**, uses **miasm** for emulation and **grap** for graph-pattern matching to identify and patch common Nymaim obfuscation routines such as `push_reg`, `detour_call`, and `detour_jmp`, then generates an IDA script to rename functions and produce a cleaned sample. A related Bitbucket project, **Patchwork**, was built to demonstrate malware deobfuscation against the same malware family inside IDA using a modified **PyEmu** engine. The author described upgrades including stronger memory management, better support for uncommon x86 instructions, and a Python 2.7-compatible rebuild of **pydasm**, alongside setup guidance for loading Nymaim samples and running the deobfuscation workflow, underscoring a broader effort to automate analysis of heavily obfuscated Nymaim binaries.
Aug 15, 2026
Researchers and malware analysts documented how **Garble** obfuscation is complicating reverse engineering of Go-based malware, particularly around stripped function names and runtime string reconstruction. Walmart Global Tech described a proof-of-concept for recovering Go standard library functions by matching bytecode sequences instead of relying on `.gopclntab`, while Mandiant detailed how Garble's string transformations split and encrypt data into randomized state-machine logic that is rebuilt and decrypted at runtime. OpenAnalysis separately highlighted a Garble-protected Windows stealer sample whose recovered artifacts pointed to credential theft, wallet targeting, anti-analysis checks, and exfiltration activity. A recent analysis of **Amatera Stealer** showed the operational impact of those techniques in the wild: a 32-bit Delphi loader retrieved and launched a heavily obfuscated Go third-stage payload, initially misleading analysis because Garble protection made strings and logic difficult to interpret. The analyst later determined the sample likely used Garble without literal encryption, with strings still present but constructed dynamically at runtime; recovered behavior included persistence via a scheduled task for `shark.exe`, plus network indicators tied to the malware's infrastructure and a DNS lookup for `data-seed-prebsc-2-s1.binance.org` resolving to `109.172.87.40`.
Aug 15, 2026
Researchers and government analysts documented how **Emotet** hides its functionality through API hashing, dynamic API resolution, string encryption, junk code, stack tricks, and control-flow flattening, complicating reverse engineering of unpacked samples with empty import tables. Sophos reported that, across 254 examined functions, 68 used flattened control flow; researchers fully unflattened 38, partially restored 19, and failed on 11 while adapting IDA-based tooling to handle multiple dispatchers and other edge cases. Technical work from JPCERT/CC and open-source tooling showed that analysts can automate large parts of Emotet analysis with **Ghidra** and Binary Ninja plugins, including annotating hashed APIs, decrypting strings, and extracting hardcoded command-and-control endpoints from internal configuration data. ANSSI described Emotet as a **malware-as-a-service** platform operated by **TA542**, spread largely through phishing, malicious Office attachments, thread hijacking, compromised WordPress sites, and direct IP-based C2, and linked it to downstream payloads including **TrickBot**, **QakBot**, **Dridex**, **Conti**, and **Ryuk**.
Aug 15, 2026