Callfuscated: Reverse Engineering a Stack-Based VM Protected by MBA, Opaque Predicates and Call-Based Jumps
The HackTheBox challenge Callfuscated presents one of the most layered crackmes published on the platform, combining virtualization, Mixed Boolean-Arithmetic (MBA), opaque predicates and junk instructions inside a single binary.
Initial analysis shows hundreds of functions that appear to receive arguments through mysterious arg_* variables. Disassembly reveals that every call is immediately followed by a pop r8 instruction; the return address is discarded and only r8 is clobbered. Unicorn emulation of the entire binary confirms that r8 is never subsequently read, proving that each call-pop pair is a hand-written jump.
A lightweight Python script using Capstone walks the code, replaces the call opcode (0xE8) with jmp (0xE9) and overwrites the pop r8 bytes with NOPs. After patching, Ghidra produces a readable main function containing the characteristic dispatch loop of a stack-based virtual machine.
Each handler invokes a separate function protected by MBA. The author employs Triton to symbolically execute these routines and extract an AST for the return value in RAX. The resulting expressions, sometimes exceeding 7 000 characters, are fed to the CoBRA MBA solver, which reduces them to the original operations: addition, subtraction, multiplication, bitwise AND, OR and XOR. Two handlers that receive random values as arguments simplify to expressions that ignore those arguments, confirming the presence of opaque predicates.
With opcode semantics recovered, the author uses Unicorn again to dump the bytecode at the point where it has been fully initialized. A small C emitter translates the bytecode into ordinary C statements that operate on a 256-element stack. The generated file is compiled with optimizations and loaded into a decompiler, yielding a clean routine whose final comparison against zero determines whether the flag is correct.
Related articles
Backblaze Responds in Minutes While reg.ru Delays Action on Banking Trojan Infrastructure
A detailed reverse-engineering report reveals a sophisticated Android banking Trojan distributed via Telegram spam that disables antivirus apps, intercepts SMS one-time codes, and exfiltrates banking credentials. The malware uses AES-encrypted assets, a custom binary protocol over sockets, and multiple modules for screen streaming, keylogging, microphone access, and remote control. Infrastructure analysis traced the payload to an S3-compatible bucket on Backblaze, four command-and-control domains, and a VPS, with the domains registered through reg.ru. Notifications sent to Backblaze resulted in account termination within 11 minutes, while reg.ru responded only after a week with a statement refusing action without a court order. The same signing certificate appears across multiple variants, allowing rapid infrastructure rotation that keeps the campaign active despite takedown attempts. Kaspersky and CERT teams were also notified but produced no visible results within the observed period.
SLEEPWALKER Backdoor Activates on Windows via Single Custom Encrypted Packet
SLEEPWALKER is a passive Windows backdoor that stays dormant in memory until it receives one specially crafted encrypted network packet. Upon activation the implant decrypts and executes custom bytecode written in a proprietary 23-instruction language, eliminating traditional beaconing and reducing network indicators. The malware is delivered as a 64-bit DLL that impersonates dpapi.dll and is loaded via DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous and NullSessionPipes. Configuration is protected with AES-256-CCM and the sample contains no confirmed victims or attributed infrastructure. Researchers have released YARA rules and read-only scanning utilities to detect the implant and its artifacts.
SLEEPWALKER Backdoor Stays Dormant Until Triggered by Single Custom Network Packet
SLEEPWALKER is a stealthy Windows backdoor that remains inactive until it receives one specially crafted encrypted network packet. The implant then decrypts and executes custom bytecode from a proprietary 23-instruction language, enabling chained tasks, data movement, and in-memory code execution without prior outbound communication. The 64-bit DLL masquerades as dpapi.dll and is designed for DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw network traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes, and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous. No confirmed victims or attribution have been identified, and the analysis is based on a single sample. Researchers recommend auditing endpoints for unexpected dpapi.dll files alongside ERAAgent.exe and reviewing related registry settings.
AmnesiaStealer Malware for macOS Hijacks Authenticated Browser Sessions via ClickFix and Chromium
A new macOS malware strain named AmnesiaStealer has emerged that combines infostealing, persistence mechanisms, and the ability to silently take over already authenticated browser sessions. The infection chain begins with a fake GitHub page that tricks victims into copying a malicious command into Terminal using the ClickFix social engineering technique. Once executed, the Rust-based payload collects system data, displays a fake installer window to capture the user password, and attempts to unlock the Keychain for protected credentials. Targeted data includes browser cookies, history, extensions, documents, Apple Notes, Telegram sessions, and cryptocurrency wallet information. A secondary module copies the browser profile and launches a hidden Chromium instance controlled through the Chrome DevTools Protocol, allowing attackers to interact with active sessions that have already passed multi-factor authentication. Persistence is achieved via a disguised LaunchDaemon, and the malware attempts to remove installation artifacts afterward.