After looking into available source code from other IM-ME hacks [Joby] found how the SPI baud rate is set, then went to work searching for that in a disassembly of [Travis’] binary. Once found ...

Implant code for Windows systems was obfuscated with a tool called Marbler, a C++ application that obscures text strings and binary objects within implants in a number of ways. Those methods ...