Morse Code in Malware Analysis
 

Morse Code in Malware Analysis

The study of Morse code in malware is an in-depth exploration of obfuscation techniques within malicious software development. This research delves into how Morse code, a method traditionally used for telecommunication, is repurposed to conceal the true intent and functionality of malware. This repository includes two primary programs: one designed to encode strings into Morse code for obfuscation purposes and another to demonstrate the application of these obfuscated strings within an actual binary executable.

Components of the Repository
Morse Code Encoder

The first program in the repository is an encoder that transforms plain text strings into Morse code. This obfuscation process converts readable text into a sequence of dots and dashes, making it difficult for standard security tools to detect and analyze the malware’s payload. The encoder’s functionality can be summarized as follows:

• String Conversion: Converts input strings into Morse code, using predefined mappings of characters to Morse symbols.
• Obfuscation: Enhances the complexity of the malware, thus evading detection mechanisms by converting critical strings and commands.
• Customization: Allows for customization of Morse code representations to obfuscate the patterns used further, adding an additional layer of complexity for reverse engineers.

Binary Integration Demonstrator

The second program in the repository is a demonstrator that showcases how these obfuscated Morse code strings can be embedded and utilized within a real binary executable. This program serves to illustrate the practical application of Morse code obfuscation in a malware context:

• Embedding Morse Code: Integrates the obfuscated Morse code strings directly into the binary, replacing original strings or commands.
• Decoding Mechanism: Includes a runtime decoder that translates Morse code back into its original string form during execution, allowing the malware to function as intended while maintaining obfuscation during static analysis.
• Execution Flow: Demonstrates how the malware remains functional by decoding necessary components only at runtime, effectively bypassing many static analysis tools.

The Site: https://github.com/aiooord/mim

EXPANDING FURTHER ON THIS...
Our old site was taken down but a NEW SITE AGAIN IS A MUST!!!

I am excited to announce my upcoming new Communications Protocols Reverse Engineering Site, a destination where the elegance of signal, the mystery of transmission, and the art of decoding come together.

At its heart will be a rich exploration of Morse — Morse in history, Morse in practice, and Morse as a living symbol of human stubbornness. Visitors will discover detailed dissections of historic and obsolete protocols, with Morse given special attention through carefully curated articles, archival material, and fascinating historic YouTube videos that capture the beauty, discipline, and occasional goof-ups of Morse.

This site will celebrate Morse not only as a code, but as a cultural artifact — a language of dots and dashes that shaped communication across generations. From remarkable breakthroughs to amusing mistakes, from classic Morse transmissions to rare recordings and insightful breakdowns, the project will offer a fresh and attractive perspective on Morse for enthusiasts, researchers, and the simply curious alike.

Beyond Morse, the site will also venture into reverse engineering of other communication systems, including 5G and 6G, and experimental protocols such as moo-id, a Morse-like equivalent designed to identify and communicate with cattle, echoing the “moo” in its name. It is a tribute to how signal, meaning, and identity can be expressed across wildly different worlds.

Whether you are drawn to the discipline of Morse, the charm of Morse’s historic legacy, or the unexpected delight of moo-id, this site promises to be a vibrant hub of discovery.

Nice troll post for a repo on the eve of dying.

aiooord/mim — "Morse Code in Malware Analysis": a review

Repo: https://github.com/aiooord/mim

I pulled the repo. Here's the demolition.

The code is 30 lines and two lookup tables

Excluding the alphabet maps, the entire "research" is: a for loop that concatenates map lookups, and a while (stream >> word) loop that concatenates map lookups in reverse. That's it.

The README is roughly 700 words of prose about "in-depth exploration", "research implications" and "advancing cybersecurity defenses", attached to a program a first-semester student writes as a homework exercise. The ratio of grandiosity to substance here is the single most damning thing in the repo.

The premise is wrong

Morse is not obfuscation. It's a public, keyless, fixed substitution over a two-symbol alphabet. There is no secret. Anyone who sees ^.-.. ^.... ^.- knows immediately what it is.

And it's actively worse than doing nothing. A binary containing long runs of . - / ^ and spaces is a statistical scream. Plaintext strings at least drown in the millions of plaintext strings every binary contains; base64 blobs are ordinary background noise. A Morse-alphabet run is a fingerprint you could match with a two-line regex at essentially zero false-positive rate across all legitimate software.

This scheme loses to plaintext, loses to base64, and loses to single-byte XOR — the laziest technique in existence — on size, on conspicuousness, and on having a key.

Then it ships the key inside the binary

usage/morse_decoder.h embeds g_ReverseMorseCodeMap as a static array of literal ".-", "-...", "--.-" strings in the data section.

The README claims this "bypass[es] many static analysis tools." Your own second program refutes your first program's thesis: a reverse engineer sees the complete decode table before they see anything else. You handed them the answer key and stapled it to the test.

The README describes features that don't exist

There is no customization. The map is a const global initialized inline in a header. Changing it means hand-editing two files and manually keeping them in sync. No key, no flag, no config, no seed. That bullet point is simply false.

It is a main() that prints the author's name. No payload, no API resolution, no C2 string, no dynamic imports:

Naming that a "Demonstrator" is résumé inflation.

Actual bugs

• Silent, destructive data loss. The encoder map has zero punctuation. Encode http://evil.com/a.php or C:\Users\x and it silently drops : / . \ and hands back corrupted garbage — no error, no return code. The exact strings this tool exists to hide are the ones it destroys. decode(encode(x)) != x for essentially every realistic input.
• Infinite loop on EOF. ./encoder < /dev/null spins forever: getline fails, input stays empty, != "exit" is true, print, repeat. The only exit path is typing the literal word "exit".
• Two independently hardcoded copies of the alphabet, one per direction, with nothing generating one from the other and no round-trip test. You couldn't keep two tables in sync in a 30-line project.
• const map at namespace scope in a header — internal linkage, so a separate dynamically-allocated unordered_map is constructed at static-init time in every translation unit that includes it. Invisible at this size; a real bug at any other.
• find() then .at() — double hash lookup. Twice. In both halves of a 30-line codebase.
• Neither header includes <string>; both rely on transitive includes. exit(0) skipping destructors. Unused argc/argv. No CLI mode, so it can't be scripted into a build — the only way you'd actually use it.

Engineering hygiene

Windows-only .sln/.vcxproj for code that is pure ISO C++ with no platform dependency. No CMake, no Makefile.

.vcxproj.user files — per-developer local state — committed to version control, while the .gitignore is an untouched generic template covering *.o and *.mod (Fortran, in a C++ repo) but not .vs/, Debug/, or the .user files actually present.

No tests, no CI, no releases. Apache-2.0 on thirty lines.

It isn't research

No methodology. No experiment. No detection-rate measurement against any scanner. No comparison to any other encoding. No threat model. Not a single number appears anywhere in the repository.

And it never cites the 2021 Morse-encoded phishing campaign that is the entire reason anyone briefly cared about this technique — "research" that doesn't cite the incident it's studying is a blog post with delusions.

The README's cadence — "delves into", "sheds light on", triadic bullets, a Conclusion section for a program with two functions — reads as machine-generated filler. That's the real problem: someone spent more effort generating prose about the artifact than building the artifact, and the prose makes claims the artifact contradicts.

I know... I know... The existing repo is SUCH a pity, right??? Good that the repo is not mine! :D :D :D

That is why as mentioned in the "EXPANDING FURTHER ON THIS..." section in my post above, a brand new reversing site is coming up soon!

At last, a new site is approaching that will not merely be visited, but awaited. This is the kind of release that will command attention from the very first light of morning until the final glance before sleep, the sort of destination people will return to again and again throughout the day, unable to resist checking for the next reveal. Every update will feel like a pulse of excitement, every refresh a moment of mounting suspense, every visit a step closer to something extraordinary.

Prepare yourself for the brand-new Morse Code Analysis Reverse site, a project wrapped in anticipation and buzzing with promise. It is set to become a daily obsession, the first tab opened and the last one closed, the source of countless eager return visits and breathless speculation. And as if that weren’t enough, there is also a fascinating bonus to uncover: a glimpse into the experimental cattle communications protocol, moo-id, an unusual and intriguing detail that only adds to the mystery and allure.

Something remarkable is coming. Stay alert, stay curious, and keep checking back because this is one launch you will not want to miss.

There was a good reason you were banned. You are not making any progress anywhere though. I alwaysfind you and bring you down. Bring you down to China town. Your shenanigans are over. Go waste more time and money being a vindictive trollish buffoon though. We will see how far it gets you.

??? What do you mean??? Chinatown?
I know that YOU got banned 3 times for a week each every year the past 3 years though.


Getting back on topic. This is a paper worth mentioning:

MoRSE: Task-Oriented Multi-Agent System with Mixture of Role-Subtask Experts

Large language model-based multi-agent systems have recently shown strong potential for complex, long-horizon tasks. However, existing methods mainly rely on coarse prompt-level differentiation without parameter adaptation for diverse subtasks, resulting in insufficient inter-agent heterogeneity and limited specialized capability that bottleneck performance on tasks with complex requirements. To address this, we introduce a Task-Oriented Multi-Agent System with Mixture of Role-Subtask Experts (MoRSE) that distinguishes agents with (role, subtask)-conditional specialization at both the task structure and parameter levels. To make agents' responsibility explicit at the task structure level, we formulate a task-oriented multi-agent system that decomposes each task into a dependency-aware Directed Acyclic Graph of subtasks and assigns each agent a specific (role, subtask), introducing task-level specialization across collaborating agents. Additionally, to address the diverse role and subtask parameter adaptation demands, we propose a dynamic Mixture of (role, subtask) LoRA Experts module with a prototype-based semantic router for subtasks, augmenting agents with parameter-level specialization on a shared LLM substrate cost-effectively. Then, to co-optimize experts and router stably under sparse task rewards, we further propose a hierarchical group-relative policy optimization with two-layer credit assignment that isolates expert updates from the cross-route variance introduced by routing decisions, disentangling expert quality from routing quality. Experiments on code-generation benchmarks across three backbones demonstrate the effectiveness of our approach, with improvements in both whole-task and step-wise performance, and the gains from trained specialization generalize across held-out task categories and domains.

https://arxiv.org/abs/2608.09251

Erich Zimmerman's EZ Tools https://ericzimmerman.github.io/ easily takes care of such threats.

It helped me easily get rid of the Gropper aka Dropper malware https://en.wikipedia.org/wiki/Dropper_(malware)

This was a potent malware that took down the Hadarom Container Terminal because their cyber security engineer turned out to be an incompetent bozo who sits around trolling on forums all day.