(This post is a reupload from my old site which is no longer available – you may have seen it before) If you haven’t read the first post, go check…
(This post is a reupload from my old site which is no longer available - you may have seen it before) Whilst I’m working through the Hancitor write up and…
So it's been quite a while since my last post, however now that my Beginner Malware Analysis Course is complete, the posts should be more and more frequent, although that…
I'm finally getting round to writing this post - for the past few months I have been analysing different versions of ISFB/Ursnif/Gozi to gain a deeper understanding in the functionality…
As you probably guessed from the title, we are going to be taking a look at Hancitor once again, except this time, I'll be focusing on the second stage of…
You may remember I wrote about the DarkHydrus APT a while ago, and how their Powershell malware, RogueRobin, was being used to target Middle Eastern organizations and exfiltrate data through…
If you follow me on Twitter (@0verfl0w_), you may have noticed a while back that I was analyzing a sample of Ursnif/Gozi/ISFB (which I will refer to as ISFB) and…
Carrying on with the previous post of getting started with malware analysis (you can find it here), I've had requests to do a write up on how I setup my…
So it's been a while since I last posted anything - I've been extremely busy with exam season coming up, but I had a bit of spare time so I…
I've been wanting to post write-ups about different CTF's and challenges that I have done, and I'm finally getting round to doing it. And as I've been recommended to use…
If you haven’t seen my last post about Hancitor, check it out here as I explain how this binary gets onto your machine through a malicious word document. As always, you can…
Recently, TechHelpList uploaded a Hancitor Word document to VirusBay, along with an overview of the sites it reached out to, the C2 servers, and the payloads that were dropped by said…
So you may remember I wrote a blog post about the MuddyWater APT group attacking Middle Eastern organizations using their custom Powershell malware (if you don't, you can check it…
Continuing with the "theme" of the last post, I decided to analyse one more .NET sample for a bit of practice. This time, rather than ransomware, I'm analyzing what seems…
I've mainly focused on analyzing RAT's, Backdoors, Trojans and Droppers/Downloaders in C, C++, Python, Powershell and VBS - but I have yet to analyze any .NET malware, and seeing as…