So recently I’ve been reverse engineering the newest version of IcedID (the version hiding encrypted payloads and other data inside PNGs), and I came across a post by Malware-Traffic-Analysis about…
This post is a continuation from my last one, where we reverse engineered the second stage of the shellcode, and replicated the API hashing routine. If you haven’t checked out…
Welcome back! If you haven’t checked out my last post on reverse engineering shellcode techniques, you can check it out here! This time we’re taking a look at stage 2…
It’s been a while since I posted a blog aimed at beginners in terms of reversing techniques for analyzing malware, rather than a “how-does-it-work” type post, so for this blog…
Recently I came across a newly released CTF based around memory forensics, called MemLabs, and as memory forensics is quite an important subtopic in malware analysis, I decided to brush…
Happy New Year! It’s been a while since I’ve posted anything here, as I’ve been quite occupied with a few other things - such as the Zero2Hero course that Vitali…
(This post is a reupload from my old site which is no longer available – you may have seen it before) If you haven’t read the first post, go check…
(This post is a reupload from my old site which is no longer available - you may have seen it before) Whilst I’m working through the Hancitor write up and…
So it's been quite a while since my last post, however now that my Beginner Malware Analysis Course is complete, the posts should be more and more frequent, although that…
I'm finally getting round to writing this post - for the past few months I have been analysing different versions of ISFB/Ursnif/Gozi to gain a deeper understanding in the functionality…
As you probably guessed from the title, we are going to be taking a look at Hancitor once again, except this time, I'll be focusing on the second stage of…
You may remember I wrote about the DarkHydrus APT a while ago, and how their Powershell malware, RogueRobin, was being used to target Middle Eastern organizations and exfiltrate data through…
If you follow me on Twitter (@0verfl0w_), you may have noticed a while back that I was analyzing a sample of Ursnif/Gozi/ISFB (which I will refer to as ISFB) and…
Carrying on with the previous post of getting started with malware analysis (you can find it here), I've had requests to do a write up on how I setup my…
So it's been a while since I last posted anything - I've been extremely busy with exam season coming up, but I had a bit of spare time so I…