As you probably guessed from the title, we are going to be taking a look at Hancitor once again, except this time, I'll be focusing on the second stage of…
You may remember I wrote about the DarkHydrus APT a while ago, and how their Powershell malware, RogueRobin, was being used to target Middle Eastern organizations and exfiltrate data through…
If you follow me on Twitter (@0verfl0w_), you may have noticed a while back that I was analyzing a sample of Ursnif/Gozi/ISFB (which I will refer to as ISFB) and…
Carrying on with the previous post of getting started with malware analysis (you can find it here), I've had requests to do a write up on how I setup my…
So it's been a while since I last posted anything - I've been extremely busy with exam season coming up, but I had a bit of spare time so I…
I've been wanting to post write-ups about different CTF's and challenges that I have done, and I'm finally getting round to doing it. And as I've been recommended to use…
If you haven’t seen my last post about Hancitor, check it out here as I explain how this binary gets onto your machine through a malicious word document. As always, you can…
Recently, TechHelpList uploaded a Hancitor Word document to VirusBay, along with an overview of the sites it reached out to, the C2 servers, and the payloads that were dropped by said…
So you may remember I wrote a blog post about the MuddyWater APT group attacking Middle Eastern organizations using their custom Powershell malware (if you don't, you can check it…
Continuing with the "theme" of the last post, I decided to analyse one more .NET sample for a bit of practice. This time, rather than ransomware, I'm analyzing what seems…
I've mainly focused on analyzing RAT's, Backdoors, Trojans and Droppers/Downloaders in C, C++, Python, Powershell and VBS - but I have yet to analyze any .NET malware, and seeing as…
You may have heard of the friendly (Python) Adware pBot, and how it is becoming malicious by installing Browser Extensions without user consent and injecting unwanted advertisements into web pages and…
So I haven't posted in a while, primarily due to the fact I have been quite busy recently - but I should be posting more frequently - that's if I…
On June 7th, two variants of the same Banking Trojan were uploaded to VirusBay, and so I decided to have a look at them to see what exactly the difference…
This is a new section I am starting, where instead of reverse engineering malware, I will be demonstrating how certain malware works, at a source code level. Whilst someone malicious…