Recently I came across a newly released CTF based around memory forensics, called MemLabs, and as memory forensics is quite an important subtopic in malware analysis, I decided to brush…
Happy New Year! It’s been a while since I’ve posted anything here, as I’ve been quite occupied with a few other things - such as the Zero2Hero course that Vitali…
(This post is a reupload from my old site which is no longer available – you may have seen it before) If you haven’t read the first post, go check…
(This post is a reupload from my old site which is no longer available - you may have seen it before) Whilst I’m working through the Hancitor write up and…
So it's been quite a while since my last post, however now that my Beginner Malware Analysis Course is complete, the posts should be more and more frequent, although that…
I'm finally getting round to writing this post - for the past few months I have been analysing different versions of ISFB/Ursnif/Gozi to gain a deeper understanding in the functionality…
As you probably guessed from the title, we are going to be taking a look at Hancitor once again, except this time, I'll be focusing on the second stage of…
You may remember I wrote about the DarkHydrus APT a while ago, and how their Powershell malware, RogueRobin, was being used to target Middle Eastern organizations and exfiltrate data through…
If you follow me on Twitter (@0verfl0w_), you may have noticed a while back that I was analyzing a sample of Ursnif/Gozi/ISFB (which I will refer to as ISFB) and…
Carrying on with the previous post of getting started with malware analysis (you can find it here), I've had requests to do a write up on how I setup my…
So it's been a while since I last posted anything - I've been extremely busy with exam season coming up, but I had a bit of spare time so I…
I've been wanting to post write-ups about different CTF's and challenges that I have done, and I'm finally getting round to doing it. And as I've been recommended to use…
If you haven’t seen my last post about Hancitor, check it out here as I explain how this binary gets onto your machine through a malicious word document. As always, you can…
Recently, TechHelpList uploaded a Hancitor Word document to VirusBay, along with an overview of the sites it reached out to, the C2 servers, and the payloads that were dropped by said…
So you may remember I wrote a blog post about the MuddyWater APT group attacking Middle Eastern organizations using their custom Powershell malware (if you don't, you can check it…