UNSTOPPABLE TECH SUPPORT MALWARE VISH |
| 2010-07-06 | Rob VandenBrink | Bogus Support Organizations use Live Operators to Install Malware |
UNSTOPPABLE |
| 2010-07-06/a> | Rob VandenBrink | Bogus Support Organizations use Live Operators to Install Malware |
TECH |
| 2014-08-12/a> | Adrien de Beaupre | Host discovery with nmap |
| 2013-04-29/a> | Adam Swanger | Report Fake Tech Support Calls submission form reminder |
| 2010-07-06/a> | Rob VandenBrink | Bogus Support Organizations use Live Operators to Install Malware |
| 2008-06-17/a> | Kyle Haugsness | Why go high-tech? |
SUPPORT |
| 2024-06-17/a> | Xavier Mertens | New NetSupport Campaign Delivered Through MSIX Packages |
| 2023-08-18/a> | Xavier Mertens | From a Zalando Phishing to a RAT |
| 2022-10-21/a> | Brad Duncan | sczriptzzbn inject pushes malware for NetSupport RAT |
| 2020-02-05/a> | Brad Duncan | Fake browser update pages are "still a thing" |
| 2015-06-27/a> | Guy Bruneau | Is Windows XP still around in your Network a year after Support Ended? |
| 2014-07-05/a> | Guy Bruneau | Java Support ends for Windows XP |
| 2012-12-06/a> | Daniel Wesemann | Fake tech support calls - revisited |
| 2012-10-03/a> | Kevin Shortt | Fake Support Calls Reported |
| 2011-05-23/a> | Mark Hofman | Microsoft Support Scam (again) |
| 2010-07-06/a> | Rob VandenBrink | Bogus Support Organizations use Live Operators to Install Malware |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild |
| 2010-03-01/a> | Mark Hofman | Microsoft will drop support for Vista (without any Service Packs) on April 13 and support for XP SP2 ends July 13. (i.e. no more security updates). If you are still running these, it it time to update. |
| 2010-02-03/a> | Rob VandenBrink | Support for Legacy Browsers |
MALWARE |
| 2025-04-25/a> | Xavier Mertens | Example of a Payload Delivered Through Steganography |
| 2025-04-09/a> | Xavier Mertens | Obfuscated Malicious Python Scripts with PyArmor |
| 2025-03-26/a> | Jesse La Grew | [Guest Diary] Leveraging CNNs and Entropy-Based Feature Selection to Identify Potential Malware Artifacts of Interest |
| 2025-03-18/a> | Xavier Mertens | Python Bot Delivered Through DLL Side-Loading |
| 2025-03-12/a> | Guy Bruneau | File Hashes Analysis with Power BI from Data Stored in DShield SIEM |
| 2025-03-10/a> | Xavier Mertens | Shellcode Encoded in UUIDs |
| 2025-02-27/a> | Xavier Mertens | Njrat Campaign Using Microsoft Dev Tunnels |
| 2025-02-26/a> | Jesse La Grew | [Guest Diary] Malware Source Servers: The Threat of Attackers Using Ephemeral Ports as Service Ports to Upload Data |
| 2025-02-19/a> | Xavier Mertens | XWorm Cocktail: A Mix of PE data with PowerShell Code |
| 2025-02-14/a> | Xavier Mertens | Fake BSOD Delivered by Malicious Python Script |
| 2025-02-06/a> | Xavier Mertens | The Unbreakable Multi-Layer Anti-Debugging System |
| 2025-01-29/a> | Xavier Mertens | From PowerShell to a Python Obfuscation Race! |
| 2025-01-28/a> | Xavier Mertens | Fileless Python InfoStealer Targeting Exodus |
| 2025-01-09/a> | Guy Bruneau | Examining Redtail Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics [Guest Diary] |
| 2025-01-06/a> | Xavier Mertens | Make Malware Happy |
| 2025-01-03/a> | Xavier Mertens | SwaetRAT Delivery Through Python |
| 2025-01-02/a> | Xavier Mertens | Goodware Hash Sets |
| 2024-12-24/a> | Xavier Mertens | More SSH Fun! |
| 2024-12-23/a> | Xavier Mertens | Modiloader From Obfuscated Batch File |
| 2024-12-20/a> | Xavier Mertens | Christmas "Gift" Delivered Through SSH |
| 2024-12-17/a> | Xavier Mertens | Python Delivering AnyDesk Client as RAT |
| 2024-12-17/a> | Guy Bruneau | Command Injection Exploit For PHPUnit before 4.8.28 and 5.x before 5.6.3 [Guest Diary] |
| 2024-11-30/a> | Xavier Mertens | From a Regular Infostealer to its Obfuscated Version |
| 2024-11-22/a> | Xavier Mertens | An Infostealer Searching for « BIP-0039 » Data |
| 2024-11-19/a> | Xavier Mertens | Detecting the Presence of a Debugger in Linux |
| 2024-11-07/a> | Xavier Mertens | Steam Account Checker Poisoned with Infostealer |
| 2024-11-05/a> | Xavier Mertens | Python RAT with a Nice Screensharing Feature |
| 2024-10-09/a> | Xavier Mertens | From Perfctl to InfoStealer |
| 2024-09-18/a> | Xavier Mertens | Python Infostealer Patching Windows Exodus App |
| 2024-09-17/a> | Xavier Mertens | 23:59, Time to Exfiltrate! |
| 2024-09-16/a> | Xavier Mertens | Managing PE Files With Overlays |
| 2024-09-11/a> | Guy Bruneau | Hygiene, Hygiene, Hygiene! [Guest Diary] |
| 2024-08-27/a> | Xavier Mertens | Why Is Python so Popular to Infect Windows Hosts? |
| 2024-08-26/a> | Xavier Mertens | From Highly Obfuscated Batch File to XWorm and Redline |
| 2024-08-19/a> | Xavier Mertens | Do you Like Donuts? Here is a Donut Shellcode Delivered Through PowerShell/Python |
| 2024-08-14/a> | Xavier Mertens | Multiple Malware Dropped Through MSI Package |
| 2024-07-26/a> | Xavier Mertens | ExelaStealer Delivered "From Russia With Love" |
| 2024-07-25/a> | Xavier Mertens | XWorm Hidden With Process Hollowing |
| 2024-07-24/a> | Xavier Mertens | "Mouse Logger" Malicious Python Script |
| 2024-06-06/a> | Xavier Mertens | Malicious Python Script with a "Best Before" Date |
| 2024-05-28/a> | Guy Bruneau | Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary] |
| 2024-05-22/a> | Guy Bruneau | Analysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary] |
| 2024-04-29/a> | Guy Bruneau | Linux Trojan - Xorddos with Filename eyshcjdmzg |
| 2024-04-25/a> | Jesse La Grew | Does it matter if iptables isn't running on my honeypot? |
| 2024-03-28/a> | Xavier Mertens | From JavaScript to AsyncRAT |
| 2024-03-13/a> | Xavier Mertens | Using ChatGPT to Deobfuscate Malicious Scripts |
| 2024-02-29/a> | Jesse La Grew | [Guest Diary] Dissecting DarkGate: Modular Malware Delivery and Persistence as a Service. |
| 2024-02-08/a> | Xavier Mertens | A Python MP3 Player with Builtin Keylogger Capability |
| 2024-02-06/a> | Jan Kopriva | Computer viruses are celebrating their 40th birthday (well, 54th, really) |
| 2024-01-26/a> | Xavier Mertens | A Batch File With Multiple Payloads |
| 2024-01-25/a> | Xavier Mertens | Facebook AdsManager Targeted by a Python Infostealer |
| 2024-01-24/a> | Johannes Ullrich | How Bad User Interfaces Make Security Tools Harmful |
| 2024-01-19/a> | Xavier Mertens | macOS Python Script Replacing Wallet Applications with Rogue Apps |
| 2024-01-07/a> | Guy Bruneau | Suspicious Prometei Botnet Activity |
| 2024-01-03/a> | Jan Kopriva | Interesting large and small malspam attachments from 2023 |
| 2023-12-22/a> | Xavier Mertens | Shall We Play a Game? |
| 2023-11-18/a> | Xavier Mertens | Quasar RAT Delivered Through Updated SharpLoader |
| 2023-11-15/a> | Xavier Mertens | Redline Dropped Through MSIX Package |
| 2023-11-09/a> | Xavier Mertens | Visual Examples of Code Injection |
| 2023-11-01/a> | Xavier Mertens | Malware Dropped Through a ZPAQ Archive |
| 2023-10-31/a> | Xavier Mertens | Multiple Layers of Anti-Sandboxing Techniques |
| 2023-10-28/a> | Xavier Mertens | Size Matters for Many Security Controls |
| 2023-10-18/a> | Jesse La Grew | Hiding in Hex |
| 2023-09-30/a> | Xavier Mertens | Simple Netcat Backdoor in Python Script |
| 2023-09-29/a> | Xavier Mertens | Are You Still Storing Passwords In Plain Text Files? |
| 2023-08-25/a> | Xavier Mertens | Python Malware Using Postgresql for C2 Communications |
| 2023-08-23/a> | Xavier Mertens | More Exotic Excel Files Dropping AgentTesla |
| 2023-08-22/a> | Xavier Mertens | Have You Ever Heard of the Fernet Encryption Algorithm? |
| 2023-08-21/a> | Xavier Mertens | Quick Malware Triage With Inotify Tools |
| 2023-08-20/a> | Guy Bruneau | SystemBC Malware Activity |
| 2023-08-18/a> | Xavier Mertens | From a Zalando Phishing to a RAT |
| 2023-08-11/a> | Xavier Mertens | Show me All Your Windows! |
| 2023-08-03/a> | Jan Kopriva | From small LNK to large malicious BAT file with zero VT score |
| 2023-07-29/a> | Xavier Mertens | Do Attackers Pay More Attention to IPv6? |
| 2023-07-28/a> | Xavier Mertens | ShellCode Hidden with Steganography |
| 2023-07-26/a> | Xavier Mertens | Suspicious IP Addresses Avoided by Malware Samples |
| 2023-06-27/a> | Xavier Mertens | The Importance of Malware Triage |
| 2023-06-23/a> | Xavier Mertens | Word Document with an Online Attached Template |
| 2023-06-21/a> | Yee Ching Tok | Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators |
| 2023-06-20/a> | Xavier Mertens | Malicious Code Can Be Anywhere |
| 2023-06-19/a> | Xavier Mertens | Malware Delivered Through .inf File |
| 2023-06-16/a> | Xavier Mertens | Another RAT Delivered Through VBS |
| 2023-05-17/a> | Xavier Mertens | Increase in Malicious RAR SFX files |
| 2023-04-07/a> | Xavier Mertens | Detecting Suspicious API Usage with YARA Rules |
| 2023-04-04/a> | Johannes Ullrich | Analyzing the efile.com Malware "efail" |
| 2023-03-30/a> | Xavier Mertens | Bypassing PowerShell Strong Obfuscation |
| 2023-03-26/a> | Didier Stevens | Extra: "String Obfuscation: Character Pair Reversal" |
| 2023-03-01/a> | Xavier Mertens | Python Infostealer Targeting Gamers |
| 2023-02-09/a> | Xavier Mertens | A Backdoor with Smart Screenshot Capability |
| 2023-02-04/a> | Guy Bruneau | Assemblyline as a Malware Analysis Sandbox |
| 2023-01-25/a> | Xavier Mertens | A First Malicious OneNote Document |
| 2023-01-16/a> | Johannes Ullrich | PSA: Why you must run an ad blocker when using Google |
| 2023-01-06/a> | Xavier Mertens | AutoIT Remains Popular in the Malware Landscape |
| 2023-01-05/a> | Brad Duncan | More Brazil malspam pushing Astaroth (Guildma) in January 2023 |
| 2022-12-21/a> | Guy Bruneau | DShield Sensor Setup in Azure |
| 2022-12-18/a> | Guy Bruneau | Infostealer Malware with Double Extension |
| 2022-11-19/a> | Guy Bruneau | McAfee Fake Antivirus Phishing Campaign is Back! |
| 2022-11-09/a> | Xavier Mertens | Another Script-Based Ransomware |
| 2022-11-05/a> | Guy Bruneau | Windows Malware with VHD Extension |
| 2022-11-04/a> | Xavier Mertens | Remcos Downloader with Unicode Obfuscation |
| 2022-10-24/a> | Xavier Mertens | C2 Communications Through outlook.com |
| 2022-10-21/a> | Brad Duncan | sczriptzzbn inject pushes malware for NetSupport RAT |
| 2022-10-18/a> | Xavier Mertens | Python Obfuscation for Dummies |
| 2022-10-17/a> | Xavier Mertens | Fileless Powershell Dropper |
| 2022-10-15/a> | Guy Bruneau | Malware - Covid Vaccination Supplier Declaration |
| 2022-10-07/a> | Xavier Mertens | Powershell Backdoor with DGA Capability |
| 2022-09-25/a> | Didier Stevens | Downloading Samples From Takendown Domains |
| 2022-09-24/a> | Didier Stevens | Maldoc Analysis Info On MalwareBazaar |
| 2022-09-23/a> | Xavier Mertens | Kids Like Cookies, Malware Too! |
| 2022-09-22/a> | Xavier Mertens | RAT Delivered Through FODHelper |
| 2022-09-15/a> | Xavier Mertens | Malicious Word Document with a Frameset |
| 2022-09-14/a> | Xavier Mertens | Easy Process Injection within Python |
| 2022-09-10/a> | Guy Bruneau | Phishing Word Documents with Suspicious URL |
| 2022-09-03/a> | Didier Stevens | Video: James Webb JPEG With Malware |
| 2022-09-02/a> | Didier Stevens | James Webb JPEG With Malware |
| 2022-08-30/a> | Johannes Ullrich | Two things that will never die: bash scripts and IRC! |
| 2022-08-22/a> | Xavier Mertens | 32 or 64 bits Malware? |
| 2022-07-29/a> | Johannes Ullrich | PDF Analysis Intro and OpenActions Entries |
| 2022-07-25/a> | Xavier Mertens | PowerShell Script with Fileless Capability |
| 2022-07-20/a> | Xavier Mertens | Malicious Python Script Behaving Like a Rubber Ducky |
| 2022-06-25/a> | Xavier Mertens | Malicious Code Passed to PowerShell via the Clipboard |
| 2022-06-22/a> | Xavier Mertens | Malicious PowerShell Targeting Cryptocurrency Browser Extensions |
| 2022-06-16/a> | Xavier Mertens | Houdini is Back Delivered Through a JavaScript Dropper |
| 2022-06-04/a> | Guy Bruneau | Spam Email Contains a Very Large ISO file |
| 2022-06-03/a> | Xavier Mertens | Sandbox Evasion... With Just a Filename! |
| 2022-05-31/a> | Xavier Mertens | First Exploitation of Follina Seen in the Wild |
| 2022-05-20/a> | Xavier Mertens | A 'Zip Bomb' to Bypass Security Controls & Sandboxes |
| 2022-05-19/a> | Brad Duncan | Bumblebee Malware from TransferXL URLs |
| 2022-05-11/a> | Brad Duncan | TA578 using thread-hijacked emails to push ISO files for Bumblebee malware |
| 2022-05-07/a> | Guy Bruneau | Phishing PDF Received in my ISC Mailbox |
| 2022-05-06/a> | Jan Kopriva | What is the simplest malware in the world? |
| 2022-05-05/a> | Brad Duncan | Password-protected Excel spreadsheet pushes Remcos RAT |
| 2022-04-21/a> | Xavier Mertens | Multi-Cryptocurrency Clipboard Swapper |
| 2022-04-06/a> | Brad Duncan | Windows MetaStealer Malware |
| 2022-03-25/a> | Xavier Mertens | XLSB Files: Because Binary is Stealthier Than XML |
| 2022-03-24/a> | Xavier Mertens | Malware Delivered Through Free Sharing Tool |
| 2022-03-23/a> | Brad Duncan | Arkei Variants: From Vidar to Mars Stealer |
| 2022-03-11/a> | Xavier Mertens | Keep an Eye on WebSockets |
| 2022-03-09/a> | Xavier Mertens | Infostealer in a Batch File |
| 2022-02-22/a> | Xavier Mertens | A Good Old Equation Editor Vulnerability Delivering Malware |
| 2022-02-18/a> | Xavier Mertens | Remcos RAT Delivered Through Double Compressed Archive |
| 2022-02-11/a> | Xavier Mertens | CinaRAT Delivered Through HTML ID Attributes |
| 2022-01-20/a> | Xavier Mertens | RedLine Stealer Delivered Through FTP |
| 2022-01-07/a> | Xavier Mertens | Custom Python RAT Builder |
| 2022-01-06/a> | Xavier Mertens | Malicious Python Script Targeting Chinese People |
| 2022-01-05/a> | Xavier Mertens | Code Reuse In the Malware Landscape |
| 2021-12-21/a> | Xavier Mertens | More Undetected PowerShell Dropper |
| 2021-12-15/a> | Xavier Mertens | Simple but Undetected PowerShell Backdoor |
| 2021-12-03/a> | Xavier Mertens | The UPX Packer Will Never Die! |
| 2021-12-02/a> | Brad Duncan | TA551 (Shathak) pushes IcedID (Bokbot) |
| 2021-11-19/a> | Xavier Mertens | Downloader Disguised as Excel Add-In (XLL) |
| 2021-11-18/a> | Xavier Mertens | JavaScript Downloader Delivers Agent Tesla Trojan |
| 2021-10-21/a> | Brad Duncan | "Stolen Images Evidence" campaign pushes Sliver-based malware |
| 2021-10-01/a> | Xavier Mertens | New Tool to Add to Your LOLBAS List: cvtres.exe |
| 2021-09-23/a> | Xavier Mertens | Excel Recipe: Some VBA Code with a Touch of Excel4 Macro |
| 2021-09-01/a> | Brad Duncan | STRRAT: a Java-based RAT that doesn't care if you have Java |
| 2021-08-30/a> | Xavier Mertens | Cryptocurrency Clipboard Swapper Delivered With Love |
| 2021-08-20/a> | Xavier Mertens | Waiting for the C2 to Show Up |
| 2021-08-15/a> | Didier Stevens | Simple Tips For Triage Of MALWARE Bazaar's Daily Malware Batches |
| 2021-08-07/a> | Didier Stevens | MALWARE Bazaar "Download daily malware batches" |
| 2021-08-06/a> | Xavier Mertens | Malicious Microsoft Word Remains A Key Infection Vector |
| 2021-07-30/a> | Xavier Mertens | Infected With a .reg File |
| 2021-07-29/a> | Xavier Mertens | Malicious Content Delivered Through archive.org |
| 2021-07-24/a> | Xavier Mertens | Agent.Tesla Dropped via a .daa Image and Talking to Telegram |
| 2021-07-16/a> | Xavier Mertens | Multiple BaseXX Obfuscations |
| 2021-07-06/a> | Xavier Mertens | Python DLL Injection Check |
| 2021-06-30/a> | Brad Duncan | June 2021 Forensic Contest: Answers and Analysis |
| 2021-06-11/a> | Xavier Mertens | Keeping an Eye on Dangerous Python Modules |
| 2021-06-09/a> | Jan Kopriva | Architecture, compilers and black magic, or "what else affects the ability of AVs to detect malicious files" |
| 2021-06-04/a> | Xavier Mertens | Russian Dolls VBS Obfuscation |
| 2021-05-28/a> | Xavier Mertens | Malicious PowerShell Hosted on script.google.com |
| 2021-05-27/a> | Jan Kopriva | All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not |
| 2021-05-21/a> | Xavier Mertens | Locking Kernel32.dll As Anti-Debugging Technique |
| 2021-05-19/a> | Brad Duncan | May 2021 Forensic Contest: Answers and Analysis |
| 2021-05-18/a> | Xavier Mertens | From RunDLL32 to JavaScript then PowerShell |
| 2021-05-06/a> | Xavier Mertens | Alternative Ways To Perform Basic Tasks |
| 2021-05-05/a> | Brad Duncan | May 2021 Forensic Contest |
| 2021-04-29/a> | Xavier Mertens | From Python to .Net |
| 2021-04-28/a> | Xavier Mertens | Deeper Analyzis of my Last Malicious PowerPoint Add-On |
| 2021-04-23/a> | Xavier Mertens | Malicious PowerPoint Add-On: "Small Is Beautiful" |
| 2021-04-09/a> | Xavier Mertens | No Python Interpreter? This Simple RAT Installs Its Own Copy |
| 2021-04-08/a> | Xavier Mertens | Simple Powershell Ransomware Creating a 7Z Archive of your Files |
| 2021-04-06/a> | Jan Kopriva | Malspam with Lokibot vs. Outlook and RFCs |
| 2021-04-02/a> | Xavier Mertens | C2 Activity: Sandboxes or Real Victims? |
| 2021-04-01/a> | Brad Duncan | April 2021 Forensic Quiz |
| 2021-03-31/a> | Xavier Mertens | Quick Analysis of a Modular InfoStealer |
| 2021-03-19/a> | Xavier Mertens | Pastebin.com Used As a Simple C2 Channel |
| 2021-03-18/a> | Xavier Mertens | Simple Python Keylogger |
| 2021-03-17/a> | Xavier Mertens | Defenders, Know Your Operating System Like Attackers Do! |
| 2021-03-16/a> | Jan Kopriva | 50 years of malware? Not really. 50 years of computer worms? That's a different story... |
| 2021-03-04/a> | Xavier Mertens | From VBS, PowerShell, C Sharp, Process Hollowing to RAT |
| 2021-02-19/a> | Xavier Mertens | Dynamic Data Exchange (DDE) is Back in the Wild? |
| 2021-02-14/a> | Didier Stevens | Video: tshark & Malware Analysis |
| 2021-02-12/a> | Xavier Mertens | AgentTesla Dropped Through Automatic Click in Microsoft Help File |
| 2021-02-11/a> | Jan Kopriva | Agent Tesla hidden in a historical anti-malware tool |
| 2021-02-03/a> | Brad Duncan | Excel spreadsheets push SystemBC malware |
| 2021-02-02/a> | Xavier Mertens | New Example of XSL Script Processing aka "Mitre T1220" |
| 2021-01-22/a> | Xavier Mertens | Another File Extension to Block in your MTA: .jnlp |
| 2021-01-21/a> | Xavier Mertens | Powershell Dropping a REvil Ransomware |
| 2021-01-04/a> | Jan Kopriva | From a small BAT file to Mass Logger infostealer |
| 2021-01-02/a> | Guy Bruneau | Protecting Home Office and Enterprise in 2021 |
| 2020-12-24/a> | Xavier Mertens | Malicious Word Document Delivering an Octopus Backdoor |
| 2020-12-22/a> | Xavier Mertens | Malware Victim Selection Through WiFi Identification |
| 2020-12-03/a> | Brad Duncan | Traffic Analysis Quiz: Mr Natural |
| 2020-11-25/a> | Xavier Mertens | Live Patching Windows API Calls Using PowerShell |
| 2020-11-23/a> | Didier Stevens | Quick Tip: Cobalt Strike Beacon Analysis |
| 2020-11-09/a> | Xavier Mertens | How Attackers Brush Up Their Malicious Scripts |
| 2020-10-25/a> | Didier Stevens | Video: Pascal Strings |
| 2020-10-21/a> | Daniel Wesemann | Shipping dangerous goods |
| 2020-09-24/a> | Xavier Mertens | Party in Ibiza with PowerShell |
| 2020-09-23/a> | Xavier Mertens | Malicious Word Document with Dynamic Content |
| 2020-09-18/a> | Xavier Mertens | A Mix of Python & VBA in a Malicious Word Document |
| 2020-09-15/a> | Brad Duncan | Traffic Analysis Quiz: Oh No... Another Infection! |
| 2020-09-04/a> | Jan Kopriva | A blast from the past - XXEncoded VB6.0 Trojan |
| 2020-09-03/a> | Xavier Mertens | Sandbox Evasion Using NTP |
| 2020-08-28/a> | Xavier Mertens | Example of Malicious DLL Injected in PowerShell |
| 2020-08-26/a> | Xavier Mertens | Malicious Excel Sheet with a NULL VT Score |
| 2020-08-24/a> | Xavier Mertens | Tracking A Malware Campaign Through VT |
| 2020-08-19/a> | Xavier Mertens | Example of Word Document Delivering Qakbot |
| 2020-08-18/a> | Xavier Mertens | Using API's to Track Attackers |
| 2020-08-14/a> | Jan Kopriva | Definition of 'overkill' - using 130 MB executable to hide 24 kB malware |
| 2020-08-06/a> | Xavier Mertens | A Fork of the FTCode Powershell Ransomware |
| 2020-08-05/a> | Brad Duncan | Traffic Analysis Quiz: What's the Malware From This Infection? |
| 2020-07-24/a> | Xavier Mertens | Compromized Desktop Applications by Web Technologies |
| 2020-07-15/a> | Brad Duncan | Word docs with macros for IcedID (Bokbot) |
| 2020-07-10/a> | Brad Duncan | Excel spreasheet macro kicks off Formbook infection |
| 2020-07-08/a> | Xavier Mertens | If You Want Something Done Right, You Have To Do It Yourself... Malware Too! |
| 2020-06-13/a> | Guy Bruneau | Mirai Botnet Activity |
| 2020-06-04/a> | Xavier Mertens | Anti-Debugging Technique based on Memory Protection |
| 2020-06-01/a> | Jim Clausing | Stackstrings, type 2 |
| 2020-05-23/a> | Xavier Mertens | AgentTesla Delivered via a Malicious PowerPoint Add-In |
| 2020-05-21/a> | Xavier Mertens | Malware Triage with FLOSS: API Calls Based Behavior |
| 2020-05-20/a> | Brad Duncan | Microsoft Word document with malicious macro pushes IcedID (Bokbot) |
| 2020-05-06/a> | Xavier Mertens | Keeping an Eye on Malicious Files Life Time |
| 2020-04-27/a> | Xavier Mertens | Powershell Payload Stored in a PSCredential Object |
| 2020-04-25/a> | Didier Stevens | MALWARE Bazaar |
| 2020-04-24/a> | Xavier Mertens | Malicious Excel With a Strong Obfuscation and Sandbox Evasion |
| 2020-04-20/a> | Didier Stevens | KPOT AutoIt Script: Analysis |
| 2020-04-17/a> | Xavier Mertens | Weaponized RTF Document Generator & Mailer in PowerShell |
| 2020-04-12/a> | Didier Stevens | Reader Analysis: "Dynamic analysis technique to get decrypted KPOT Malware." |
| 2020-04-10/a> | Xavier Mertens | PowerShell Sample Extracting Payload From SSL |
| 2020-04-03/a> | Xavier Mertens | Obfuscated with a Simple 0x0A |
| 2020-03-31/a> | Johannes Ullrich | Kwampirs Targeted Attacks Involving Healthcare Sector |
| 2020-03-27/a> | Xavier Mertens | Malicious JavaScript Dropping Payload in the Registry |
| 2020-03-26/a> | Xavier Mertens | Very Large Sample as Evasion Technique? |
| 2020-03-23/a> | Didier Stevens | KPOT Deployed via AutoIt Script |
| 2020-03-22/a> | Didier Stevens | More COVID-19 Themed Malware |
| 2020-03-21/a> | Guy Bruneau | Honeypot - Scanning and Targeting Devices & Services |
| 2020-03-19/a> | Xavier Mertens | COVID-19 Themed Multistage Malware |
| 2020-03-11/a> | Xavier Mertens | Agent Tesla Delivered via Fake Canon EOS Notification on Free OwnCloud Account |
| 2020-03-06/a> | Xavier Mertens | A Safe Excel Sheet Not So Safe |
| 2020-02-21/a> | Xavier Mertens | Quick Analysis of an Encrypted Compound Document Format |
| 2020-02-14/a> | Xavier Mertens | Keep an Eye on Command-Line Browsers |
| 2020-02-07/a> | Xavier Mertens | Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript |
| 2020-02-03/a> | Jan Kopriva | Analysis of a triple-encrypted AZORult downloader |
| 2020-01-16/a> | Jan Kopriva | Picks of 2019 malware - the large, the small and the one full of null bytes |
| 2020-01-10/a> | Xavier Mertens | More Data Exfiltration |
| 2020-01-09/a> | Xavier Mertens | Quick Analyzis of a(nother) Maldoc |
| 2020-01-02/a> | Xavier Mertens | Ransomware in Node.js |
| 2019-12-24/a> | Brad Duncan | Malspam with links to Word docs pushes IcedID (Bokbot) |
| 2019-12-12/a> | Xavier Mertens | Code & Data Reuse in the Malware Ecosystem |
| 2019-11-23/a> | Guy Bruneau | Local Malware Analysis with Malice |
| 2019-10-18/a> | Xavier Mertens | Quick Malicious VBS Analysis |
| 2019-10-03/a> | Xavier Mertens | "Lost_Files" Ransomware |
| 2019-09-19/a> | Xavier Mertens | Agent Tesla Trojan Abusing Corporate Email Accounts |
| 2019-08-30/a> | Xavier Mertens | Malware Dropping a Local Node.js Instance |
| 2019-08-28/a> | Xavier Mertens | Malware Samples Compiling Their Next Stage on Premise |
| 2019-08-22/a> | Xavier Mertens | Simple Mimikatz & RDPWrapper Dropper |
| 2019-08-18/a> | Didier Stevens | Video: Analyzing DAA Files |
| 2019-08-16/a> | Didier Stevens | The DAA File Format |
| 2019-08-12/a> | Didier Stevens | Malicious .DAA Attachments |
| 2019-07-18/a> | Xavier Mertens | Malicious PHP Script Back on Stage? |
| 2019-07-11/a> | Xavier Mertens | Russian Dolls Malicious Script Delivering Ursnif |
| 2019-07-02/a> | Xavier Mertens | Malicious Script With Multiple Payloads |
| 2019-06-14/a> | Jim Clausing | A few Ghidra tips for IDA users, part 4 - function call graphs |
| 2019-06-10/a> | Xavier Mertens | Interesting JavaScript Obfuscation Example |
| 2019-05-29/a> | Xavier Mertens | Behavioural Malware Analysis with Microsoft ASA |
| 2019-05-13/a> | Xavier Mertens | From Phishing To Ransomware? |
| 2019-05-03/a> | Jim Clausing | A few Ghidra tips for IDA users, part 3 - conversion, labels, and comments |
| 2019-05-01/a> | Xavier Mertens | Another Day, Another Suspicious UDF File |
| 2019-04-19/a> | Didier Stevens | Analyzing UDF Files with Python |
| 2019-04-17/a> | Jim Clausing | A few Ghidra tips for IDA users, part 2 - strings and parameters |
| 2019-04-17/a> | Xavier Mertens | Malware Sample Delivered Through UDF Image |
| 2019-04-08/a> | Jim Clausing | A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code |
| 2019-04-03/a> | Jim Clausing | A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters |
| 2019-03-30/a> | Didier Stevens | "404" is not Malware |
| 2019-03-10/a> | Didier Stevens | Malicious HTA Analysis by a Reader |
| 2019-03-10/a> | Didier Stevens | Quick and Dirty Malicious HTA Analysis |
| 2019-02-14/a> | Xavier Mertens | Old H-Worm Delivered Through GitHub |
| 2019-01-16/a> | Brad Duncan | Emotet infections and follow-up malware |
| 2019-01-06/a> | Didier Stevens | Malicious .tar Attachments |
| 2019-01-05/a> | Didier Stevens | A Malicious JPEG? Second Example |
| 2019-01-04/a> | Didier Stevens | A Malicious JPEG? |
| 2019-01-02/a> | Xavier Mertens | Malicious Script Leaking Data via FTP |
| 2018-12-09/a> | Didier Stevens | Quickie: String Analysis is Still Useful |
| 2018-12-08/a> | Didier Stevens | Reader Malware Submission: MHT File Inside a ZIP File |
| 2018-11-27/a> | Xavier Mertens | More obfuscated shell scripts: Fake MacOS Flash update |
| 2018-11-26/a> | Xavier Mertens | Obfuscated bash script targeting QNap boxes |
| 2018-11-22/a> | Xavier Mertens | Divided Payload in Multiple Pasties |
| 2018-11-06/a> | Xavier Mertens | Malicious Powershell Script Dissection |
| 2018-10-23/a> | Xavier Mertens | Diving into Malicious AutoIT Code |
| 2018-10-22/a> | Xavier Mertens | Malicious Powershell using a Decoy Picture |
| 2018-10-21/a> | Pasquale Stirparo | Beyond good ol’ LaunchAgent - part 0 |
| 2018-10-12/a> | Xavier Mertens | More Equation Editor Exploit Waves |
| 2018-09-28/a> | Xavier Mertens | More Excel DDE Code Injection |
| 2018-09-22/a> | Didier Stevens | Suspicious DNS Requests ... Issued by a Firewall |
| 2018-09-16/a> | Didier Stevens | 20/20 malware vision |
| 2018-09-13/a> | Xavier Mertens | Malware Delivered Through MHT Files |
| 2018-09-05/a> | Xavier Mertens | Malicious PowerShell Compiling C# Code on the Fly |
| 2018-08-31/a> | Jim Clausing | Quickie: Using radare2 to disassemble shellcode |
| 2018-08-30/a> | Xavier Mertens | Crypto Mining Is More Popular Than Ever! |
| 2018-08-26/a> | Didier Stevens | Identifying numeric obfuscation |
| 2018-08-26/a> | Didier Stevens | "When was this machine infected?" |
| 2018-08-24/a> | Xavier Mertens | Microsoft Publisher Files Delivering Malware |
| 2018-08-21/a> | Xavier Mertens | Malicious DLL Loaded Through AutoIT |
| 2018-08-06/a> | Didier Stevens | Numeric obfuscation: another example |
| 2018-08-04/a> | Didier Stevens | Dealing with numeric obfuscation in malicious scripts |
| 2018-08-02/a> | Brad Duncan | DHL-themed malspam reveals embedded malware in animated gif |
| 2018-07-26/a> | Xavier Mertens | Windows Batch File Deobfuscation |
| 2018-07-09/a> | Renato Marinho | Criminals Don't Read Instructions or Use Strong Passwords |
| 2018-06-07/a> | Remco Verhoef | Automated twitter loot collection |
| 2018-06-05/a> | Xavier Mertens | Malicious Post-Exploitation Batch File |
| 2018-06-01/a> | Remco Verhoef | Binary analysis with Radare2 |
| 2018-05-22/a> | Xavier Mertens | Malware Distributed via .slk Files |
| 2018-05-19/a> | Xavier Mertens | Malicious Powershell Targeting UK Bank Customers |
| 2018-05-09/a> | Xavier Mertens | Nice Phishing Sample Delivering Trickbot |
| 2018-05-07/a> | Xavier Mertens | Adding Persistence Via Scheduled Tasks |
| 2018-05-01/a> | Xavier Mertens | Diving into a Simple Maldoc Generator |
| 2018-03-05/a> | Xavier Mertens | Malicious Bash Script with Multiple Features |
| 2018-03-04/a> | Xavier Mertens | The Crypto Miners Fight For CPU Cycles |
| 2018-02-25/a> | Didier Stevens | Retrieving malware over Tor on Windows |
| 2018-02-02/a> | Xavier Mertens | Simple but Effective Malicious XLS Sheet |
| 2018-01-28/a> | Didier Stevens | Is this a pentest? |
| 2018-01-26/a> | Xavier Mertens | Investigating Microsoft BITS Activity |
| 2018-01-25/a> | Xavier Mertens | Ransomware as a Service |
| 2018-01-11/a> | Xavier Mertens | Mining or Nothing! |
| 2017-12-19/a> | Xavier Mertens | Example of 'MouseOver' Link in a Powerpoint File |
| 2017-12-16/a> | Xavier Mertens | Microsoft Office VBA Macro Obfuscation via Metadata |
| 2017-11-29/a> | Xavier Mertens | Fileless Malicious PowerShell Sample |
| 2017-11-16/a> | Xavier Mertens | Suspicious Domains Tracking Dashboard |
| 2017-11-15/a> | Xavier Mertens | If you want something done right, do it yourself! |
| 2017-11-13/a> | Guy Bruneau | VBE Embeded Script (info.zip) |
| 2017-11-07/a> | Xavier Mertens | Interesting VBA Dropper |
| 2017-11-03/a> | Xavier Mertens | Simple Analysis of an Obfuscated JAR File |
| 2017-10-31/a> | Xavier Mertens | Some Powershell Malicious Code |
| 2017-10-29/a> | Didier Stevens | Remember ACE files? |
| 2017-10-24/a> | Xavier Mertens | BadRabbit: New ransomware wave hitting RU & UA |
| 2017-10-15/a> | Didier Stevens | Peeking into .msg files |
| 2017-09-09/a> | Didier Stevens | Malware analysis output sanitization |
| 2017-09-02/a> | Xavier Mertens | AutoIT based malware back in the wild |
| 2017-08-26/a> | Didier Stevens | Malware analysis: searching for dots |
| 2017-08-25/a> | Xavier Mertens | Malicious AutoIT script delivered in a self-extracting RAR file |
| 2017-08-23/a> | Xavier Mertens | Malicious script dropping an executable signed by Avast? |
| 2017-08-18/a> | Renato Marinho | EngineBox Malware Supports 10+ Brazilian Banks |
| 2017-07-21/a> | Didier Stevens | Malicious .iso Attachments |
| 2017-07-09/a> | Russ McRee | Adversary hunting with SOF-ELK |
| 2017-07-05/a> | Didier Stevens | Selecting domains with random names |
| 2017-06-22/a> | Xavier Mertens | Obfuscating without XOR |
| 2017-06-06/a> | Didier Stevens | Malware and XOR - Part 2 |
| 2017-06-05/a> | Didier Stevens | Malware and XOR - Part 1 |
| 2017-05-16/a> | Russ McRee | WannaCry? Do your own data analysis. |
| 2017-05-13/a> | Guy Bruneau | Microsoft Released Guidance for WannaCrypt |
| 2017-04-28/a> | Xavier Mertens | Another Day, Another Obfuscation Technique |
| 2017-04-19/a> | Xavier Mertens | Hunting for Malicious Excel Sheets |
| 2017-04-05/a> | Xavier Mertens | Whitelists: The Holy Grail of Attackers |
| 2017-03-18/a> | Xavier Mertens | Example of Multiple Stages Dropper |
| 2017-03-12/a> | Guy Bruneau | Honeypot Logs and Tracking a VBE Script |
| 2017-03-08/a> | Xavier Mertens | Not All Malware Samples Are Complex |
| 2017-02-05/a> | Xavier Mertens | Many Malware Samples Found on Pastebin |
| 2017-01-31/a> | Johannes Ullrich | Malicious Office files using fileless UAC bypass to drop KEYBASE malware |
| 2017-01-24/a> | Xavier Mertens | Malicious SVG Files in the Wild |
| 2017-01-06/a> | John Bambenek | Ransomware Operators Cold Calling UK Schools to Get Malware Through |
| 2017-01-05/a> | John Bambenek | New Year's Resolution: Build Your Own Malware Lab? |
| 2017-01-01/a> | Didier Stevens | py2exe Decompiling - Part 1 |
| 2016-12-13/a> | Xavier Mertens | UAC Bypass in JScript Dropper |
| 2016-11-11/a> | Rick Wanner | Benevolent malware? reincarna/Linux.Wifatch |
| 2016-10-30/a> | Pasquale Stirparo | Volatility Bot: Automated Memory Analysis |
| 2016-09-30/a> | Xavier Mertens | Another Day, Another Malicious Behaviour |
| 2016-09-13/a> | Rob VandenBrink | If it's Free, YOU are the Product |
| 2016-09-05/a> | Xavier Mertens | Malware Delivered via '.pub' Files |
| 2016-09-01/a> | Xavier Mertens | Maxmind.com (Ab)used As Anti-Analysis Technique |
| 2016-08-25/a> | Xavier Mertens | Out-of-Band iOS Patch Fixes 0-Day Vulnerabilities |
| 2016-08-24/a> | Xavier Mertens | Example of Targeted Attack Through a Proxy PAC File |
| 2016-08-23/a> | Xavier Mertens | Voice Message Notifications Deliver Ransomware |
| 2016-08-01/a> | Daniel Wesemann | Are you getting I-CANNED ? |
| 2016-07-27/a> | Xavier Mertens | Analyze of a Linux botnet client source code |
| 2016-07-25/a> | Didier Stevens | Python Malware - Part 4 |
| 2016-07-16/a> | Didier Stevens | Python Malware - Part 3 |
| 2016-07-12/a> | Xavier Mertens | Hunting for Malicious Files with MISP + OSSEC |
| 2016-06-20/a> | Xavier Mertens | Ongoing Spam Campaign Related to Swift |
| 2016-06-18/a> | Rob VandenBrink | Controlling JavaScript Malware Before it Runs |
| 2016-05-15/a> | Didier Stevens | Python Malware - Part 1 |
| 2016-05-13/a> | Xavier Mertens | MISP - Malware Information Sharing Platform |
| 2016-05-05/a> | Xavier Mertens | Microsoft BITS Used to Download Payloads |
| 2016-05-02/a> | Rick Wanner | Fake Chrome update for Android |
| 2016-04-21/a> | Daniel Wesemann | Decoding Pseudo-Darkleech (#1) |
| 2016-04-21/a> | Daniel Wesemann | Decoding Pseudo-Darkleech (Part #2) |
| 2016-04-10/a> | Didier Stevens | Handling Malware Samples |
| 2016-03-07/a> | Xavier Mertens | Another Malicious Document, Another Way to Deliver Malicious Code |
| 2016-02-24/a> | Xavier Mertens | Analyzis of a Malicious .lnk File with an Embedded Payload |
| 2016-02-18/a> | Xavier Mertens | Hunting for Executable Code in Windows Environments |
| 2016-02-11/a> | Tom Webb | Tomcat IR with XOR.DDoS |
| 2016-01-24/a> | Didier Stevens | Obfuscated MIME Files |
| 2016-01-15/a> | Xavier Mertens | JavaScript Deobfuscation Tool |
| 2016-01-01/a> | Didier Stevens | Failure Is An Option |
| 2015-12-26/a> | Didier Stevens | Malfunctioning Malware |
| 2015-12-16/a> | Xavier Mertens | Playing With Sandboxes Like a Boss |
| 2015-12-06/a> | Mark Hofman | Malware SPAM a new run has started. |
| 2015-11-09/a> | John Bambenek | Protecting Users and Enterprises from the Mobile Malware Threat |
| 2015-09-29/a> | Pedro Bueno | Tricks for DLL analysis |
| 2015-09-28/a> | Johannes Ullrich | "Transport of London" Malicious E-Mail |
| 2015-09-21/a> | Xavier Mertens | Detecting XCodeGhost Activity |
| 2015-04-24/a> | Basil Alawi S.Taher | Fileless Malware |
| 2015-04-09/a> | Brad Duncan | An example of the malicious emails sometimes sent to the ISC handler addresses |
| 2015-03-18/a> | Daniel Wesemann | New SANS memory forensics poster |
| 2015-03-14/a> | Didier Stevens | Maldoc VBA Sandbox/Virtualization Detection |
| 2015-03-08/a> | Brad Duncan | What Happened to You, Asprox Botnet? |
| 2015-02-19/a> | Daniel Wesemann | Macros? Really?! |
| 2014-10-03/a> | Johannes Ullrich | CSAM: The Power of Virustotal to Turn Harmless Binaries Malicious |
| 2014-09-22/a> | Johannes Ullrich | Fake LogMeIn Certificate Update with Bad AV Detection Rate |
| 2014-08-06/a> | Chris Mohan | Free Service to Help CryptoLocker Victims by FireEye and Fox-IT |
| 2014-07-22/a> | Daniel Wesemann | Ivan's Order of Magnitude |
| 2014-07-19/a> | Russ McRee | Keeping the RATs out: the trap is sprung - Part 3 |
| 2014-07-18/a> | Russ McRee | Keeping the RATs out: **it happens - Part 2 |
| 2014-07-18/a> | Russ McRee | Gameover Zeus reported as "returned from the dead" |
| 2014-07-16/a> | Russ McRee | Keeping the RATs out: an exercise in building IOCs - Part 1 |
| 2014-07-05/a> | Guy Bruneau | Malware Analysis with pedump |
| 2014-06-22/a> | Russ McRee | OfficeMalScanner helps identify the source of a compromise |
| 2014-06-08/a> | Guy Bruneau | efax Spam Containing Malware |
| 2014-04-06/a> | Basil Alawi S.Taher | "Power Worm" PowerShell based Malware |
| 2014-04-05/a> | Jim Clausing | Those strange e-mails with URLs in them can lead to Android malware |
| 2014-03-04/a> | Daniel Wesemann | XPired! |
| 2014-02-28/a> | Daniel Wesemann | Fiesta! |
| 2014-01-19/a> | Rick Wanner | Anatomy of a Malware distribution campaign |
| 2013-12-24/a> | Daniel Wesemann | Mr Jones wants you to appear in court! |
| 2013-12-23/a> | Daniel Wesemann | Costco, BestBuy, Walmart really want to send you a package! |
| 2013-12-07/a> | Guy Bruneau | Suspected Active Rovnix Botnet Controller |
| 2013-11-02/a> | Rick Wanner | Protecting Your Family's Computers |
| 2013-10-31/a> | Russ McRee | Happy Halloween: The Ghost Really May Be In The Machine |
| 2013-10-30/a> | Russ McRee | SIR v15: Five good reasons to leave Windows XP behind |
| 2013-10-28/a> | Daniel Wesemann | Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities |
| 2013-10-24/a> | Johannes Ullrich | False Positive: php.net Malware Alert |
| 2013-09-30/a> | Adrien de Beaupre | Twitter DM spam/malware |
| 2013-09-12/a> | Daniel Wesemann | 37.58.73.42 / 95.156.228.69 / 195.210.43.42, anyone? |
| 2013-09-10/a> | Swa Frantzen | Macs need to patch too! |
| 2013-08-29/a> | Russ McRee | Suspect Sendori software |
| 2013-07-04/a> | Russ McRee | Celebrating 4th of July With a Malware PCAP Visualization |
| 2013-06-18/a> | Russ McRee | Volatility rules...any questions? |
| 2013-05-21/a> | Adrien de Beaupre | Moore, Oklahoma tornado charitable organization scams, malware, and phishing |
| 2013-05-17/a> | Daniel Wesemann | e-netprotections.su ? |
| 2013-05-16/a> | Daniel Wesemann | Extracting signatures from Apple .apps |
| 2013-05-11/a> | Lenny Zeltser | Extracting Digital Signatures from Signed Malware |
| 2013-05-01/a> | Daniel Wesemann | The cost of cleaning up |
| 2013-04-10/a> | Manuel Humberto Santander Pelaez | Massive Google scam sent by email to Colombian domains |
| 2013-03-22/a> | Mark Baggett | Wipe the drive! Stealthy Malware Persistence - Part 4 |
| 2013-03-20/a> | Mark Baggett | Wipe the drive! Stealthy Malware Persistence - Part 3 |
| 2013-03-19/a> | Johannes Ullrich | Scam of the day: More fake CNN e-mails |
| 2013-03-15/a> | Mark Baggett | AVG detect legit file as virus |
| 2013-03-14/a> | Mark Baggett | Wipe the drive! Stealthy Malware Persistence - Part 2 |
| 2013-03-13/a> | Mark Baggett | Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1 |
| 2013-02-25/a> | Johannes Ullrich | Mass-Customized Malware Lures: Don't trust your cat! |
| 2013-01-08/a> | Jim Clausing | Cuckoo 0.5 is out and the world didn't end |
| 2012-12-18/a> | Rob VandenBrink | All I Want for Christmas is to Not Get Hacked ! |
| 2012-12-03/a> | Kevin Liston | Mobile Malware: Request for Field Reports |
| 2012-11-02/a> | Daniel Wesemann | Lamiabiocasa |
| 2012-11-01/a> | Daniel Wesemann | Patched your Java yet? |
| 2012-10-14/a> | Pedro Bueno | Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1 |
| 2012-09-21/a> | Guy Bruneau | Storing your Collection of Malware Samples with Malwarehouse |
| 2012-09-14/a> | Lenny Zeltser | Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan |
| 2012-07-21/a> | Rick Wanner | OpenDNS is looking for a few good malware people! |
| 2012-07-05/a> | Adrien de Beaupre | New OS X trojan backdoor MaControl variant reported |
| 2012-06-27/a> | Swa Frantzen | Online Banking Heists |
| 2012-06-26/a> | Daniel Wesemann | Run, Forest! (Update) |
| 2012-06-25/a> | Rick Wanner | Targeted Malware for Industrial Espionage? |
| 2012-06-25/a> | Swa Frantzen | Belgian online banking customers hacked. |
| 2012-06-22/a> | Daniel Wesemann | Run, Forest! |
| 2012-06-21/a> | Raul Siles | Print Bomb? (Take 2) |
| 2012-06-21/a> | Russ McRee | Analysis of drive-by attack sample set |
| 2012-06-19/a> | Daniel Wesemann | Vulnerabilityqueerprocessbrittleness |
| 2012-06-04/a> | Lenny Zeltser | Decoding Common XOR Obfuscation in Malicious Code |
| 2012-04-26/a> | Richard Porter | Define Irony: A medical device with a Virus? |
| 2012-04-25/a> | Daniel Wesemann | Blacole's obfuscated JavaScript |
| 2012-04-25/a> | Daniel Wesemann | Blacole's shell code |
| 2012-04-12/a> | Guy Bruneau | HP ProCurve 5400 zl Switch, Flash Cards Infected with Malware |
| 2012-04-12/a> | Guy Bruneau | Apple Java Updates for Mac OS X |
| 2012-03-25/a> | Daniel Wesemann | evilcode.class |
| 2012-03-03/a> | Jim Clausing | New automated sandbox for Android malware |
| 2012-02-24/a> | Guy Bruneau | Flashback Trojan in the Wild |
| 2012-02-20/a> | Rick Wanner | DNSChanger resolver shutdown deadline is March 8th |
| 2012-02-20/a> | Pedro Bueno | Simple Malware Research Tools |
| 2012-01-14/a> | Daniel Wesemann | Hello, Antony! |
| 2011-12-28/a> | Daniel Wesemann | .nl.ai ? |
| 2011-12-10/a> | Daniel Wesemann | Unwanted Presents |
| 2011-12-07/a> | Lenny Zeltser | V8 as an Alternative to SpiderMonkey for JavaScript Deobfuscation |
| 2011-11-04/a> | Guy Bruneau | Duqu Mitigation |
| 2011-10-20/a> | Johannes Ullrich | Evil Printers Sending Mail |
| 2011-09-07/a> | Lenny Zeltser | Analyzing Mobile Device Malware - Honeynet Forensic Challenge 9 and Some Tools |
| 2011-08-29/a> | Kevin Shortt | Internet Worm in the Wild |
| 2011-06-15/a> | Pedro Bueno | Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)... |
| 2011-05-25/a> | Daniel Wesemann | Apple advisory on "MacDefender" malware |
| 2011-05-19/a> | Daniel Wesemann | Fake AV Bingo |
| 2011-05-14/a> | Guy Bruneau | Websense Study Claims Canada Next Hotbed for Cybercrime Web Hosting Activity |
| 2011-05-03/a> | Johannes Ullrich | Update on Osama Bin Laden themed Malware |
| 2011-05-02/a> | Johannes Ullrich | Bin Laden Death Related Malware |
| 2011-04-23/a> | Manuel Humberto Santander Pelaez | Image search can lead to malware download |
| 2011-03-01/a> | Daniel Wesemann | AV software and "sharing samples" |
| 2011-02-07/a> | Pedro Bueno | The Good , the Bad and the Unknown Online Scanners |
| 2011-02-01/a> | Lenny Zeltser | The Importance of HTTP Headers When Investigating Malicious Sites |
| 2010-12-29/a> | Daniel Wesemann | Malware Domains 2234.in, 0000002.in & co |
| 2010-12-29/a> | Daniel Wesemann | Beware of strange web sites bearing gifts ... |
| 2010-10-26/a> | Pedro Bueno | Cyber Security Awareness Month - Day 26 - Sharing Office Files |
| 2010-09-09/a> | Marcus Sachs | 'Here You Have' Email |
| 2010-07-21/a> | Adrien de Beaupre | Dell PowerEdge R410 replacement motherboard firmware contains malware |
| 2010-07-21/a> | Adrien de Beaupre | autorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198) |
| 2010-07-06/a> | Rob VandenBrink | Bogus Support Organizations use Live Operators to Install Malware |
| 2010-07-04/a> | Manuel Humberto Santander Pelaez | Malware inside PDF Files |
| 2010-06-17/a> | Deborah Hale | FYI - Another bogus site |
| 2010-06-14/a> | Manuel Humberto Santander Pelaez | Rogue facebook application acting like a worm |
| 2010-06-07/a> | Manuel Humberto Santander Pelaez | Software Restriction Policy to keep malware away |
| 2010-06-02/a> | Rob VandenBrink | New Mac malware - OSX/Onionspy |
| 2010-05-26/a> | Bojan Zdrnja | Malware modularization and AV detection evasion |
| 2010-05-23/a> | Manuel Humberto Santander Pelaez | e-mail scam announcing Fidel Castro's funeral ... and nasty malware to your computer. |
| 2010-05-21/a> | Rick Wanner | IBM distributes malware at AusCERT! |
| 2010-04-30/a> | Kevin Liston | The Importance of Small Files |
| 2010-04-19/a> | Daniel Wesemann | Linked into scams? |
| 2010-04-18/a> | Guy Bruneau | Some NetSol hosted sites breached |
| 2010-04-13/a> | Johannes Ullrich | More Legal Threat Malware E-Mail |
| 2010-03-30/a> | Pedro Bueno | Sharing the Tools |
| 2010-03-26/a> | Daniel Wesemann | Getting the EXE out of the RTF again |
| 2010-03-09/a> | Marcus Sachs | Energizer Malware |
| 2010-03-04/a> | Daniel Wesemann | salefale-dot-com is bad |
| 2010-03-03/a> | Johannes Ullrich | Reports about large number of fake Amazon order confirmations |
| 2010-02-21/a> | Patrick Nolan | Looking for "more useful" malware information? Help develop the format. |
| 2010-01-14/a> | Bojan Zdrnja | PDF Babushka |
| 2010-01-07/a> | Daniel Wesemann | Static analysis of malicious PDFs |
| 2010-01-07/a> | Daniel Wesemann | Static analysis of malicous PDFs (Part #2) |
| 2009-12-17/a> | Daniel Wesemann | In caches, danger lurks |
| 2009-12-17/a> | Daniel Wesemann | overlay.xul is back |
| 2009-12-16/a> | Rob VandenBrink | Beware the Attack of the Christmas Greeting Cards ! |
| 2009-12-07/a> | Rick Wanner | Cheat Sheet: Analyzing Malicious Documents |
| 2009-12-04/a> | Daniel Wesemann | Max Power's Malware Paradise |
| 2009-12-02/a> | Rob VandenBrink | SPAM and Malware taking advantage of H1N1 concerns |
| 2009-11-25/a> | Jim Clausing | Updates to my GREM Gold scripts and a new script |
| 2009-09-25/a> | Lenny Zeltser | Categories of Common Malware Traits |
| 2009-09-25/a> | Deborah Hale | Conficker Continues to Impact Networks |
| 2009-09-25/a> | Deborah Hale | Malware delivered over Google and Yahoo Ad's? |
| 2009-09-04/a> | Adrien de Beaupre | Fake anti-virus |
| 2009-08-29/a> | Guy Bruneau | Immunet Protect - Cloud and Community Malware Protection |
| 2009-08-26/a> | Johannes Ullrich | Malicious CD ROMs mailed to banks |
| 2009-07-26/a> | Jim Clausing | New Volatility plugins |
| 2009-07-03/a> | Adrien de Beaupre | Happy 4th of July! |
| 2009-07-02/a> | Daniel Wesemann | Getting the EXE out of the RTF |
| 2009-07-02/a> | Bojan Zdrnja | Cold Fusion web sites getting compromised |
| 2009-06-16/a> | John Bambenek | Iran Internet Blackout: Using Twitter for Operational Intelligence |
| 2009-06-16/a> | John Bambenek | URL Shortening Service Cligs Hacked |
| 2009-06-04/a> | Raul Siles | Malware targetting banks ATM's |
| 2009-06-04/a> | Raul Siles | Targeted e-mail attacks asking to verify wire transfer details |
| 2009-06-01/a> | G. N. White | Yet another "Digital Certificate" malware campaign |
| 2009-05-20/a> | Pedro Bueno | Cyber Warfare and Kylin thoughts |
| 2009-05-07/a> | Deborah Hale | Malicious Content on the Web |
| 2009-05-04/a> | Tom Liston | Facebook phishing malware |
| 2009-04-24/a> | Pedro Bueno | Did you check your conference goodies? |
| 2009-03-13/a> | Bojan Zdrnja | When web application security, Microsoft and the AV vendors all fail |
| 2009-02-23/a> | Daniel Wesemann | Turf War |
| 2009-02-23/a> | Daniel Wesemann | And the Oscar goes to... |
| 2009-02-10/a> | Bojan Zdrnja | More tricks from Conficker and VM detection |
| 2009-02-09/a> | Bojan Zdrnja | Some tricks from Conficker's bag |
| 2009-02-04/a> | Daniel Wesemann | Titan Shields up! |
| 2009-01-31/a> | John Bambenek | Google Search Engine's Malware Detection Broken |
| 2009-01-24/a> | Pedro Bueno | Identifying and Removing the iWork09 Trojan |
| 2009-01-18/a> | Daniel Wesemann | 3322. org |
| 2009-01-15/a> | Bojan Zdrnja | Conficker's autorun and social engineering |
| 2009-01-12/a> | William Salusky | Downadup / Conficker - MS08-067 exploit and Windows domain account lockout |
| 2009-01-07/a> | Bojan Zdrnja | An Israeli patriot program or a trojan |
| 2009-01-02/a> | Rick Wanner | Tools on my Christmas list. |
| 2008-12-25/a> | Maarten Van Horenbeeck | Merry Christmas, and beware of digital hitchhikers! |
| 2008-12-25/a> | Maarten Van Horenbeeck | Christmas Ecard Malware |
| 2008-12-17/a> | donald smith | Team CYMRU's Malware Hash Registry |
| 2008-12-05/a> | Daniel Wesemann | Been updatin' your Flash player lately? |
| 2008-12-05/a> | Daniel Wesemann | Baby, baby! |
| 2008-12-04/a> | Bojan Zdrnja | Rogue DHCP servers |
| 2008-11-17/a> | Jim Clausing | Finding stealth injected DLLs |
| 2008-11-16/a> | Maarten Van Horenbeeck | Detection of Trojan control channels |
| 2008-11-12/a> | John Bambenek | Thoughts on Security Intelligence (McColo Corp alleged spam/malware host knocked offline) |
| 2008-11-11/a> | Swa Frantzen | Acrobat continued activity in the wild |
| 2008-11-10/a> | Stephen Hall | Adobe Reader Vulnerability - part 2 |
| 2008-10-07/a> | Kyle Haugsness | Good reading and a malware challenge |
| 2008-09-29/a> | Daniel Wesemann | ASPROX mutant |
| 2008-09-22/a> | Maarten Van Horenbeeck | Data exfiltration and the use of anonymity providers |
| 2008-09-18/a> | Bojan Zdrnja | Monitoring HTTP User-Agent fields |
| 2008-09-07/a> | Lorna Hutcheson | Malware Analysis: Tools are only so good |
| 2008-09-03/a> | Daniel Wesemann | Static analysis of Shellcode |
| 2008-09-03/a> | Daniel Wesemann | Static analysis of Shellcode - Part 2 |
| 2008-09-01/a> | John Bambenek | The Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months |
| 2008-08-13/a> | Adrien de Beaupre | CNN switched to MSNBC |
| 2008-08-05/a> | Daniel Wesemann | The news update you never asked for |
| 2008-07-20/a> | Kevin Liston | Malware Intelligence: Making it Actionable |
| 2008-07-15/a> | Maarten Van Horenbeeck | Extracting scripts and data from suspect PDF files |
| 2008-07-14/a> | Daniel Wesemann | Obfuscated JavaScript Redux |
| 2008-07-07/a> | Pedro Bueno | Bad url classification |
| 2008-06-18/a> | Marcus Sachs | Olympics Part II |
| 2008-06-14/a> | Lorna Hutcheson | Malware Detection - Take the Blinders Off |
| 2008-06-10/a> | Swa Frantzen | Ransomware keybreaking |
| 2008-06-01/a> | Mark Hofman | Free Yahoo email account! Sign me up, Ok well maybe not. |
| 2008-05-28/a> | Adrien de Beaupre | Another example of malicious SWF |
| 2008-05-27/a> | Adrien de Beaupre | Malicious swf files? |
| 2008-05-26/a> | Marcus Sachs | Predictable Response |
| 2008-05-14/a> | Bojan Zdrnja | War of the worlds? |
| 2008-05-02/a> | Adrien de Beaupre | Hi, remember me?... |
| 2008-04-30/a> | Bojan Zdrnja | (Minor) evolution in Mac DNS changer malware |
| 2008-04-24/a> | Maarten Van Horenbeeck | Targeted attacks using malicious PDF files |
| 2008-04-16/a> | Bojan Zdrnja | The 10.000 web sites infection mystery solved |
| 2008-04-15/a> | Johannes Ullrich | SRI Malware Threat Center |
| 2008-04-14/a> | John Bambenek | A Federal Subpoena or Just Some More Spam & Malware? |
| 2008-04-07/a> | John Bambenek | HP USB Keys Shipped with Malware for your Proliant Server |
| 2008-04-07/a> | John Bambenek | Got Kraken? |
| 2008-04-07/a> | John Bambenek | Kraken Technical Details: UPDATED x3 |
| 2008-04-06/a> | Daniel Wesemann | Advanced obfuscated JavaScript analysis |
| 2008-04-04/a> | Daniel Wesemann | nmidahena |
| 2008-04-03/a> | Bojan Zdrnja | VB detection: is it so difficult? |
| 2008-04-02/a> | Adrien de Beaupre | When is a DMG file not a DMG file |
| 2008-03-27/a> | Maarten Van Horenbeeck | Guarding the guardians: a story of PGP key ring theft |
| 2006-08-31/a> | Swa Frantzen | NT botnet submitted |
| 2000-01-02/a> | Deborah Hale | 2010 A Look Back - 2011 A Look Ahead |
VISH |
| 2012-11-08/a> | Daniel Wesemann | Get a 40% discount on your hotel room! |
| 2010-07-06/a> | Rob VandenBrink | Bogus Support Organizations use Live Operators to Install Malware |
| 2008-10-20/a> | Johannes Ullrich | Fraudulent ATM Reactivation Phone Calls. |
