Find a domain name today. We make it easy.

WIP Emotet Control Flow Unflattening using miasm and radare2 - ulexec/EmotetCFU

Contribute to 1d8/analyses development by creating an account on GitHub.

Generally, when a hypervisor encounters a VM exit, it is because it needs to emulate the effects of an instruction, be it CPUID, RDMSR, or E...

Key Takeaways: Just about one year ago, the makers of the infamous GandCrab ransomware announced their retirement, having reportedly earned an astonishing $2 billion since their entry into the ransomware market in January 2018. The vacuum was quickly filled…

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers. - BC-SECURITY/Empire

The idea of handling system calls differently depending on the origin of each call in the proce [...]

In cybersecurity, there have been several approaches used to track and analyze the various characteristics of cyber intrusions by advanced…

This unusual web skimmer campaign goes after sites running Microsoft's IIS servers with an outdated version of the ASP.NET framework.

FortiGuard Labs recently captured an MS Office Word document in the wild that was spreading a variant of QBot. Learn more about this.…

In part two of the analysis of a recently discovered QBot campaign, discover how the core module collects data from a victim’s device, how it extracts submodules, how it injects its injection-modul…

A new macOS ransomware threat uses a custom file encryption routine not based on public key encryption. Jason Reaves shows how we broke it.

In my last article on Chinoxy backdoor, this version has its configuration in a resource called NNKK and it is deciphered. The purpose of…

M00nD3V is a multifunctional information-stealing trojan that has gained popularity on hacker forums.

BazarBackdoor is a module of the dreaded TrickBot Trojan. It is mostly used to gain a foothold in compromised enterprise networks.

We discovered a new Mirai variant that exploits nine vulnerabilities, most notable of which is CVE-2020-10173 in Comtrend VR-3033 routers which we have not observed exploited by past Mirai variants.

Moobot is a mirai based botnet. Spread through weak telnet passwords and some nday and 0day  vulnerabilities.

Overview


On June 17, 2020, 360Netlab Threat Detecting System flagged an interesting ELF sample (dd7c9d99d8f7b9975c29c803abdf1c33), further analysis shows that this is a DDos Bot program that propagates through the CVE-2020-8515 vulnerability which targets…

ESET research gives a detailed picture of the operations of Evilnum and its toolkit used in attacks against carefully chosen targets in the fintech sector.