malware 27
- Decompiling a JPHP Loader with binwalk and cfr
- Dissecting a Java Pikabot Dropper
- Timelining a Malicious VHD for More Intelligence
- Malware via VHD Files, an Excellent Choice
- NetSupport Manager RAT from a Malicious Installer
- BATLoader, Ursnif, and Redline, oh my!
- .NET Downloader Leading to OriginLogger
- Malware Weight Loss the Fast Way with Foremost
- Bad Guys Hate This Trick for Malware Weight Loss!
- Analyzing .NET Core Single File Samples (DUCKTAIL Case Study)
- Analyzing a Pirrit adware installer
- Shortcut to Emotet, an odd TTP change
- Snip3 Crypter used with DCRat via VBScript
- An AgentTesla Sample Using VBA Macros and Certutil
- Formbook Distributed Via VBScript, PowerShell, and C# Code
- Aggah PPAM macros renaming MSHTA
- Analyzing a Stealer MSI using msitools
- XLoader/Formbook Distributed by Encrypted VelvetSweatshop Spreadsheets
- AgentTesla From RTF Exploitation to .NET Tradecraft
- njRAT Installed from a MSI
- STRRAT Attached to a MSI File
- GuLoader Executing Shellcode Using Callback Functions
- HCrypt Injecting BitRAT using PowerShell, HTAs, and .NET
- BazarISO Analysis - Loading with Advpack.dll
- Extracting Payloads from Excel-DNA XLL Add-Ins
- Emotet's Excel 4.0 Macros Dropping DLLs
- Inspecting a PowerShell Cobalt Strike Beacon