https://forensicitguy.github.io/Tony LambertTony's blog about malware analysis and other security topics 2026-05-16T04:22:42+00:00 Tony Lambert https://forensicitguy.github.io/ Jekyll © 2026 Tony Lambert /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png Squeezing Cobalt Strike Threat Intelligence from Shodan2025-05-18T00:00:00+00:00 2025-05-19T01:31:42+00:00 https://forensicitguy.github.io/squeezing-cobalt-strike-intel-from-shodan/ Tony Lambert One of my favorite Twitter accounts from the last several years was @cobaltstrikebot, mainly because it was an awesome source of threat intelligence for Cobalt Strike beacons in the wild. The account went dark in June 2023, but its tweets are still around. Today's 5 most common Spawn_to values:%windir%\sysnative\rundll32.exec:\windows\system32\rundll32.exe%windir%\system32\rundll32.exe%win... Exploring VenomRAT Metadata and Encryption with YARA - #100DaysOfYara2025-01-02T00:00:00+00:00 2025-01-02T00:00:00+00:00 https://forensicitguy.github.io/exploring-venomrat-metadata-encryption-with-yara/ Tony Lambert It’s that time of year again - 100 Days of YARA! In this post I want to walk through how I use YARA to document malware analysis findings. YARA has loads of different use cases: Detecting malicious file contents Estimating malware capabilities Showing how files can be similar to known documentation My favorite use case is that last one. In my day job I often encounter malware that doe... Decompiling a JPHP Loader with binwalk and cfr2024-07-20T00:00:00+00:00 2024-07-20T00:00:00+00:00 https://forensicitguy.github.io/decompiling-jphp-loader-binwalk-cfr/ Tony Lambert It’s not unusual for adversaries to explore new and unusual ways to implement loader malware, and lately I’ve been looking at JPHP-based loader malware. This kind of loader doesn’t get a lot of attention from antimalware providers, likely because of its nature as a weird hybrid language. In this post, I dive into unpacking the loader (which I suspect is “d3f@ck” loader) and statically decompili... Dissecting a Java Pikabot Dropper2024-03-03T00:00:00+00:00 2024-03-03T00:00:00+00:00 https://forensicitguy.github.io/dissecting-java-pikabot-dropper/ Tony Lambert In mid-February, TA577 experimented with a Java Archive (JAR) dropper to deliver Pikabot to their victims. In this post I’ll explore some static analysis of that dropper to show how we can get information from it. If you want to follow along, I’m working with this sample in MalwareBazaar: https://bazaar.abuse.ch/sample/0a0e0d2f9daa0bad25c3defd69a3a6d96a6ac5f325a369761807c06887d3bd9f/. Triage t... Timelining a Malicious VHD for More Intelligence2023-08-04T00:00:00+00:00 2023-08-04T00:00:00+00:00 https://forensicitguy.github.io/timelining-malware-vhd-intelligence/ Tony Lambert In a previous blog post I mentioned how adversaries using VHD files to distribute malware can leave around a lot more data than they intend, including identifiable data for tracking. In this post I want to break out the best friend everyone made during SANS FOR508, Plaso, so I can process the filesystem data for a malicious VHD and illustrate how we can establish a timeline of operations for th...