Bad Guys Hate This Trick for Malware Weight Loss!

Lately I’ve had to work with multiple malware samples that are extremely heavyweight in size. Usually about 300 MB and above, depending on the sample. This large sample size can significantly hinde...

Oct 15, 2022 malware

Analyzing .NET Core Single File Samples (DUCKTAIL Case Study)

This post is dedicated to my colleague Matt Graeber (@mattifestation) who showed me how to do the manual calculations and carving of PEs using CFF Explorer and a hex editor, making me think “there ...

Aug 7, 2022 malware

Analyzing a Pirrit adware installer

While Windows holds the largest market share on malware, macOS has its fair share of threats that mostly exist in an adware/grayware area. In this post I want to walk through how a Pirrit PKG file ...

May 13, 2022 malware

Shortcut to Emotet, an odd TTP change

The adversary behind Emotet made a really interesting TTP change around 4/22 to use Windows shortcut files, and it definitely got noticed by multiple researchers. #Emotet New TTPs 🚨[+] LNK with em...

Apr 24, 2022 malware

Snip3 Crypter used with DCRat via VBScript

Adversaries love using free or cheap RATs or stealers, and I see a lot of RATs such as AsyncRAT during my daily malware analysis tasks. In this detection I want to examine a fairly recent sample fr...

Apr 16, 2022 malware

An AgentTesla Sample Using VBA Macros and Certutil

AgentTesla is a .NET stealer that adversaries commonly buy and combine with other malicious products for deployment. In this post I’m tearing into a XLSM document that downloads and executes furthe...

Mar 26, 2022 malware

Formbook Distributed Via VBScript, PowerShell, and C# Code

Formbook is one of the threats that I categorize as part of the “background noise of exploitation” on the internet. While targeted attacks occur in scoped areas, anyone can go buy access for Formbo...

Mar 25, 2022 malware

Aggah PPAM macros renaming MSHTA

In this quick post I’m taking a look at a PowerPoint file with macros on board! According to MalwareBazaar’s tags, it was reported in association with the group “Aggah”. If you want to follow along...

Mar 4, 2022 malware

Analyzing a Stealer MSI using msitools

This post is dedicated to Josh Rickard (@MSAdministrator on Twitter) since his feedback on my blog posts has cut my triage time on MSI files down in a massive way! After writing an analysis of a MS...

Feb 12, 2022 malware

XLoader/Formbook Distributed by Encrypted VelvetSweatshop Spreadsheets

Just like with RTF documents, adversaries can use XLSX spreadsheets to exploit the Microsoft Office Equation Editor. To add a little bit of complication on top, adversaries also sometimes like to e...

Feb 11, 2022 malware