Analyzing .NET Core Single File Samples (DUCKTAIL Case Study)

This post is dedicated to my colleague Matt Graeber (@mattifestation) who showed me how to do the manual calculations and carving of PEs using CFF Explorer and a hex editor, making me think “there ...

Aug 7, 2022 malware

Analyzing a Pirrit adware installer

While Windows holds the largest market share on malware, macOS has its fair share of threats that mostly exist in an adware/grayware area. In this post I want to walk through how a Pirrit PKG file ...

May 13, 2022 malware

Shortcut to Emotet, an odd TTP change

The adversary behind Emotet made a really interesting TTP change around 4/22 to use Windows shortcut files, and it definitely got noticed by multiple researchers. #Emotet New TTPs 🚨[+] LNK with em...

Apr 24, 2022 malware

Snip3 Crypter used with DCRat via VBScript

Adversaries love using free or cheap RATs or stealers, and I see a lot of RATs such as AsyncRAT during my daily malware analysis tasks. In this detection I want to examine a fairly recent sample fr...

Apr 16, 2022 malware

An AgentTesla Sample Using VBA Macros and Certutil

AgentTesla is a .NET stealer that adversaries commonly buy and combine with other malicious products for deployment. In this post I’m tearing into a XLSM document that downloads and executes furthe...

Mar 26, 2022 malware

Formbook Distributed Via VBScript, PowerShell, and C# Code

Formbook is one of the threats that I categorize as part of the “background noise of exploitation” on the internet. While targeted attacks occur in scoped areas, anyone can go buy access for Formbo...

Mar 25, 2022 malware

Aggah PPAM macros renaming MSHTA

In this quick post I’m taking a look at a PowerPoint file with macros on board! According to MalwareBazaar’s tags, it was reported in association with the group “Aggah”. If you want to follow along...

Mar 4, 2022 malware

Analyzing a Stealer MSI using msitools

This post is dedicated to Josh Rickard (@MSAdministrator on Twitter) since his feedback on my blog posts has cut my triage time on MSI files down in a massive way! After writing an analysis of a MS...

Feb 12, 2022 malware

XLoader/Formbook Distributed by Encrypted VelvetSweatshop Spreadsheets

Just like with RTF documents, adversaries can use XLSX spreadsheets to exploit the Microsoft Office Equation Editor. To add a little bit of complication on top, adversaries also sometimes like to e...

Feb 11, 2022 malware

AgentTesla From RTF Exploitation to .NET Tradecraft

When adversaries buy and deploy threats like AgentTesla you often see this functional and entertaining chain of older exploitation activity with some .NET framework tradecraft you’d expect from som...

Feb 6, 2022 malware