malware 38
- Decompiling a JPHP Loader with binwalk and cfr
- Dissecting a Java Pikabot Dropper
- Timelining a Malicious VHD for More Intelligence
- Malware via VHD Files, an Excellent Choice
- NetSupport Manager RAT from a Malicious Installer
- BATLoader, Ursnif, and Redline, oh my!
- .NET Downloader Leading to OriginLogger
- Malware Weight Loss the Fast Way with Foremost
- Bad Guys Hate This Trick for Malware Weight Loss!
- Analyzing .NET Core Single File Samples (DUCKTAIL Case Study)
- Analyzing a Pirrit adware installer
- Shortcut to Emotet, an odd TTP change
- Snip3 Crypter used with DCRat via VBScript
- An AgentTesla Sample Using VBA Macros and Certutil
- Formbook Distributed Via VBScript, PowerShell, and C# Code
- Aggah PPAM macros renaming MSHTA
- Analyzing a Stealer MSI using msitools
- XLoader/Formbook Distributed by Encrypted VelvetSweatshop Spreadsheets
- AgentTesla From RTF Exploitation to .NET Tradecraft
- njRAT Installed from a MSI
- STRRAT Attached to a MSI File
- GuLoader Executing Shellcode Using Callback Functions
- HCrypt Injecting BitRAT using PowerShell, HTAs, and .NET
- BazarISO Analysis - Loading with Advpack.dll
- Extracting Payloads from Excel-DNA XLL Add-Ins
- Emotet's Excel 4.0 Macros Dropping DLLs
- Analyzing a CACTUSTORCH HTA Leading to Cobalt Strike
- Inspecting a PowerShell Cobalt Strike Beacon
- Looking at PowerPoint Macros with Olevba
- Decoding an Encoded Webshell Using NodeJS
- Extracting Indicators from a Packed Mirai Sample
- A Tale of Two Dropper Scripts for Agent Tesla
- Analyzing a Magnitude EK Appx Package Dropping Magniber
- Analyzing an IcedID Loader Document
- Analyzing a Log4Shell log4j Exploit from Muhstik
- Smarter, Not Harder: Getting Malware to Help You Analyze It
- Analyzing an Empire macOS PKG Stager
- How Qbot Uses Esentutl