Dark Caracal Part I - Introducing Dark Caracal
Explore the global cyber threat "Dark Caracal," its multi-platform attacks, and the evolution of nation-state actors in cyber-warfare, including mobile device exploitation.
Threat Hunting - Using MITRE ATT&CK Against Carbanak Malware
Explore threat hunting using MITRE ATT&CK framework against Carbanak malware, covering tactics, techniques, and procedures for effective cybersecurity defense and mitigation strategies.
Netrepser - A JavaScript Targeted Attack
Explore Netrepser, a unique JavaScript-based espionage tool using freeware utilities for targeted attacks. Learn its techniques, impact, and how it blends into environments for data exfiltration.
The Next Gen PlugX - ShadowPad - A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT
Explore the emerging Pangolin8RAT trojan, its potential as a successor to PlugX and ShadowPad in Chinese cyber operations, and its attack timeline from 2020 to 2021.
Finding Xori - Malware Analysis Triage with Automated Disassembly
Explore automated malware analysis using Xori, an open-source disassembler. Learn to identify suspicious functionality and contribute to this valuable cybersecurity tool.
Exploring How Memory-Mapped Files Hide From AV and Execute Malicious Code
Explore techniques for using memory-mapped files to conceal malicious payloads and execute code, evading antivirus detection.
Miasm - Reverse Engineering Framework
Explore Miasm's reverse engineering capabilities, from basic framework to symbolic emulation and malware analysis tools. Learn disassembly, code emulation, and advanced techniques for tackling complex software.
Finding Xori - Malware Analysis Triage with Automated Disassembly
Explore automated malware analysis using Xori, an open-source tool for efficient triage and disassembly. Learn to process high volumes of malware and improve analysis capabilities at scale.
Worm Charming - Harvesting Malware Lures for Fun and Profit
Explore YARA rules for extracting malware samples from VirusTotal, learning techniques to identify attacker infrastructure and analyze real-world threats.
My Ticks Don't Lie - New Timing Attacks for Hypervisor Detection
Explore new timing attacks for hypervisor detection, crucial for sandbox evasion in malware analysis. Learn about hardware-assisted virtualization vulnerabilities and low-level measurement techniques.
Unpacking the Packed Unpacker - Reverse Engineering an Android Anti-Analysis Native Library
Gain tools and techniques to expose hidden Android malware through reverse engineering of anti-analysis native libraries, enhancing your ability to combat mobile threats.
Windows Offender - Reverse Engineering Windows Defender's Antivirus Emulator
Dive into the internals of Windows Defender's antivirus emulator, exploring its binary analysis techniques for potentially malicious PE files. Gain unique insights into reverse engineering antivirus systems.
Rope - Bypassing Behavioral Detection of Malware with Distributed ROP-Driven Execution
Explore a novel covert distributed execution technique for malware that challenges behavioral detection by AV and EDR solutions, using ROP-driven execution across multiple processes.
Harnessing Intelligence From Malware Repositories
Explore techniques for extracting intelligence from malware repositories using program analysis and data mining, with insights on connecting seemingly disparate cyber attacks and tracking malware trends.
Graphic Content Ahead - Towards Automated Scalable Analysis of Graphical Images Embedded in Malware
Explores automated analysis of images in malware, focusing on identifying visually similar samples and classifying images into categories to enhance malware triage and reveal attacker patterns.
ThunderStrike 2 - Sith Strike
Explore firmware vulnerabilities in Mac systems, demonstrating software-only attacks and showcasing the potential of Mac firmware malware. Learn about shared vulnerabilities and case studies.
Internet-Scale File Analysis
Explore TOTEM and DRAKVUF systems for large-scale malware analysis, addressing challenges in file diversity, volume, and dynamic analysis through cloud-based orchestration and hardware virtualization.
PDF Attack - A Journey from the Exploit Kit to the Shellcode
Explore PDF-based attacks, from exploit kits to shellcode analysis. Learn to extract and analyze obfuscated JavaScript, modify malicious PDFs, and understand cybercriminal techniques using peepdf tool.
Man in the Binder - He Who Controls IPC, Controls the Droid
Explore Android's Binder IPC system, its security implications, and potential vulnerabilities through a POC rootkit demonstration and in-depth analysis of low-level Binder operations.
A Scalable, Ensemble Approach for Building and Visualizing Deep Code-Sharing Networks
Innovative ensemble approach for detecting code-sharing in malware, combining multiple analysis techniques to overcome obfuscation and scale to millions of samples. Includes visualization and open-source implementation.
Repurposing OnionDuke - A Single Case Study Around Reusing Nation State Malware
Explore the process of reverse engineering and repurposing OnionDuke, a suspected Russian government malware, for use in other tools. Learn about malware analysis and ethical considerations in cybersecurity research.