Collaborate Disseminate
Data breaches happen.
Today, as never before, data plays a fundamental role in our real life. Everybody is both: data producer and data consumer. We are data producer by simply moving from one building to another one, having a smartphone i… Continue reading How to data breaches happen
Nowadays Microsoft office documents are often used to propagate Malware acting like dynamic droppers. Microsoft Excel within macros or Microsoft Word with user actions (like links or external OLE objects) are the main player in this “Office Dropping A… Continue reading Microsoft Powerpoint as Malware Dropper
Today I’d like to share an interesting analysis of a Targeted Attack found and dissected by Yoroi (technical details are available here). The victim was one of the most important leader in the field of security and defensive military grade Naval… Continue reading MartyMcFly Malware: Targeting Naval Industry
Today I’d like to share a simple analysis based on fascinating threat that I like to call Sustes (you will see name genesis in a bit).
Everybody knows Monero crypto currency and probably everybody knows that it has built upon privacy, by meaning I… Continue reading Sustes Malware: CPU for Monero
Today I’d like to share a full path analysis including a KickBack attack which took me to gain full access to an entire Ursniff/Gozi BotNet .
In other words: from a simple “Malware Sample” to “Pwn the Attacker Infrastructure”.
NB: Fed… Continue reading Hacking The Hacker. Stopping a big botnet targeting USA, Canada and Italy
Today I’d like to share the following reverse engineering path since it ended up to be more complex respect what I thought. The full path took me about hours work and the sample covers many obfuscation steps and implementation languages. During the an… Continue reading Interesting hidden threat since years ?
Today I’d like to share another interesting analysis made by my colleagues and I. It would be a nice and interesting analysis since it targeted many Italian and European companies. Fortunately the attacker forgot the LOG.TXT freely available on the dr… Continue reading DMOSK Malware Targeting Italian Companies
Today I’d like to share an interesting (at least to me) analysis on a given sample. I have called this sample MalHide but you will see “why” only at the end of my post :D. I believe this is a quite interesting Malware since it firstly implements sever… Continue reading MalHide: an interesting Malware sample
Nowadays is hard to give strong definitions on what are the differences between Security Operation Centers (SOC), Computer Emergency Response Teams (CERT) and Computer Security Incident Response Teams (CSIRT) since they are widely used in many organis… Continue reading CERTs, CSIRTs and SOCs after 10 years from definitions
Understanding the real code behind a Malware is a great opportunity for Malware analysts, it would increase the chances to understand what the sample really does. Unfortunately it is not always possible figuring out the “real code”, sometimes the Malw… Continue reading Control Flow Integrity: a Javascript Evasion Technique