Collaborate Disseminate
When I try to perform a DLL injection with ScyllaHide in x32/x64 dbg, then it crashes for some reason, is this a bug? Both with stealthy injection as with normal injection, the program crashes when I inject a DLL.
For example, when I injec… Continue reading ScyllaHide DLL Injection
Could someone please explain this to me: When you use a fuzzy hash algorithm (ssdeep, tlsh, sdhash… or any other) to calculate the hash value of a file, does it calculate the hash based on the whole file (e.g. a PDF file consists of a tr… Continue reading Fuzzy hash of a file
I want to hook certain API calls, e.g. CreateFile (or NtCreateFile if I hook ntdll.dll), but there are some issues.
I can use several methods to achieve this goal, e.g. DLL injection, Inline hooking etc. But I think the most pragmatic way … Continue reading API hooking with Microsoft Detours
Could somebody help me with the following questions:
Does a sandbox adds extra security over a virtual machine host-guest interaction, or does it only provide a security analysis (API call sequences etc.)? What would you recommend in term… Continue reading Build Ransomware analysis lab
Does anyone understand what the author means which this (please see the screenshot below).
This is a link to the paper, it’s on page 19 (page 28 if you count all pages):
https://pure.tue.nl/ws/portalfiles/portal/72275825/738228_Mulders_D.A… Continue reading Rename file by Ransomware- Does anyone know what is ment by this? [closed]
If I analyse multiple PDF files with a hex editor, I see that all of them have two trailers.
That’s possible if an object has changed or renewed (https://blog.idrsolutions.com/multiple-trailers-in-a-pdf-file/), but in my case, the PDF file… Continue reading PDF file have two trailers? [closed]
Advanced types of Ransomware generate, usually, an AES 128 bit key (used to encrypt files, some types of ransomware use a unique AES key for each file). This key is generated on the fly. In addition, the ransomware generates a client RSA 4… Continue reading Where is the AES key of ransomware stored (in the file header/trailer)?
Some time ago I read an article that mentioned that it is possible for some ransomware to change the magic numbers of a file (that makes sense). However, the authors claimed that their method was better, because they calculated the entropy… Continue reading Why does some Ransomware encrypt also the file header and trailer?
If you use Shannon’s entropy as an indicator to distinguish between encrypted and legitimate files, then it will be difficult to make a distinction between encrypted and compressed files, as both have a relatively high entropy value.
How i… Continue reading Why does ransomware also encrypt the file signature? [closed]