Unpacking a laZzzy Donut
<p>Six stages. Multiple encryption layers. One static analysis. In this blog, we unpack a multi-stage malware loader combining Python obfuscation, Donut shellcode, and laZzzy PE encryption, without executing the payload.</p>
Author Archives: Scott Nusbaum
Malware Series: Process Injection Mapped Sections
<p>We’re back with another post about common malware techniques. This time, we are talking about using shared memory sections to inject and execute code in a remote process. This method of process injection uses Windows…</p> Continue reading Malware Series: Process Injection Mapped Sections
Putting Our Hooks Into Windows
<p>We’re back with another post about common malware techniques. This time we are talking about setting Windows hooks. This is a simple technique that can be used to log keystrokes or inject code into remote processes. We…</p> Continue reading Putting Our Hooks Into Windows
Loading DLLs Reflections
<p>We’re back with another post about common malware techniques. This time we’re not talking about process hollowing. We are going to branch off and talk about the reflective loading of a DLL. This is a technique used to…</p> Continue reading Loading DLLs Reflections
Burrowing a Hollow in a DLL to Hide
<p>1 Burrowing a Hollow in a DLL to Hide In this post about common malware techniques, we are still talking about hollowing—but this time, instead of hollowing a newly created process, we will make a process load a new…</p>
Holiday Phishing: Office 365
It’s that time of year again, Merry Phishmas!! Holidays are the prime time of the year for attackers to send Phishing campaigns. Whether you are looking for the best deal on Black Friday, the best Christmas gift for that special family member, or a Holiday greeting from employees, employers, or costumers, there are plenty…
The post Holiday Phishing: Office 365 appeared first on TrustedSec.
Dumping Embedded Java Classes
A few months ago, I came across a piece of Java malware. This was a nice change of pace for me, since most of what I see is written in C/C++. The malware was heavily obfuscated using a common tool, Allatori v5.3. After working my way manually through decoding, I came to a point where…
The post Dumping Embedded Java Classes appeared first on TrustedSec.
Protected: Malware Analysis is for the (Cuckoo) Birds – Working with Proxmox
There is no excerpt because this is a protected post.
The post Protected: Malware Analysis is for the (Cuckoo) Birds – Working with Proxmox appeared first on TrustedSec.
Continue reading Protected: Malware Analysis is for the (Cuckoo) Birds – Working with Proxmox