Category Archives: malware analysis

The rise of malicious Chrome extensions targeting Latin America

Posted on by

In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of […]

The post The rise of malicious Chrome extensions targeting Latin America appeared first on Security Intelligence.

Continue reading The rise of malicious Chrome extensions targeting Latin America→

TCP/IP Services Application in Windows 10 and it’s usage as DDoS client

Posted on by

Recently I’ve been hit with a virus which uses ‘Simple TCP/IP services’ in Windows 10. It was using quite a lot of upload bandwidth (pic 1) and sending chargen packets using UDP to several IPs that I checked with wireshark (pic 2)
pic 1:

… Continue reading TCP/IP Services Application in Windows 10 and it’s usage as DDoS client→

Obfuscation Using Python Bytecode

Posted on by

1.1      Introduction I love when I get tossed a piece of unique malware. Most of the time, malware is obfuscated using PowerShell or a dropper written in C. This time, however, it was obfuscated using Python. How fun! My first thought when I was asked to look at it was, “It’s Python. I’ll just read…

The post Obfuscation Using Python Bytecode appeared first on TrustedSec.

Continue reading Obfuscation Using Python Bytecode→

The Nightmare of Proc Hollow’s Exe

Posted on by

In the last blog on Parent Process ID (PPID) Spoofing, we discussed how to hide the malicious process by giving it a legit parent. In this blog, we are going to discuss yet another method of hiding malicious code, using Process Hollowing. At a high level, this is where malicious code launches a new process,…

The post The Nightmare of Proc Hollow’s Exe appeared first on TrustedSec.

Continue reading The Nightmare of Proc Hollow’s Exe→

PPID Spoofing: It’s Really this Easy to Fake Your Parent

Posted on by

1 New Blog Series on Common Malware Tactics and Tricks This will be the first post in a series of blogs covering some common malware tactics and tricks. The following list is of topics that will be discussed in these blogs. However, feel free to reach out if there is topic that is not on…

The post PPID Spoofing: It’s Really this Easy to Fake Your Parent appeared first on TrustedSec.

Continue reading PPID Spoofing: It’s Really this Easy to Fake Your Parent→

How to know if you have downloaded a malware on a virtual machine [duplicate]

Posted on by

First, I’m a complete beginner, my only experience in malware is running windows defender lol. But I will try my best to learn anything that you guys recommend.
My younger brother keeps downloading games from shady websites, thankfully til… Continue reading How to know if you have downloaded a malware on a virtual machine [duplicate]→

Ex-Conti and FIN7 Actors Collaborate with New Backdoor

Posted on by

Former Conti syndicate and FIN7 members have collaborated to use a new backdoor dubbed “Minodo” to deliver the Project Nemesis infostealer. Explore the intricate nature of cooperation among cybercriminal groups and their members with in-depth analysis from IBM Security X-Force experts.

The post Ex-Conti and FIN7 Actors Collaborate with New Backdoor appeared first on Security Intelligence.

Continue reading Ex-Conti and FIN7 Actors Collaborate with New Backdoor→