MWLab

Recently I noticed the news about AI-generated malware which was hidden in images with pandas.

Recent TryHackMe room called “Block” inspired me to create this write-up.

When I looked on recent public submissions on Any.Run this week, my attention was attracted by XWorm samples with tags “stegocampaign”.

Between 1st-3rd November 2023, there was another CTF event - EKOPARTY CTF.

During the October 2023, I participated in the Huntress Capture the Flag contest.

Yesterday, as a part of a challenge in one CTF competition, I had to analyze a modified sample of AsyncRAT.

Last month I had two lectures about cyber attacks at Gamefair 2023 conference.

Poznámka: tento môj článok pôvodne vyšiel na blogu firmy IstroSec V druhej častí nášho prehľadu prinášame pokračovanie výberu z najpoužívanejších a najužitočnejších nástrojov na analýzu malvéru, ktoré sú navyše k dispozícii bezplatne.

Note: my article was originally published on IstroSec blog In the second part of our overview we continue with the selection of the most used and most usable malware analysis tools.

Poznámka: tento môj článok pôvodne vyšiel na blogu firmy IstroSec V tomto prehľade prinášame výber z najpoužívanejších a najužitočnejších nástrojov na analýzu malvéru, ktoré sú navyše k dispozícii bezplatne.

Note: my article was originally published on IstroSec blog In this overview we introduce the selection of the most used and most usable malware analysis tools.

Attackers compromised up to 1500 companies during massive ransomware attack, which is now reported as one of the largest cyber attacks ever.

DarkSide Ransomware is a very hot topic now, especially after the Compromise of Colonial Pipeline networks, which has been investigated by FBI, too.

Threat intelligence is one of the most critical weapons we can use in cyber defense.

IDA, the Interactive Disassembler, is well known tool.

Few weeks ago, I saw somewhere on the Internet question about IDA Freeware compatibility with the Fluorescence plugin.

In June, LIFARS team worked on engagement related to FIN6 threat actor.

In my recent post about XMRig-based CoinMiners spread by Blue Mockingbird Group based mainly on Case Study by LIFARS I wrote about multi-stage attack performed by this threat actor.

As I stated in the post about Synology in VirtualBox, I wondered about forensic analysis of Synology NAS, especially about memory acquisition.

Overview During March-May the Blue Mockingbird group infected thousands of computer systems, mainly in the enterprise environment.

Background A few days ago, we detected a PDF file with a non-zero detection score on VirusTotal, however, almost all the detections have only a kind of “generic” results.

I wondered about forensic analysis of Synology NAS, especially how to create a memory dump, but unfortunately, I was not able to find any useful howtos.

Some people asked me what tools can be useful for Incident Response and for the CSIRT/CERT teams, so I decided to prepare list of such tools and seize the opportunity of the Open Source Weekend in Košice, Slovakia on 19th October.

Few weeks ago I prepared the technical background of the CTF (Capture the Flag) for QuBit Conference Sofia 2019.

Introduction In the post about GandCrab String Decryption I use very simple heuristic for identifying the function for string decryption.

Introduction In the last arcitle about Ursnif campaign have been presented the ursnif powershell downloader, which was also able to download the GandCrab payload.

Introduction In the first part of this analysis have been presented the two types of macro-enabled documents with powershell downloader spreading via emails in recent campaign.

Overview During the first half of February 2019 there was an increase in occurrences of the Spam messages containing attached documents with the names in the form “Request” followed by the number, like “Request15.doc”.

Introduction My friend have got one USB stick infected with malware, at least that’s what one AntiVirus product reported about it.