Internet Storm Center
Sign In
Sign Up
Handler on Duty:
Guy Bruneau
Threat Level:
green
Date
Author
Title
SPAM MALWARE H1N1 VACCINATION CDC
2009-12-02
Rob VandenBrink
SPAM and Malware taking advantage of H1N1 concerns
SPAM
2024-05-27/a>
Jan Kopriva
Files with TXZ extension used as malspam attachments
2024-02-05/a>
Jesse La Grew
Public Information and Email Spam
2024-01-03/a>
Jan Kopriva
Interesting large and small malspam attachments from 2023
2023-11-08/a>
Xavier Mertens
Example of Phishing Campaign Project File
2023-10-29/a>
Guy Bruneau
Spam or Phishing? Looking for Credentials & Passwords
2023-06-29/a>
Brad Duncan
GuLoader- or DBatLoader/ModiLoader-style infection for Remcos RAT
2023-05-30/a>
Brad Duncan
Malspam pushes ModiLoader (DBatLoader) infection for Remcos RAT
2023-04-12/a>
Brad Duncan
Recent IcedID (Bokbot) activity
2023-01-19/a>
Jan Kopriva
SPF and DMARC use on 100k most popular domains
2023-01-05/a>
Brad Duncan
More Brazil malspam pushing Astaroth (Guildma) in January 2023
2022-12-02/a>
Brad Duncan
obama224 distribution Qakbot tries .vhd (virtual hard disk) images
2022-11-19/a>
Guy Bruneau
McAfee Fake Antivirus Phishing Campaign is Back!
2022-10-15/a>
Guy Bruneau
Malware - Covid Vaccination Supplier Declaration
2022-08-19/a>
Brad Duncan
Brazil malspam pushes Astaroth (Guildma) malware
2022-07-07/a>
Brad Duncan
Emotet infection with Cobalt Strike
2022-06-17/a>
Brad Duncan
Malspam pushes Matanbuchus malware, leads to Cobalt Strike
2022-04-06/a>
Brad Duncan
Windows MetaStealer Malware
2022-03-16/a>
Brad Duncan
Qakbot infection with Cobalt Strike and VNC activity
2022-02-09/a>
Brad Duncan
Example of Cobalt Strike from Emotet infection
2022-01-25/a>
Brad Duncan
Emotet Stops Using 0.0.0.0 in Spambot Traffic
2021-12-31/a>
Jan Kopriva
Do you want your Agent Tesla in the 300 MB or 8 kB package?
2021-12-22/a>
Brad Duncan
December 2021 Forensic Contest: Answers and Analysis
2021-12-20/a>
Jan Kopriva
PowerPoint attachments, Agent Tesla and code reuse in malware
2021-11-16/a>
Brad Duncan
Emotet Returns
2021-10-22/a>
Brad Duncan
October 2021 Contest: Forensic Challenge
2021-09-17/a>
Xavier Mertens
Malicious Calendar Subscriptions Are Back?
2021-09-02/a>
Xavier Mertens
Attackers Will Always Abuse Major Events in our Lifes
2021-08-13/a>
Brad Duncan
Example of Danabot distributed through malspam
2021-07-26/a>
Didier Stevens
Failed Malspam: Recovering The Password
2021-07-14/a>
Jan Kopriva
One way to fail at malspam - give recipients the wrong password for an encrypted attachment
2021-05-29/a>
Guy Bruneau
Spear-phishing Email Targeting Outlook Mail Clients
2021-04-16/a>
Rick Wanner
Querying Spamhaus for IP reputation
2021-04-06/a>
Jan Kopriva
Malspam with Lokibot vs. Outlook and RFCs
2021-03-05/a>
Xavier Mertens
Spam Farm Spotted in the Wild
2021-02-24/a>
Brad Duncan
Malspam pushes GuLoader for Remcos RAT
2021-02-17/a>
Brad Duncan
Malspam pushing Trickbot gtag rob13
2021-01-20/a>
Brad Duncan
Qakbot activity resumes after holiday break
2021-01-13/a>
Brad Duncan
Hancitor activity resumes after a hoilday break
2020-12-09/a>
Brad Duncan
Recent Qakbot (Qbot) activity
2020-10-31/a>
Didier Stevens
More File Selection Gaffes
2020-10-14/a>
Brad Duncan
More TA551 (Shathak) Word docs push IcedID (Bokbot)
2020-08-07/a>
Brad Duncan
TA551 (Shathak) Word docs push IcedID (Bokbot)
2020-07-10/a>
Brad Duncan
Excel spreasheet macro kicks off Formbook infection
2020-06-16/a>
Johannes Ullrich
Odd "Protest" Spam (Scam?) Targeting Atlanta Police Foundation
2020-06-10/a>
Brad Duncan
Job application-themed malspam pushes ZLoader
2020-05-13/a>
Brad Duncan
Malspam with links to zip archives pushes Dridex malware
2020-04-08/a>
Brad Duncan
German malspam pushes ZLoader malware
2020-04-01/a>
Brad Duncan
Qakbot malspam sent from an infected Windows host
2020-03-25/a>
Brad Duncan
Recent Dridex activity
2020-03-05/a>
Xavier Mertens
Will You Put Your Password in a Survey?
2020-02-12/a>
Brad Duncan
Malpsam pushes Ursnif through Italian language Word docs
2020-02-03/a>
Jan Kopriva
Analysis of a triple-encrypted AZORult downloader
2020-01-22/a>
Brad Duncan
German language malspam pushes Ursnif
2020-01-16/a>
Jan Kopriva
Picks of 2019 malware - the large, the small and the one full of null bytes
2019-12-18/a>
Brad Duncan
Emotet infection with spambot activity
2019-12-11/a>
Brad Duncan
German language malspam pushes yet another wave of Trickbot
2019-12-03/a>
Brad Duncan
Ursnif infection with Dridex
2019-11-20/a>
Brad Duncan
Hancitor infection with Pony, Evil Pony, Ursnif, and Cobalt Strike
2019-11-13/a>
Brad Duncan
An example of malspam pushing Lokibot malware, November 2019
2019-11-09/a>
Guy Bruneau
Fake Netflix Update Request by Text
2019-11-06/a>
Brad Duncan
More malspam pushing Formbook
2019-10-02/a>
Brad Duncan
A recent example of Emotet malspam
2019-10-01/a>
Johannes Ullrich
A Quick Look at Some Current Comment Spam
2019-09-25/a>
Brad Duncan
Malspam pushing Quasar RAT
2019-09-18/a>
Brad Duncan
Emotet malspam is back
2019-06-18/a>
Brad Duncan
Malspam with password-protected Word docs pushing Dridex
2019-04-07/a>
Guy Bruneau
Fake Office 365 Payment Information Update
2019-03-21/a>
Xavier Mertens
New Wave of Extortion Emails: Central Intelligence Agency Case
2019-03-13/a>
Brad Duncan
Malspam pushes Emotet with Qakbot as the follow-up malware
2019-03-06/a>
Brad Duncan
Malspam with password-protected word docs still pushing IcedID (Bokbot) with Trickbot
2019-02-20/a>
Brad Duncan
More Russian language malspam pushing Shade (Troldesh) ransomware
2019-02-06/a>
Brad Duncan
Hancitor malspam and infection traffic from Tuesday 2019-02-05
2019-01-24/a>
Brad Duncan
Malspam with Word docs uses macro to run Powershell script and steal system data
2019-01-16/a>
Brad Duncan
Emotet infections and follow-up malware
2019-01-10/a>
Brad Duncan
Heartbreaking Emails: "Love You" Malspam
2018-12-18/a>
Brad Duncan
Malspam links to password-protected Word docs that push IcedID (Bokbot)
2018-12-05/a>
Brad Duncan
Campaign evolution: Hancitor changes its Word macros
2018-12-04/a>
Brad Duncan
Malspam pushing Lokibot malware
2018-11-29/a>
Brad Duncan
Russian language malspam pushing Shade (Troldesh) ransomware
2018-11-15/a>
Brad Duncan
Emotet infection with IcedID banking Trojan
2018-11-14/a>
Brad Duncan
Day in the life of a researcher: Finding a wave of Trickbot malspam
2018-10-31/a>
Brad Duncan
More malspam using password-protected Word docs
2018-10-30/a>
Brad Duncan
Campaign evolution: Hancitor malspam starts pushing Ursnif this week
2018-10-05/a>
Jim Clausing
A strange spam
2018-09-26/a>
Brad Duncan
One Emotet infection leads to three follow-up malware infections
2018-08-15/a>
Brad Duncan
More malspam pushing password-protected Word docs for AZORult and Hermes Ransomware
2018-08-02/a>
Brad Duncan
DHL-themed malspam reveals embedded malware in animated gif
2018-07-27/a>
Brad Duncan
Malspam with password-protected Word docs pushes Hermes ransomware
2018-07-24/a>
Brad Duncan
Recent Emotet activity
2018-06-18/a>
Xavier Mertens
Malicious JavaScript Targeting Mobile Browsers
2018-06-13/a>
Xavier Mertens
A Bunch of Compromized Wordpress Sites
2018-03-02/a>
Xavier Mertens
Common Patterns Used in Phishing Campaigns Files
2018-02-01/a>
Xavier Mertens
Adaptive Phishing Kit
2017-12-18/a>
Didier Stevens
Phish or scam? - Part 2
2017-12-17/a>
Didier Stevens
Phish or scam? - Part 1
2017-11-30/a>
Brad Duncan
More Malspam pushing Emotet malware
2017-10-19/a>
Brad Duncan
HSBC-themed malspam uses ISO attachments to push Loki Bot malware
2017-10-17/a>
Brad Duncan
Hancitor malspam uses DDE attack
2017-09-18/a>
Xavier Mertens
Getting some intelligence from malspam
2017-09-01/a>
Brad Duncan
Malspam pushing Locky ransomware tries HoeflerText notifications for Chrome and FireFox
2017-08-14/a>
Didier Stevens
Sometimes it's just SPAM
2017-07-26/a>
Brad Duncan
Malspam pushing Emotet malware
2017-07-14/a>
Brad Duncan
NemucodAES and the malspam that distributes it
2017-06-28/a>
Brad Duncan
Catching up with Blank Slate: a malspam campaign still going strong
2017-05-24/a>
Brad Duncan
Jaff ransomware gets a makeover
2017-04-11/a>
Brad Duncan
Dridex malspam seen on Monday 2017-04-10
2017-03-28/a>
Xavier Mertens
Logical & Physical Security Correlation
2017-02-10/a>
Brad Duncan
Hancitor/Pony malspam
2016-10-25/a>
Xavier Mertens
Another Day, Another Spam...
2016-10-19/a>
Xavier Mertens
Spam Delivered via .ICS Files
2016-06-20/a>
Xavier Mertens
Ongoing Spam Campaign Related to Swift
2016-05-12/a>
Xavier Mertens
Another Day, Another Wave of Phishing Emails
2015-12-06/a>
Mark Hofman
Malware SPAM a new run has started.
2015-09-01/a>
Daniel Wesemann
Gift card from Marriott?
2015-06-22/a>
Johannes Ullrich
SMTP Brute Forcing
2015-04-09/a>
Brad Duncan
An example of the malicious emails sometimes sent to the ISC handler addresses
2015-03-23/a>
Rick Wanner
Interesting Home Depot Spam
2015-01-31/a>
Guy Bruneau
Beware of Phishing and Spam Super Bowl Fans!
2014-09-17/a>
Daniel Wesemann
Your online background check is now public!
2014-08-05/a>
Johannes Ullrich
Legal Threat Spam: Sometimes it Gets Personal
2014-06-17/a>
Rob VandenBrink
Canada's Anti-Spam Legislation (CASL) 2014
2014-06-08/a>
Guy Bruneau
efax Spam Containing Malware
2014-04-05/a>
Jim Clausing
Those strange e-mails with URLs in them can lead to Android malware
2014-03-22/a>
Guy Bruneau
How the Compromise of a User Account Lead to a Spam Incident
2014-02-21/a>
Johannes Ullrich
UPS Malware Spam Using Fake SPF Headers
2014-01-24/a>
Johannes Ullrich
How to send mass e-mail the right way
2013-12-24/a>
Daniel Wesemann
Mr Jones wants you to appear in court!
2013-10-17/a>
Adrien de Beaupre
New spamming technique - onmicrosoft.com
2013-09-30/a>
Adrien de Beaupre
Twitter DM spam/malware
2013-09-03/a>
Rob VandenBrink
Is "Reputation Backscatter" a Thing?
2013-07-18/a>
Chris Mohan
Blog Spam - annoying junk or a source of intelligence?
2013-03-28/a>
John Bambenek
Where Were You During the Great DDoS Cybergeddon of 2013?
2013-03-26/a>
Daniel Wesemann
How your Webhosting Account is Getting Abused
2013-03-18/a>
Kevin Shortt
Spamhaus DDOS
2013-02-08/a>
Kevin Shortt
Is it Spam or Is it Malware?
2012-12-06/a>
Daniel Wesemann
Rich Quick Make Money!
2012-10-10/a>
Kevin Shortt
Facebook Scam Spam
2012-09-09/a>
Guy Bruneau
Phishing/Spam Pretending to be from BBB
2012-08-22/a>
Adrien de Beaupre
Phishing/spam via SMS
2012-03-21/a>
Johannes Ullrich
Virus Bulletin Spam Filter Test
2012-02-17/a>
Mark Hofman
Intersting Facebook SPAM
2011-11-28/a>
Rob VandenBrink
It's Cyber Monday - Click Here!
2011-11-16/a>
Adrien de Beaupre
GET BACK TO ME ASAP
2011-10-20/a>
Johannes Ullrich
Evil Printers Sending Mail
2011-08-31/a>
Johannes Ullrich
Phishing e-mail to custom e-mail addresses
2011-06-30/a>
Guy Bruneau
Symantec Report - Spam Surge against Social Networks
2011-06-27/a>
Kevin Shortt
Phishy Spam
2011-06-08/a>
Johannes Ullrich
Spam from compromised Hotmail accounts
2011-03-29/a>
Daniel Wesemann
Requesting deletion of "free" email and chat accounts
2011-01-11/a>
Kevin Shortt
Spam Cannons on Holiday
2010-12-03/a>
Mark Hofman
T'is the season to be SPAMMY, trallalalaa la la la laaa
2010-11-22/a>
Lenny Zeltser
Adobe Acrobat Spam Going Strong - More to Come?
2010-09-18/a>
Rick Wanner
I'm fine, thanks!
2010-08-29/a>
Swa Frantzen
Abandoned free email accounts
2010-07-15/a>
Deborah Hale
Be on the Alert
2010-07-03/a>
Deborah Hale
Delivery Status Failure Notice That Packed A Wallop
2010-06-21/a>
Adrien de Beaupre
GoDaddy Scam/Phish/Spam
2010-06-10/a>
Deborah Hale
Another Morning of Fun
2010-06-02/a>
Rob VandenBrink
SPAM pretending to be from Habitat for Humanity
2010-04-22/a>
Deborah Hale
Don't Be Fooled by Twitter Spam in Your Inbox
2010-04-13/a>
Johannes Ullrich
More Legal Threat Malware E-Mail
2010-03-17/a>
Deborah Hale
Spam was killing us! Here is what we did to help!
2010-03-15/a>
Adrien de Beaupre
Spamassassin Milter Plugin Remote Root Attack
2010-02-03/a>
Johannes Ullrich
Anatomy of a Form Spam Campaign (in progress against isc.sans.org right now) https://blogs.sans.org/appsecstreetfighter/
2009-12-02/a>
Rob VandenBrink
SPAM and Malware taking advantage of H1N1 concerns
2009-11-03/a>
Andre Ludwig
SURBL now posting abuse statistics for TLD's
2009-10-12/a>
Mark Hofman
Some interesting SSL SPAM
2009-10-08/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 8 - Port 25 - SMTP
2009-10-07/a>
Joel Esler
Spam rate increase is seen
2009-09-10/a>
Johannes Ullrich
Healthcare Spam
2009-07-28/a>
Adrien de Beaupre
Twitter spam/phish
2009-06-25/a>
Mark Hofman
Michael J & Farrah F death SPAM
2009-06-20/a>
Scott Fendley
Situational Awareness: Spam Crisis and China
2009-04-06/a>
Adrien de Beaupre
Abuse addresses
2009-01-25/a>
Rick Wanner
Twam?? Twammers?
2009-01-16/a>
G. N. White
...and all that SPAM - Evolution of Spam Bots in 2009
2008-09-09/a>
Swa Frantzen
The complaint that's an attack
2008-08-13/a>
Adrien de Beaupre
CNN switched to MSNBC
2008-08-10/a>
Stephen Hall
Fake IE 7 update spam doing the rounds
2008-08-06/a>
Bojan Zdrnja
When spammers use your own e-mails
2008-08-05/a>
Daniel Wesemann
The news update you never asked for
2008-05-02/a>
Adrien de Beaupre
Hi, remember me?...
2008-04-22/a>
donald smith
Spam to your calendar via Google agenda?
2008-03-26/a>
Raul Siles
ORDB.org blocklisting all IP addresses
2006-10-08/a>
Swa Frantzen
Spam Backscatter
MALWARE
2024-11-30/a>
Xavier Mertens
From a Regular Infostealer to its Obfuscated Version
2024-11-22/a>
Xavier Mertens
An Infostealer Searching for « BIP-0039 » Data
2024-11-19/a>
Xavier Mertens
Detecting the Presence of a Debugger in Linux
2024-11-07/a>
Xavier Mertens
Steam Account Checker Poisoned with Infostealer
2024-11-05/a>
Xavier Mertens
Python RAT with a Nice Screensharing Feature
2024-10-09/a>
Xavier Mertens
From Perfctl to InfoStealer
2024-09-18/a>
Xavier Mertens
Python Infostealer Patching Windows Exodus App
2024-09-17/a>
Xavier Mertens
23:59, Time to Exfiltrate!
2024-09-16/a>
Xavier Mertens
Managing PE Files With Overlays
2024-09-11/a>
Guy Bruneau
Hygiene, Hygiene, Hygiene! [Guest Diary]
2024-08-27/a>
Xavier Mertens
Why Is Python so Popular to Infect Windows Hosts?
2024-08-26/a>
Xavier Mertens
From Highly Obfuscated Batch File to XWorm and Redline
2024-08-19/a>
Xavier Mertens
Do you Like Donuts? Here is a Donut Shellcode Delivered Through PowerShell/Python
2024-08-14/a>
Xavier Mertens
Multiple Malware Dropped Through MSI Package
2024-07-26/a>
Xavier Mertens
ExelaStealer Delivered "From Russia With Love"
2024-07-25/a>
Xavier Mertens
XWorm Hidden With Process Hollowing
2024-07-24/a>
Xavier Mertens
"Mouse Logger" Malicious Python Script
2024-06-06/a>
Xavier Mertens
Malicious Python Script with a "Best Before" Date
2024-05-28/a>
Guy Bruneau
Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-05-22/a>
Guy Bruneau
Analysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary]
2024-04-29/a>
Guy Bruneau
Linux Trojan - Xorddos with Filename eyshcjdmzg
2024-04-25/a>
Jesse La Grew
Does it matter if iptables isn't running on my honeypot?
2024-03-28/a>
Xavier Mertens
From JavaScript to AsyncRAT
2024-03-13/a>
Xavier Mertens
Using ChatGPT to Deobfuscate Malicious Scripts
2024-02-29/a>
Jesse La Grew
[Guest Diary] Dissecting DarkGate: Modular Malware Delivery and Persistence as a Service.
2024-02-08/a>
Xavier Mertens
A Python MP3 Player with Builtin Keylogger Capability
2024-02-06/a>
Jan Kopriva
Computer viruses are celebrating their 40th birthday (well, 54th, really)
2024-01-26/a>
Xavier Mertens
A Batch File With Multiple Payloads
2024-01-25/a>
Xavier Mertens
Facebook AdsManager Targeted by a Python Infostealer
2024-01-24/a>
Johannes Ullrich
How Bad User Interfaces Make Security Tools Harmful
2024-01-19/a>
Xavier Mertens
macOS Python Script Replacing Wallet Applications with Rogue Apps
2024-01-07/a>
Guy Bruneau
Suspicious Prometei Botnet Activity
2024-01-03/a>
Jan Kopriva
Interesting large and small malspam attachments from 2023
2023-12-22/a>
Xavier Mertens
Shall We Play a Game?
2023-11-18/a>
Xavier Mertens
Quasar RAT Delivered Through Updated SharpLoader
2023-11-15/a>
Xavier Mertens
Redline Dropped Through MSIX Package
2023-11-09/a>
Xavier Mertens
Visual Examples of Code Injection
2023-11-01/a>
Xavier Mertens
Malware Dropped Through a ZPAQ Archive
2023-10-31/a>
Xavier Mertens
Multiple Layers of Anti-Sandboxing Techniques
2023-10-28/a>
Xavier Mertens
Size Matters for Many Security Controls
2023-10-18/a>
Jesse La Grew
Hiding in Hex
2023-09-30/a>
Xavier Mertens
Simple Netcat Backdoor in Python Script
2023-09-29/a>
Xavier Mertens
Are You Still Storing Passwords In Plain Text Files?
2023-08-25/a>
Xavier Mertens
Python Malware Using Postgresql for C2 Communications
2023-08-23/a>
Xavier Mertens
More Exotic Excel Files Dropping AgentTesla
2023-08-22/a>
Xavier Mertens
Have You Ever Heard of the Fernet Encryption Algorithm?
2023-08-21/a>
Xavier Mertens
Quick Malware Triage With Inotify Tools
2023-08-20/a>
Guy Bruneau
SystemBC Malware Activity
2023-08-18/a>
Xavier Mertens
From a Zalando Phishing to a RAT
2023-08-11/a>
Xavier Mertens
Show me All Your Windows!
2023-08-03/a>
Jan Kopriva
From small LNK to large malicious BAT file with zero VT score
2023-07-29/a>
Xavier Mertens
Do Attackers Pay More Attention to IPv6?
2023-07-28/a>
Xavier Mertens
ShellCode Hidden with Steganography
2023-07-26/a>
Xavier Mertens
Suspicious IP Addresses Avoided by Malware Samples
2023-06-27/a>
Xavier Mertens
The Importance of Malware Triage
2023-06-23/a>
Xavier Mertens
Word Document with an Online Attached Template
2023-06-21/a>
Yee Ching Tok
Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators
2023-06-20/a>
Xavier Mertens
Malicious Code Can Be Anywhere
2023-06-19/a>
Xavier Mertens
Malware Delivered Through .inf File
2023-06-16/a>
Xavier Mertens
Another RAT Delivered Through VBS
2023-05-17/a>
Xavier Mertens
Increase in Malicious RAR SFX files
2023-04-07/a>
Xavier Mertens
Detecting Suspicious API Usage with YARA Rules
2023-04-04/a>
Johannes Ullrich
Analyzing the efile.com Malware "efail"
2023-03-30/a>
Xavier Mertens
Bypassing PowerShell Strong Obfuscation
2023-03-26/a>
Didier Stevens
Extra: "String Obfuscation: Character Pair Reversal"
2023-03-01/a>
Xavier Mertens
Python Infostealer Targeting Gamers
2023-02-09/a>
Xavier Mertens
A Backdoor with Smart Screenshot Capability
2023-02-04/a>
Guy Bruneau
Assemblyline as a Malware Analysis Sandbox
2023-01-25/a>
Xavier Mertens
A First Malicious OneNote Document
2023-01-16/a>
Johannes Ullrich
PSA: Why you must run an ad blocker when using Google
2023-01-06/a>
Xavier Mertens
AutoIT Remains Popular in the Malware Landscape
2023-01-05/a>
Brad Duncan
More Brazil malspam pushing Astaroth (Guildma) in January 2023
2022-12-21/a>
Guy Bruneau
DShield Sensor Setup in Azure
2022-12-18/a>
Guy Bruneau
Infostealer Malware with Double Extension
2022-11-19/a>
Guy Bruneau
McAfee Fake Antivirus Phishing Campaign is Back!
2022-11-09/a>
Xavier Mertens
Another Script-Based Ransomware
2022-11-05/a>
Guy Bruneau
Windows Malware with VHD Extension
2022-11-04/a>
Xavier Mertens
Remcos Downloader with Unicode Obfuscation
2022-10-24/a>
Xavier Mertens
C2 Communications Through outlook.com
2022-10-21/a>
Brad Duncan
sczriptzzbn inject pushes malware for NetSupport RAT
2022-10-18/a>
Xavier Mertens
Python Obfuscation for Dummies
2022-10-17/a>
Xavier Mertens
Fileless Powershell Dropper
2022-10-15/a>
Guy Bruneau
Malware - Covid Vaccination Supplier Declaration
2022-10-07/a>
Xavier Mertens
Powershell Backdoor with DGA Capability
2022-09-25/a>
Didier Stevens
Downloading Samples From Takendown Domains
2022-09-24/a>
Didier Stevens
Maldoc Analysis Info On MalwareBazaar
2022-09-23/a>
Xavier Mertens
Kids Like Cookies, Malware Too!
2022-09-22/a>
Xavier Mertens
RAT Delivered Through FODHelper
2022-09-15/a>
Xavier Mertens
Malicious Word Document with a Frameset
2022-09-14/a>
Xavier Mertens
Easy Process Injection within Python
2022-09-10/a>
Guy Bruneau
Phishing Word Documents with Suspicious URL
2022-09-03/a>
Didier Stevens
Video: James Webb JPEG With Malware
2022-09-02/a>
Didier Stevens
James Webb JPEG With Malware
2022-08-30/a>
Johannes Ullrich
Two things that will never die: bash scripts and IRC!
2022-08-22/a>
Xavier Mertens
32 or 64 bits Malware?
2022-07-29/a>
Johannes Ullrich
PDF Analysis Intro and OpenActions Entries
2022-07-25/a>
Xavier Mertens
PowerShell Script with Fileless Capability
2022-07-20/a>
Xavier Mertens
Malicious Python Script Behaving Like a Rubber Ducky
2022-06-25/a>
Xavier Mertens
Malicious Code Passed to PowerShell via the Clipboard
2022-06-22/a>
Xavier Mertens
Malicious PowerShell Targeting Cryptocurrency Browser Extensions
2022-06-16/a>
Xavier Mertens
Houdini is Back Delivered Through a JavaScript Dropper
2022-06-04/a>
Guy Bruneau
Spam Email Contains a Very Large ISO file
2022-06-03/a>
Xavier Mertens
Sandbox Evasion... With Just a Filename!
2022-05-31/a>
Xavier Mertens
First Exploitation of Follina Seen in the Wild
2022-05-20/a>
Xavier Mertens
A 'Zip Bomb' to Bypass Security Controls & Sandboxes
2022-05-19/a>
Brad Duncan
Bumblebee Malware from TransferXL URLs
2022-05-11/a>
Brad Duncan
TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
2022-05-07/a>
Guy Bruneau
Phishing PDF Received in my ISC Mailbox
2022-05-06/a>
Jan Kopriva
What is the simplest malware in the world?
2022-05-05/a>
Brad Duncan
Password-protected Excel spreadsheet pushes Remcos RAT
2022-04-21/a>
Xavier Mertens
Multi-Cryptocurrency Clipboard Swapper
2022-04-06/a>
Brad Duncan
Windows MetaStealer Malware
2022-03-25/a>
Xavier Mertens
XLSB Files: Because Binary is Stealthier Than XML
2022-03-24/a>
Xavier Mertens
Malware Delivered Through Free Sharing Tool
2022-03-23/a>
Brad Duncan
Arkei Variants: From Vidar to Mars Stealer
2022-03-11/a>
Xavier Mertens
Keep an Eye on WebSockets
2022-03-09/a>
Xavier Mertens
Infostealer in a Batch File
2022-02-22/a>
Xavier Mertens
A Good Old Equation Editor Vulnerability Delivering Malware
2022-02-18/a>
Xavier Mertens
Remcos RAT Delivered Through Double Compressed Archive
2022-02-11/a>
Xavier Mertens
CinaRAT Delivered Through HTML ID Attributes
2022-01-20/a>
Xavier Mertens
RedLine Stealer Delivered Through FTP
2022-01-07/a>
Xavier Mertens
Custom Python RAT Builder
2022-01-06/a>
Xavier Mertens
Malicious Python Script Targeting Chinese People
2022-01-05/a>
Xavier Mertens
Code Reuse In the Malware Landscape
2021-12-21/a>
Xavier Mertens
More Undetected PowerShell Dropper
2021-12-15/a>
Xavier Mertens
Simple but Undetected PowerShell Backdoor
2021-12-03/a>
Xavier Mertens
The UPX Packer Will Never Die!
2021-12-02/a>
Brad Duncan
TA551 (Shathak) pushes IcedID (Bokbot)
2021-11-19/a>
Xavier Mertens
Downloader Disguised as Excel Add-In (XLL)
2021-11-18/a>
Xavier Mertens
JavaScript Downloader Delivers Agent Tesla Trojan
2021-10-21/a>
Brad Duncan
"Stolen Images Evidence" campaign pushes Sliver-based malware
2021-10-01/a>
Xavier Mertens
New Tool to Add to Your LOLBAS List: cvtres.exe
2021-09-23/a>
Xavier Mertens
Excel Recipe: Some VBA Code with a Touch of Excel4 Macro
2021-09-01/a>
Brad Duncan
STRRAT: a Java-based RAT that doesn't care if you have Java
2021-08-30/a>
Xavier Mertens
Cryptocurrency Clipboard Swapper Delivered With Love
2021-08-20/a>
Xavier Mertens
Waiting for the C2 to Show Up
2021-08-15/a>
Didier Stevens
Simple Tips For Triage Of MALWARE Bazaar's Daily Malware Batches
2021-08-07/a>
Didier Stevens
MALWARE Bazaar "Download daily malware batches"
2021-08-06/a>
Xavier Mertens
Malicious Microsoft Word Remains A Key Infection Vector
2021-07-30/a>
Xavier Mertens
Infected With a .reg File
2021-07-29/a>
Xavier Mertens
Malicious Content Delivered Through archive.org
2021-07-24/a>
Xavier Mertens
Agent.Tesla Dropped via a .daa Image and Talking to Telegram
2021-07-16/a>
Xavier Mertens
Multiple BaseXX Obfuscations
2021-07-06/a>
Xavier Mertens
Python DLL Injection Check
2021-06-30/a>
Brad Duncan
June 2021 Forensic Contest: Answers and Analysis
2021-06-11/a>
Xavier Mertens
Keeping an Eye on Dangerous Python Modules
2021-06-09/a>
Jan Kopriva
Architecture, compilers and black magic, or "what else affects the ability of AVs to detect malicious files"
2021-06-04/a>
Xavier Mertens
Russian Dolls VBS Obfuscation
2021-05-28/a>
Xavier Mertens
Malicious PowerShell Hosted on script.google.com
2021-05-27/a>
Jan Kopriva
All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not
2021-05-21/a>
Xavier Mertens
Locking Kernel32.dll As Anti-Debugging Technique
2021-05-19/a>
Brad Duncan
May 2021 Forensic Contest: Answers and Analysis
2021-05-18/a>
Xavier Mertens
From RunDLL32 to JavaScript then PowerShell
2021-05-06/a>
Xavier Mertens
Alternative Ways To Perform Basic Tasks
2021-05-05/a>
Brad Duncan
May 2021 Forensic Contest
2021-04-29/a>
Xavier Mertens
From Python to .Net
2021-04-28/a>
Xavier Mertens
Deeper Analyzis of my Last Malicious PowerPoint Add-On
2021-04-23/a>
Xavier Mertens
Malicious PowerPoint Add-On: "Small Is Beautiful"
2021-04-09/a>
Xavier Mertens
No Python Interpreter? This Simple RAT Installs Its Own Copy
2021-04-08/a>
Xavier Mertens
Simple Powershell Ransomware Creating a 7Z Archive of your Files
2021-04-06/a>
Jan Kopriva
Malspam with Lokibot vs. Outlook and RFCs
2021-04-02/a>
Xavier Mertens
C2 Activity: Sandboxes or Real Victims?
2021-04-01/a>
Brad Duncan
April 2021 Forensic Quiz
2021-03-31/a>
Xavier Mertens
Quick Analysis of a Modular InfoStealer
2021-03-19/a>
Xavier Mertens
Pastebin.com Used As a Simple C2 Channel
2021-03-18/a>
Xavier Mertens
Simple Python Keylogger
2021-03-17/a>
Xavier Mertens
Defenders, Know Your Operating System Like Attackers Do!
2021-03-16/a>
Jan Kopriva
50 years of malware? Not really. 50 years of computer worms? That's a different story...
2021-03-04/a>
Xavier Mertens
From VBS, PowerShell, C Sharp, Process Hollowing to RAT
2021-02-19/a>
Xavier Mertens
Dynamic Data Exchange (DDE) is Back in the Wild?
2021-02-14/a>
Didier Stevens
Video: tshark & Malware Analysis
2021-02-12/a>
Xavier Mertens
AgentTesla Dropped Through Automatic Click in Microsoft Help File
2021-02-11/a>
Jan Kopriva
Agent Tesla hidden in a historical anti-malware tool
2021-02-03/a>
Brad Duncan
Excel spreadsheets push SystemBC malware
2021-02-02/a>
Xavier Mertens
New Example of XSL Script Processing aka "Mitre T1220"
2021-01-22/a>
Xavier Mertens
Another File Extension to Block in your MTA: .jnlp
2021-01-21/a>
Xavier Mertens
Powershell Dropping a REvil Ransomware
2021-01-04/a>
Jan Kopriva
From a small BAT file to Mass Logger infostealer
2021-01-02/a>
Guy Bruneau
Protecting Home Office and Enterprise in 2021
2020-12-24/a>
Xavier Mertens
Malicious Word Document Delivering an Octopus Backdoor
2020-12-22/a>
Xavier Mertens
Malware Victim Selection Through WiFi Identification
2020-12-03/a>
Brad Duncan
Traffic Analysis Quiz: Mr Natural
2020-11-25/a>
Xavier Mertens
Live Patching Windows API Calls Using PowerShell
2020-11-23/a>
Didier Stevens
Quick Tip: Cobalt Strike Beacon Analysis
2020-11-09/a>
Xavier Mertens
How Attackers Brush Up Their Malicious Scripts
2020-10-25/a>
Didier Stevens
Video: Pascal Strings
2020-10-21/a>
Daniel Wesemann
Shipping dangerous goods
2020-09-24/a>
Xavier Mertens
Party in Ibiza with PowerShell
2020-09-23/a>
Xavier Mertens
Malicious Word Document with Dynamic Content
2020-09-18/a>
Xavier Mertens
A Mix of Python & VBA in a Malicious Word Document
2020-09-15/a>
Brad Duncan
Traffic Analysis Quiz: Oh No... Another Infection!
2020-09-04/a>
Jan Kopriva
A blast from the past - XXEncoded VB6.0 Trojan
2020-09-03/a>
Xavier Mertens
Sandbox Evasion Using NTP
2020-08-28/a>
Xavier Mertens
Example of Malicious DLL Injected in PowerShell
2020-08-26/a>
Xavier Mertens
Malicious Excel Sheet with a NULL VT Score
2020-08-24/a>
Xavier Mertens
Tracking A Malware Campaign Through VT
2020-08-19/a>
Xavier Mertens
Example of Word Document Delivering Qakbot
2020-08-18/a>
Xavier Mertens
Using API's to Track Attackers
2020-08-14/a>
Jan Kopriva
Definition of 'overkill' - using 130 MB executable to hide 24 kB malware
2020-08-06/a>
Xavier Mertens
A Fork of the FTCode Powershell Ransomware
2020-08-05/a>
Brad Duncan
Traffic Analysis Quiz: What's the Malware From This Infection?
2020-07-24/a>
Xavier Mertens
Compromized Desktop Applications by Web Technologies
2020-07-15/a>
Brad Duncan
Word docs with macros for IcedID (Bokbot)
2020-07-10/a>
Brad Duncan
Excel spreasheet macro kicks off Formbook infection
2020-07-08/a>
Xavier Mertens
If You Want Something Done Right, You Have To Do It Yourself... Malware Too!
2020-06-13/a>
Guy Bruneau
Mirai Botnet Activity
2020-06-04/a>
Xavier Mertens
Anti-Debugging Technique based on Memory Protection
2020-06-01/a>
Jim Clausing
Stackstrings, type 2
2020-05-23/a>
Xavier Mertens
AgentTesla Delivered via a Malicious PowerPoint Add-In
2020-05-21/a>
Xavier Mertens
Malware Triage with FLOSS: API Calls Based Behavior
2020-05-20/a>
Brad Duncan
Microsoft Word document with malicious macro pushes IcedID (Bokbot)
2020-05-06/a>
Xavier Mertens
Keeping an Eye on Malicious Files Life Time
2020-04-27/a>
Xavier Mertens
Powershell Payload Stored in a PSCredential Object
2020-04-25/a>
Didier Stevens
MALWARE Bazaar
2020-04-24/a>
Xavier Mertens
Malicious Excel With a Strong Obfuscation and Sandbox Evasion
2020-04-20/a>
Didier Stevens
KPOT AutoIt Script: Analysis
2020-04-17/a>
Xavier Mertens
Weaponized RTF Document Generator & Mailer in PowerShell
2020-04-12/a>
Didier Stevens
Reader Analysis: "Dynamic analysis technique to get decrypted KPOT Malware."
2020-04-10/a>
Xavier Mertens
PowerShell Sample Extracting Payload From SSL
2020-04-03/a>
Xavier Mertens
Obfuscated with a Simple 0x0A
2020-03-31/a>
Johannes Ullrich
Kwampirs Targeted Attacks Involving Healthcare Sector
2020-03-27/a>
Xavier Mertens
Malicious JavaScript Dropping Payload in the Registry
2020-03-26/a>
Xavier Mertens
Very Large Sample as Evasion Technique?
2020-03-23/a>
Didier Stevens
KPOT Deployed via AutoIt Script
2020-03-22/a>
Didier Stevens
More COVID-19 Themed Malware
2020-03-21/a>
Guy Bruneau
Honeypot - Scanning and Targeting Devices & Services
2020-03-19/a>
Xavier Mertens
COVID-19 Themed Multistage Malware
2020-03-11/a>
Xavier Mertens
Agent Tesla Delivered via Fake Canon EOS Notification on Free OwnCloud Account
2020-03-06/a>
Xavier Mertens
A Safe Excel Sheet Not So Safe
2020-02-21/a>
Xavier Mertens
Quick Analysis of an Encrypted Compound Document Format
2020-02-14/a>
Xavier Mertens
Keep an Eye on Command-Line Browsers
2020-02-07/a>
Xavier Mertens
Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript
2020-02-03/a>
Jan Kopriva
Analysis of a triple-encrypted AZORult downloader
2020-01-16/a>
Jan Kopriva
Picks of 2019 malware - the large, the small and the one full of null bytes
2020-01-10/a>
Xavier Mertens
More Data Exfiltration
2020-01-09/a>
Xavier Mertens
Quick Analyzis of a(nother) Maldoc
2020-01-02/a>
Xavier Mertens
Ransomware in Node.js
2019-12-24/a>
Brad Duncan
Malspam with links to Word docs pushes IcedID (Bokbot)
2019-12-12/a>
Xavier Mertens
Code & Data Reuse in the Malware Ecosystem
2019-11-23/a>
Guy Bruneau
Local Malware Analysis with Malice
2019-10-18/a>
Xavier Mertens
Quick Malicious VBS Analysis
2019-10-03/a>
Xavier Mertens
"Lost_Files" Ransomware
2019-09-19/a>
Xavier Mertens
Agent Tesla Trojan Abusing Corporate Email Accounts
2019-08-30/a>
Xavier Mertens
Malware Dropping a Local Node.js Instance
2019-08-28/a>
Xavier Mertens
Malware Samples Compiling Their Next Stage on Premise
2019-08-22/a>
Xavier Mertens
Simple Mimikatz & RDPWrapper Dropper
2019-08-18/a>
Didier Stevens
Video: Analyzing DAA Files
2019-08-16/a>
Didier Stevens
The DAA File Format
2019-08-12/a>
Didier Stevens
Malicious .DAA Attachments
2019-07-18/a>
Xavier Mertens
Malicious PHP Script Back on Stage?
2019-07-11/a>
Xavier Mertens
Russian Dolls Malicious Script Delivering Ursnif
2019-07-02/a>
Xavier Mertens
Malicious Script With Multiple Payloads
2019-06-14/a>
Jim Clausing
A few Ghidra tips for IDA users, part 4 - function call graphs
2019-06-10/a>
Xavier Mertens
Interesting JavaScript Obfuscation Example
2019-05-29/a>
Xavier Mertens
Behavioural Malware Analysis with Microsoft ASA
2019-05-13/a>
Xavier Mertens
From Phishing To Ransomware?
2019-05-03/a>
Jim Clausing
A few Ghidra tips for IDA users, part 3 - conversion, labels, and comments
2019-05-01/a>
Xavier Mertens
Another Day, Another Suspicious UDF File
2019-04-19/a>
Didier Stevens
Analyzing UDF Files with Python
2019-04-17/a>
Jim Clausing
A few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-17/a>
Xavier Mertens
Malware Sample Delivered Through UDF Image
2019-04-08/a>
Jim Clausing
A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-03/a>
Jim Clausing
A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2019-03-30/a>
Didier Stevens
"404" is not Malware
2019-03-10/a>
Didier Stevens
Malicious HTA Analysis by a Reader
2019-03-10/a>
Didier Stevens
Quick and Dirty Malicious HTA Analysis
2019-02-14/a>
Xavier Mertens
Old H-Worm Delivered Through GitHub
2019-01-16/a>
Brad Duncan
Emotet infections and follow-up malware
2019-01-06/a>
Didier Stevens
Malicious .tar Attachments
2019-01-05/a>
Didier Stevens
A Malicious JPEG? Second Example
2019-01-04/a>
Didier Stevens
A Malicious JPEG?
2019-01-02/a>
Xavier Mertens
Malicious Script Leaking Data via FTP
2018-12-09/a>
Didier Stevens
Quickie: String Analysis is Still Useful
2018-12-08/a>
Didier Stevens
Reader Malware Submission: MHT File Inside a ZIP File
2018-11-27/a>
Xavier Mertens
More obfuscated shell scripts: Fake MacOS Flash update
2018-11-26/a>
Xavier Mertens
Obfuscated bash script targeting QNap boxes
2018-11-22/a>
Xavier Mertens
Divided Payload in Multiple Pasties
2018-11-06/a>
Xavier Mertens
Malicious Powershell Script Dissection
2018-10-23/a>
Xavier Mertens
Diving into Malicious AutoIT Code
2018-10-22/a>
Xavier Mertens
Malicious Powershell using a Decoy Picture
2018-10-21/a>
Pasquale Stirparo
Beyond good ol’ LaunchAgent - part 0
2018-10-12/a>
Xavier Mertens
More Equation Editor Exploit Waves
2018-09-28/a>
Xavier Mertens
More Excel DDE Code Injection
2018-09-22/a>
Didier Stevens
Suspicious DNS Requests ... Issued by a Firewall
2018-09-16/a>
Didier Stevens
20/20 malware vision
2018-09-13/a>
Xavier Mertens
Malware Delivered Through MHT Files
2018-09-05/a>
Xavier Mertens
Malicious PowerShell Compiling C# Code on the Fly
2018-08-31/a>
Jim Clausing
Quickie: Using radare2 to disassemble shellcode
2018-08-30/a>
Xavier Mertens
Crypto Mining Is More Popular Than Ever!
2018-08-26/a>
Didier Stevens
Identifying numeric obfuscation
2018-08-26/a>
Didier Stevens
"When was this machine infected?"
2018-08-24/a>
Xavier Mertens
Microsoft Publisher Files Delivering Malware
2018-08-21/a>
Xavier Mertens
Malicious DLL Loaded Through AutoIT
2018-08-06/a>
Didier Stevens
Numeric obfuscation: another example
2018-08-04/a>
Didier Stevens
Dealing with numeric obfuscation in malicious scripts
2018-08-02/a>
Brad Duncan
DHL-themed malspam reveals embedded malware in animated gif
2018-07-26/a>
Xavier Mertens
Windows Batch File Deobfuscation
2018-07-09/a>
Renato Marinho
Criminals Don't Read Instructions or Use Strong Passwords
2018-06-07/a>
Remco Verhoef
Automated twitter loot collection
2018-06-05/a>
Xavier Mertens
Malicious Post-Exploitation Batch File
2018-06-01/a>
Remco Verhoef
Binary analysis with Radare2
2018-05-22/a>
Xavier Mertens
Malware Distributed via .slk Files
2018-05-19/a>
Xavier Mertens
Malicious Powershell Targeting UK Bank Customers
2018-05-09/a>
Xavier Mertens
Nice Phishing Sample Delivering Trickbot
2018-05-07/a>
Xavier Mertens
Adding Persistence Via Scheduled Tasks
2018-05-01/a>
Xavier Mertens
Diving into a Simple Maldoc Generator
2018-03-05/a>
Xavier Mertens
Malicious Bash Script with Multiple Features
2018-03-04/a>
Xavier Mertens
The Crypto Miners Fight For CPU Cycles
2018-02-25/a>
Didier Stevens
Retrieving malware over Tor on Windows
2018-02-02/a>
Xavier Mertens
Simple but Effective Malicious XLS Sheet
2018-01-28/a>
Didier Stevens
Is this a pentest?
2018-01-26/a>
Xavier Mertens
Investigating Microsoft BITS Activity
2018-01-25/a>
Xavier Mertens
Ransomware as a Service
2018-01-11/a>
Xavier Mertens
Mining or Nothing!
2017-12-19/a>
Xavier Mertens
Example of 'MouseOver' Link in a Powerpoint File
2017-12-16/a>
Xavier Mertens
Microsoft Office VBA Macro Obfuscation via Metadata
2017-11-29/a>
Xavier Mertens
Fileless Malicious PowerShell Sample
2017-11-16/a>
Xavier Mertens
Suspicious Domains Tracking Dashboard
2017-11-15/a>
Xavier Mertens
If you want something done right, do it yourself!
2017-11-13/a>
Guy Bruneau
VBE Embeded Script (info.zip)
2017-11-07/a>
Xavier Mertens
Interesting VBA Dropper
2017-11-03/a>
Xavier Mertens
Simple Analysis of an Obfuscated JAR File
2017-10-31/a>
Xavier Mertens
Some Powershell Malicious Code
2017-10-29/a>
Didier Stevens
Remember ACE files?
2017-10-24/a>
Xavier Mertens
BadRabbit: New ransomware wave hitting RU & UA
2017-10-15/a>
Didier Stevens
Peeking into .msg files
2017-09-09/a>
Didier Stevens
Malware analysis output sanitization
2017-09-02/a>
Xavier Mertens
AutoIT based malware back in the wild
2017-08-26/a>
Didier Stevens
Malware analysis: searching for dots
2017-08-25/a>
Xavier Mertens
Malicious AutoIT script delivered in a self-extracting RAR file
2017-08-23/a>
Xavier Mertens
Malicious script dropping an executable signed by Avast?
2017-08-18/a>
Renato Marinho
EngineBox Malware Supports 10+ Brazilian Banks
2017-07-21/a>
Didier Stevens
Malicious .iso Attachments
2017-07-09/a>
Russ McRee
Adversary hunting with SOF-ELK
2017-07-05/a>
Didier Stevens
Selecting domains with random names
2017-06-22/a>
Xavier Mertens
Obfuscating without XOR
2017-06-06/a>
Didier Stevens
Malware and XOR - Part 2
2017-06-05/a>
Didier Stevens
Malware and XOR - Part 1
2017-05-16/a>
Russ McRee
WannaCry? Do your own data analysis.
2017-05-13/a>
Guy Bruneau
Microsoft Released Guidance for WannaCrypt
2017-04-28/a>
Xavier Mertens
Another Day, Another Obfuscation Technique
2017-04-19/a>
Xavier Mertens
Hunting for Malicious Excel Sheets
2017-04-05/a>
Xavier Mertens
Whitelists: The Holy Grail of Attackers
2017-03-18/a>
Xavier Mertens
Example of Multiple Stages Dropper
2017-03-12/a>
Guy Bruneau
Honeypot Logs and Tracking a VBE Script
2017-03-08/a>
Xavier Mertens
Not All Malware Samples Are Complex
2017-02-05/a>
Xavier Mertens
Many Malware Samples Found on Pastebin
2017-01-31/a>
Johannes Ullrich
Malicious Office files using fileless UAC bypass to drop KEYBASE malware
2017-01-24/a>
Xavier Mertens
Malicious SVG Files in the Wild
2017-01-06/a>
John Bambenek
Ransomware Operators Cold Calling UK Schools to Get Malware Through
2017-01-05/a>
John Bambenek
New Year's Resolution: Build Your Own Malware Lab?
2017-01-01/a>
Didier Stevens
py2exe Decompiling - Part 1
2016-12-13/a>
Xavier Mertens
UAC Bypass in JScript Dropper
2016-11-11/a>
Rick Wanner
Benevolent malware? reincarna/Linux.Wifatch
2016-10-30/a>
Pasquale Stirparo
Volatility Bot: Automated Memory Analysis
2016-09-30/a>
Xavier Mertens
Another Day, Another Malicious Behaviour
2016-09-13/a>
Rob VandenBrink
If it's Free, YOU are the Product
2016-09-05/a>
Xavier Mertens
Malware Delivered via '.pub' Files
2016-09-01/a>
Xavier Mertens
Maxmind.com (Ab)used As Anti-Analysis Technique
2016-08-25/a>
Xavier Mertens
Out-of-Band iOS Patch Fixes 0-Day Vulnerabilities
2016-08-24/a>
Xavier Mertens
Example of Targeted Attack Through a Proxy PAC File
2016-08-23/a>
Xavier Mertens
Voice Message Notifications Deliver Ransomware
2016-08-01/a>
Daniel Wesemann
Are you getting I-CANNED ?
2016-07-27/a>
Xavier Mertens
Analyze of a Linux botnet client source code
2016-07-25/a>
Didier Stevens
Python Malware - Part 4
2016-07-16/a>
Didier Stevens
Python Malware - Part 3
2016-07-12/a>
Xavier Mertens
Hunting for Malicious Files with MISP + OSSEC
2016-06-20/a>
Xavier Mertens
Ongoing Spam Campaign Related to Swift
2016-06-18/a>
Rob VandenBrink
Controlling JavaScript Malware Before it Runs
2016-05-15/a>
Didier Stevens
Python Malware - Part 1
2016-05-13/a>
Xavier Mertens
MISP - Malware Information Sharing Platform
2016-05-05/a>
Xavier Mertens
Microsoft BITS Used to Download Payloads
2016-05-02/a>
Rick Wanner
Fake Chrome update for Android
2016-04-21/a>
Daniel Wesemann
Decoding Pseudo-Darkleech (#1)
2016-04-21/a>
Daniel Wesemann
Decoding Pseudo-Darkleech (Part #2)
2016-04-10/a>
Didier Stevens
Handling Malware Samples
2016-03-07/a>
Xavier Mertens
Another Malicious Document, Another Way to Deliver Malicious Code
2016-02-24/a>
Xavier Mertens
Analyzis of a Malicious .lnk File with an Embedded Payload
2016-02-18/a>
Xavier Mertens
Hunting for Executable Code in Windows Environments
2016-02-11/a>
Tom Webb
Tomcat IR with XOR.DDoS
2016-01-24/a>
Didier Stevens
Obfuscated MIME Files
2016-01-15/a>
Xavier Mertens
JavaScript Deobfuscation Tool
2016-01-01/a>
Didier Stevens
Failure Is An Option
2015-12-26/a>
Didier Stevens
Malfunctioning Malware
2015-12-16/a>
Xavier Mertens
Playing With Sandboxes Like a Boss
2015-12-06/a>
Mark Hofman
Malware SPAM a new run has started.
2015-11-09/a>
John Bambenek
Protecting Users and Enterprises from the Mobile Malware Threat
2015-09-29/a>
Pedro Bueno
Tricks for DLL analysis
2015-09-28/a>
Johannes Ullrich
"Transport of London" Malicious E-Mail
2015-09-21/a>
Xavier Mertens
Detecting XCodeGhost Activity
2015-04-24/a>
Basil Alawi S.Taher
Fileless Malware
2015-04-09/a>
Brad Duncan
An example of the malicious emails sometimes sent to the ISC handler addresses
2015-03-18/a>
Daniel Wesemann
New SANS memory forensics poster
2015-03-14/a>
Didier Stevens
Maldoc VBA Sandbox/Virtualization Detection
2015-03-08/a>
Brad Duncan
What Happened to You, Asprox Botnet?
2015-02-19/a>
Daniel Wesemann
Macros? Really?!
2014-10-03/a>
Johannes Ullrich
CSAM: The Power of Virustotal to Turn Harmless Binaries Malicious
2014-09-22/a>
Johannes Ullrich
Fake LogMeIn Certificate Update with Bad AV Detection Rate
2014-08-06/a>
Chris Mohan
Free Service to Help CryptoLocker Victims by FireEye and Fox-IT
2014-07-22/a>
Daniel Wesemann
Ivan's Order of Magnitude
2014-07-19/a>
Russ McRee
Keeping the RATs out: the trap is sprung - Part 3
2014-07-18/a>
Russ McRee
Keeping the RATs out: **it happens - Part 2
2014-07-18/a>
Russ McRee
Gameover Zeus reported as "returned from the dead"
2014-07-16/a>
Russ McRee
Keeping the RATs out: an exercise in building IOCs - Part 1
2014-07-05/a>
Guy Bruneau
Malware Analysis with pedump
2014-06-22/a>
Russ McRee
OfficeMalScanner helps identify the source of a compromise
2014-06-08/a>
Guy Bruneau
efax Spam Containing Malware
2014-04-06/a>
Basil Alawi S.Taher
"Power Worm" PowerShell based Malware
2014-04-05/a>
Jim Clausing
Those strange e-mails with URLs in them can lead to Android malware
2014-03-04/a>
Daniel Wesemann
XPired!
2014-02-28/a>
Daniel Wesemann
Fiesta!
2014-01-19/a>
Rick Wanner
Anatomy of a Malware distribution campaign
2013-12-24/a>
Daniel Wesemann
Mr Jones wants you to appear in court!
2013-12-23/a>
Daniel Wesemann
Costco, BestBuy, Walmart really want to send you a package!
2013-12-07/a>
Guy Bruneau
Suspected Active Rovnix Botnet Controller
2013-11-02/a>
Rick Wanner
Protecting Your Family's Computers
2013-10-31/a>
Russ McRee
Happy Halloween: The Ghost Really May Be In The Machine
2013-10-30/a>
Russ McRee
SIR v15: Five good reasons to leave Windows XP behind
2013-10-28/a>
Daniel Wesemann
Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities
2013-10-24/a>
Johannes Ullrich
False Positive: php.net Malware Alert
2013-09-30/a>
Adrien de Beaupre
Twitter DM spam/malware
2013-09-12/a>
Daniel Wesemann
37.58.73.42 / 95.156.228.69 / 195.210.43.42, anyone?
2013-09-10/a>
Swa Frantzen
Macs need to patch too!
2013-08-29/a>
Russ McRee
Suspect Sendori software
2013-07-04/a>
Russ McRee
Celebrating 4th of July With a Malware PCAP Visualization
2013-06-18/a>
Russ McRee
Volatility rules...any questions?
2013-05-21/a>
Adrien de Beaupre
Moore, Oklahoma tornado charitable organization scams, malware, and phishing
2013-05-17/a>
Daniel Wesemann
e-netprotections.su ?
2013-05-16/a>
Daniel Wesemann
Extracting signatures from Apple .apps
2013-05-11/a>
Lenny Zeltser
Extracting Digital Signatures from Signed Malware
2013-05-01/a>
Daniel Wesemann
The cost of cleaning up
2013-04-10/a>
Manuel Humberto Santander Pelaez
Massive Google scam sent by email to Colombian domains
2013-03-22/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence - Part 4
2013-03-20/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence - Part 3
2013-03-19/a>
Johannes Ullrich
Scam of the day: More fake CNN e-mails
2013-03-15/a>
Mark Baggett
AVG detect legit file as virus
2013-03-14/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence - Part 2
2013-03-13/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1
2013-02-25/a>
Johannes Ullrich
Mass-Customized Malware Lures: Don't trust your cat!
2013-01-08/a>
Jim Clausing
Cuckoo 0.5 is out and the world didn't end
2012-12-18/a>
Rob VandenBrink
All I Want for Christmas is to Not Get Hacked !
2012-12-03/a>
Kevin Liston
Mobile Malware: Request for Field Reports
2012-11-02/a>
Daniel Wesemann
Lamiabiocasa
2012-11-01/a>
Daniel Wesemann
Patched your Java yet?
2012-10-14/a>
Pedro Bueno
Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1
2012-09-21/a>
Guy Bruneau
Storing your Collection of Malware Samples with Malwarehouse
2012-09-14/a>
Lenny Zeltser
Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-07-21/a>
Rick Wanner
OpenDNS is looking for a few good malware people!
2012-07-05/a>
Adrien de Beaupre
New OS X trojan backdoor MaControl variant reported
2012-06-27/a>
Swa Frantzen
Online Banking Heists
2012-06-26/a>
Daniel Wesemann
Run, Forest! (Update)
2012-06-25/a>
Rick Wanner
Targeted Malware for Industrial Espionage?
2012-06-25/a>
Swa Frantzen
Belgian online banking customers hacked.
2012-06-22/a>
Daniel Wesemann
Run, Forest!
2012-06-21/a>
Raul Siles
Print Bomb? (Take 2)
2012-06-21/a>
Russ McRee
Analysis of drive-by attack sample set
2012-06-19/a>
Daniel Wesemann
Vulnerabilityqueerprocessbrittleness
2012-06-04/a>
Lenny Zeltser
Decoding Common XOR Obfuscation in Malicious Code
2012-04-26/a>
Richard Porter
Define Irony: A medical device with a Virus?
2012-04-25/a>
Daniel Wesemann
Blacole's obfuscated JavaScript
2012-04-25/a>
Daniel Wesemann
Blacole's shell code
2012-04-12/a>
Guy Bruneau
HP ProCurve 5400 zl Switch, Flash Cards Infected with Malware
2012-04-12/a>
Guy Bruneau
Apple Java Updates for Mac OS X
2012-03-25/a>
Daniel Wesemann
evilcode.class
2012-03-03/a>
Jim Clausing
New automated sandbox for Android malware
2012-02-24/a>
Guy Bruneau
Flashback Trojan in the Wild
2012-02-20/a>
Pedro Bueno
Simple Malware Research Tools
2012-02-20/a>
Rick Wanner
DNSChanger resolver shutdown deadline is March 8th
2012-01-14/a>
Daniel Wesemann
Hello, Antony!
2011-12-28/a>
Daniel Wesemann
.nl.ai ?
2011-12-10/a>
Daniel Wesemann
Unwanted Presents
2011-12-07/a>
Lenny Zeltser
V8 as an Alternative to SpiderMonkey for JavaScript Deobfuscation
2011-11-04/a>
Guy Bruneau
Duqu Mitigation
2011-10-20/a>
Johannes Ullrich
Evil Printers Sending Mail
2011-09-07/a>
Lenny Zeltser
Analyzing Mobile Device Malware - Honeynet Forensic Challenge 9 and Some Tools
2011-08-29/a>
Kevin Shortt
Internet Worm in the Wild
2011-06-15/a>
Pedro Bueno
Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)...
2011-05-25/a>
Daniel Wesemann
Apple advisory on "MacDefender" malware
2011-05-19/a>
Daniel Wesemann
Fake AV Bingo
2011-05-14/a>
Guy Bruneau
Websense Study Claims Canada Next Hotbed for Cybercrime Web Hosting Activity
2011-05-03/a>
Johannes Ullrich
Update on Osama Bin Laden themed Malware
2011-05-02/a>
Johannes Ullrich
Bin Laden Death Related Malware
2011-04-23/a>
Manuel Humberto Santander Pelaez
Image search can lead to malware download
2011-03-01/a>
Daniel Wesemann
AV software and "sharing samples"
2011-02-07/a>
Pedro Bueno
The Good , the Bad and the Unknown Online Scanners
2011-02-01/a>
Lenny Zeltser
The Importance of HTTP Headers When Investigating Malicious Sites
2010-12-29/a>
Daniel Wesemann
Malware Domains 2234.in, 0000002.in & co
2010-12-29/a>
Daniel Wesemann
Beware of strange web sites bearing gifts ...
2010-10-26/a>
Pedro Bueno
Cyber Security Awareness Month - Day 26 - Sharing Office Files
2010-09-09/a>
Marcus Sachs
'Here You Have' Email
2010-07-21/a>
Adrien de Beaupre
Dell PowerEdge R410 replacement motherboard firmware contains malware
2010-07-21/a>
Adrien de Beaupre
autorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010-07-06/a>
Rob VandenBrink
Bogus Support Organizations use Live Operators to Install Malware
2010-07-04/a>
Manuel Humberto Santander Pelaez
Malware inside PDF Files
2010-06-17/a>
Deborah Hale
FYI - Another bogus site
2010-06-14/a>
Manuel Humberto Santander Pelaez
Rogue facebook application acting like a worm
2010-06-07/a>
Manuel Humberto Santander Pelaez
Software Restriction Policy to keep malware away
2010-06-02/a>
Rob VandenBrink
New Mac malware - OSX/Onionspy
2010-05-26/a>
Bojan Zdrnja
Malware modularization and AV detection evasion
2010-05-23/a>
Manuel Humberto Santander Pelaez
e-mail scam announcing Fidel Castro's funeral ... and nasty malware to your computer.
2010-05-21/a>
Rick Wanner
IBM distributes malware at AusCERT!
2010-04-30/a>
Kevin Liston
The Importance of Small Files
2010-04-19/a>
Daniel Wesemann
Linked into scams?
2010-04-18/a>
Guy Bruneau
Some NetSol hosted sites breached
2010-04-13/a>
Johannes Ullrich
More Legal Threat Malware E-Mail
2010-03-30/a>
Pedro Bueno
Sharing the Tools
2010-03-26/a>
Daniel Wesemann
Getting the EXE out of the RTF again
2010-03-09/a>
Marcus Sachs
Energizer Malware
2010-03-04/a>
Daniel Wesemann
salefale-dot-com is bad
2010-03-03/a>
Johannes Ullrich
Reports about large number of fake Amazon order confirmations
2010-02-21/a>
Patrick Nolan
Looking for "more useful" malware information? Help develop the format.
2010-01-14/a>
Bojan Zdrnja
PDF Babushka
2010-01-07/a>
Daniel Wesemann
Static analysis of malicious PDFs
2010-01-07/a>
Daniel Wesemann
Static analysis of malicous PDFs (Part #2)
2009-12-17/a>
Daniel Wesemann
overlay.xul is back
2009-12-17/a>
Daniel Wesemann
In caches, danger lurks
2009-12-16/a>
Rob VandenBrink
Beware the Attack of the Christmas Greeting Cards !
2009-12-07/a>
Rick Wanner
Cheat Sheet: Analyzing Malicious Documents
2009-12-04/a>
Daniel Wesemann
Max Power's Malware Paradise
2009-12-02/a>
Rob VandenBrink
SPAM and Malware taking advantage of H1N1 concerns
2009-11-25/a>
Jim Clausing
Updates to my GREM Gold scripts and a new script
2009-09-25/a>
Lenny Zeltser
Categories of Common Malware Traits
2009-09-25/a>
Deborah Hale
Conficker Continues to Impact Networks
2009-09-25/a>
Deborah Hale
Malware delivered over Google and Yahoo Ad's?
2009-09-04/a>
Adrien de Beaupre
Fake anti-virus
2009-08-29/a>
Guy Bruneau
Immunet Protect - Cloud and Community Malware Protection
2009-08-26/a>
Johannes Ullrich
Malicious CD ROMs mailed to banks
2009-07-26/a>
Jim Clausing
New Volatility plugins
2009-07-03/a>
Adrien de Beaupre
Happy 4th of July!
2009-07-02/a>
Daniel Wesemann
Getting the EXE out of the RTF
2009-07-02/a>
Bojan Zdrnja
Cold Fusion web sites getting compromised
2009-06-16/a>
John Bambenek
Iran Internet Blackout: Using Twitter for Operational Intelligence
2009-06-16/a>
John Bambenek
URL Shortening Service Cligs Hacked
2009-06-04/a>
Raul Siles
Malware targetting banks ATM's
2009-06-04/a>
Raul Siles
Targeted e-mail attacks asking to verify wire transfer details
2009-06-01/a>
G. N. White
Yet another "Digital Certificate" malware campaign
2009-05-20/a>
Pedro Bueno
Cyber Warfare and Kylin thoughts
2009-05-07/a>
Deborah Hale
Malicious Content on the Web
2009-05-04/a>
Tom Liston
Facebook phishing malware
2009-04-24/a>
Pedro Bueno
Did you check your conference goodies?
2009-03-13/a>
Bojan Zdrnja
When web application security, Microsoft and the AV vendors all fail
2009-02-23/a>
Daniel Wesemann
Turf War
2009-02-23/a>
Daniel Wesemann
And the Oscar goes to...
2009-02-10/a>
Bojan Zdrnja
More tricks from Conficker and VM detection
2009-02-09/a>
Bojan Zdrnja
Some tricks from Conficker's bag
2009-02-04/a>
Daniel Wesemann
Titan Shields up!
2009-01-31/a>
John Bambenek
Google Search Engine's Malware Detection Broken
2009-01-24/a>
Pedro Bueno
Identifying and Removing the iWork09 Trojan
2009-01-18/a>
Daniel Wesemann
3322. org
2009-01-15/a>
Bojan Zdrnja
Conficker's autorun and social engineering
2009-01-12/a>
William Salusky
Downadup / Conficker - MS08-067 exploit and Windows domain account lockout
2009-01-07/a>
Bojan Zdrnja
An Israeli patriot program or a trojan
2009-01-02/a>
Rick Wanner
Tools on my Christmas list.
2008-12-25/a>
Maarten Van Horenbeeck
Merry Christmas, and beware of digital hitchhikers!
2008-12-25/a>
Maarten Van Horenbeeck
Christmas Ecard Malware
2008-12-17/a>
donald smith
Team CYMRU's Malware Hash Registry
2008-12-05/a>
Daniel Wesemann
Baby, baby!
2008-12-05/a>
Daniel Wesemann
Been updatin' your Flash player lately?
2008-12-04/a>
Bojan Zdrnja
Rogue DHCP servers
2008-11-17/a>
Jim Clausing
Finding stealth injected DLLs
2008-11-16/a>
Maarten Van Horenbeeck
Detection of Trojan control channels
2008-11-12/a>
John Bambenek
Thoughts on Security Intelligence (McColo Corp alleged spam/malware host knocked offline)
2008-11-11/a>
Swa Frantzen
Acrobat continued activity in the wild
2008-11-10/a>
Stephen Hall
Adobe Reader Vulnerability - part 2
2008-10-07/a>
Kyle Haugsness
Good reading and a malware challenge
2008-09-29/a>
Daniel Wesemann
ASPROX mutant
2008-09-22/a>
Maarten Van Horenbeeck
Data exfiltration and the use of anonymity providers
2008-09-18/a>
Bojan Zdrnja
Monitoring HTTP User-Agent fields
2008-09-07/a>
Lorna Hutcheson
Malware Analysis: Tools are only so good
2008-09-03/a>
Daniel Wesemann
Static analysis of Shellcode
2008-09-03/a>
Daniel Wesemann
Static analysis of Shellcode - Part 2
2008-09-01/a>
John Bambenek
The Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months
2008-08-13/a>
Adrien de Beaupre
CNN switched to MSNBC
2008-08-05/a>
Daniel Wesemann
The news update you never asked for
2008-07-20/a>
Kevin Liston
Malware Intelligence: Making it Actionable
2008-07-15/a>
Maarten Van Horenbeeck
Extracting scripts and data from suspect PDF files
2008-07-14/a>
Daniel Wesemann
Obfuscated JavaScript Redux
2008-07-07/a>
Pedro Bueno
Bad url classification
2008-06-18/a>
Marcus Sachs
Olympics Part II
2008-06-14/a>
Lorna Hutcheson
Malware Detection - Take the Blinders Off
2008-06-10/a>
Swa Frantzen
Ransomware keybreaking
2008-06-01/a>
Mark Hofman
Free Yahoo email account! Sign me up, Ok well maybe not.
2008-05-28/a>
Adrien de Beaupre
Another example of malicious SWF
2008-05-27/a>
Adrien de Beaupre
Malicious swf files?
2008-05-26/a>
Marcus Sachs
Predictable Response
2008-05-14/a>
Bojan Zdrnja
War of the worlds?
2008-05-02/a>
Adrien de Beaupre
Hi, remember me?...
2008-04-30/a>
Bojan Zdrnja
(Minor) evolution in Mac DNS changer malware
2008-04-24/a>
Maarten Van Horenbeeck
Targeted attacks using malicious PDF files
2008-04-16/a>
Bojan Zdrnja
The 10.000 web sites infection mystery solved
2008-04-15/a>
Johannes Ullrich
SRI Malware Threat Center
2008-04-14/a>
John Bambenek
A Federal Subpoena or Just Some More Spam & Malware?
2008-04-07/a>
John Bambenek
HP USB Keys Shipped with Malware for your Proliant Server
2008-04-07/a>
John Bambenek
Got Kraken?
2008-04-07/a>
John Bambenek
Kraken Technical Details: UPDATED x3
2008-04-06/a>
Daniel Wesemann
Advanced obfuscated JavaScript analysis
2008-04-04/a>
Daniel Wesemann
nmidahena
2008-04-03/a>
Bojan Zdrnja
VB detection: is it so difficult?
2008-04-02/a>
Adrien de Beaupre
When is a DMG file not a DMG file
2008-03-27/a>
Maarten Van Horenbeeck
Guarding the guardians: a story of PGP key ring theft
2006-08-31/a>
Swa Frantzen
NT botnet submitted
2000-01-02/a>
Deborah Hale
2010 A Look Back - 2011 A Look Ahead
H1N1
2009-12-02/a>
Rob VandenBrink
SPAM and Malware taking advantage of H1N1 concerns
2009-06-11/a>
Rick Wanner
WHO Declares Flu A(H1N1) a Pandemic
2009-05-02/a>
Rick Wanner
More Swine/Mexican/H1N1 related domains
VACCINATION
2009-12-02/a>
Rob VandenBrink
SPAM and Malware taking advantage of H1N1 concerns
CDC
2009-12-02/a>
Rob VandenBrink
SPAM and Malware taking advantage of H1N1 concerns
Homepage
Diaries
Podcasts
Jobs
Data
TCP/UDP Port Activity
Port Trends
SSH/Telnet Scanning Activity
Weblogs
Threat Feeds Activity
Threat Feeds Map
Useful InfoSec Links
Presentations & Papers
Research Papers
API
Tools
DShield Sensor
DNS Looking Glass
Honeypot (RPi/AWS)
InfoSec Glossary
Contact Us
Contact Us
About Us
Handlers
About Us
Slack Channel
Mastodon
Bluesky
X
This site is powered by
your submissions
, so tell us
what you see happening