Souhail Hammou

A screen locker is a malware in which the primary purpose is to lock the victim's screen by displaying a fearful message designed to invoke a high level of...

For those familiar with CTF contests, time is an important constraint that needs to be managed effectively to get as many points as possible. Most task write-ups...

In this second article on the dropper, we will resume our analysis right where we left off: the decryption of the key and data. After the decryption, two structures...

Avatar was first detected by ESET circulating in the wild in early 2013 [1]. However, no samples were collected for analysis until May of the same year. ESET...

In the previous part, we stopped right at when the decision of which approach to use to encrypt the data, i.e. either Petya or Mischa. In this article, we will...

What makes Petya a special ransomware is that it doesn't aim to encrypt each file individually, but aims for low-level disk encryption. In this series, we'll...

A race condition occurs when two or multiple running threads manipulate the same resources without any synchronization mechanism regulating access to these...

In this third and last part of the series on Pony Stealer, we're going to start where we left off last time: the encryption algorithm. After that, we'll take...

In the second part of this analysis, we will be exploring how Pony steals data and how it sends it to the C&C server. We are equally interested in knowing...

A stealer is a type of malware that looks for passwords stored on the machine and sends them remotely (e.g. mail, HTTP) to an attacker. Most stealers use a...