Andromeda Bot Analysis part 1
Andromeda, also known as Win32/Gamarue, is an HTTP based botnet. It was first spotted in late 2011, and is still at this moment used a lot in herding. It has...
Malware analysis
MOOSE Malware: Analysis
Part One of this series was a very basic level, and had only thrown light on what Moose Malware actually is, as well as its components and related IoC's. In...
Win32/Lethic Botnet Analysis
Lethic is a spam botnet consisting of an estimated 210 000 - 310 000 individual machines which are mainly involved in pharmaceutical and replica spam. At the...
MOOSE Malware: Basics
In this article series, we will learn about a famous Linux family of malware known as MOOSE, which is used to steal unencrypted traffic over the wire and infect...
Analyzing and writing a local exploit
So far, in the previous articles, we learnt how to exploit an application remotely. We ran the Python script directly on the Machine B, which was the attacker...
Malware Researcher’s Handbook: Introduction
All the Stuff You Know Before Starting Research
Malware research contains a lot of information like reverse engineering, exploit-kit, exploit analysis, botnet...
Asprox / Kuluoz Botnet Analysis
Kuluoz, aka Asprox, is a spam botnet that emerged in 2007. It has been known for sending mass of phishing emails used in conjunction with social engineering...
Windows functions in malware analysis – cheat sheet – Part 1
In this article, we will learn briefly about the various windows functions commonly encountered by malware analysts.
Accept: This function is used to...
Mumblehard Malware
In this article, we will learn about a malware known as Mumblehard which is known for targeting Linux and BSD OS. This malware opens a backdoor that gives...
Dynamic Analysis Techniques
As we have covered the malware analysis basics with static techniques here, this post is all about performing the basic analysis of malware using dynamic technique.
As...