Research reports
1,224 reports from 387 publishers45 added in the past week
3 reports, newest added first
Added Thu 23 Jul
[QuickNote] Mustang Panda ToneShell (APT S1239) Beacon Shellcode – RE Analysis
Sample: 32-bit Windows shellcode, position-independent (decoded and loaded via SolidPDFCreator.dll – see Campaign 3 DLL report) Family: Mustang Panda ToneShell (APT tracking: S1239 / Hive0154 / Earth Preta) Note on the ToneShell similarity: It is a ToneShell…
State-sponsored
Added Fri 10 Apr
Quick analysis note about DealPly (Adware)
DealPly adware abuses Microsoft, McAfee services to evade detection Adware.DealPly The post focuses on the following main sections: Unpack wrapper/loader to get main Dll payload. Decrypt C2url and strings are used in the malware code. Sample: SHA-256:…
Malware
Added Sun 5 Apr
Manual Unpacking IcedID Write-up
SHA256: 76cd290b236b11bd18d81e75e41682208e4c0a5701ce7834a9e289ea9e06eb7e Tools: PE files static analysis: PortExAnalyzer; PE-bear Debugger & plugin: x64dbg + ScyllaHide Anti-Anti-Debug Aplib decompress: aplib-ripper 1. Static Analysis Thow the sample to…
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.