Most of my readeres exactly know what code caves are while many other people out there (maybe occasional readers) could wonder why I am writing about codecaves in 2016 since it is a well know technique (published in 2006) to inject a malicious payload inside Windows Portable Executables. Well, today I want to disclouse a […]Read more "Looking For Caves in Windows Executables"
Today I want to share a quick’n dirty analysis of a brand new Crypt0l0cker version realised for the Italian market and spread over emails (such as: ENEL Bolletta). Unfortunately I do not have much time to invest in that analysis but we will analyse how we might be able to recover mostly of the encrypted […]Read more "Recovering Files From Brand New Crypt0l0cker"
Even if Ransomware is not one of my favorite topics, since are simple Malware without specific targets (at least util today), I am currently observing a huge increment of this threat in companies, agencies and in private users as well. For such a reason I decided to write a little bit about them in my […]Read more "Ransomware: a general view after field experiences"
TOR is a well known “software” able to protect communications dispatching packets between different relays spread over the world run by a network of volunteers. Because the high rate of anonymity TOR has been used over the past years to cover malicious actions by physical and cyber attackers. TOR, especially through its browser implementation (the […]Read more "Spotting Malicious Node Relays"
Understanding the “sandbox” technology is a fundamental step in Malware prevention. While it is obvious the new evasion techniques such as (but not limited to); Malware Encryption, Malware Packing, Metamorphism and Polimorfism are able to evade romantic defensive technologies such as (but not limited to) AntiVirus, Intrusion Detection and Prevention Systems, URL Filtering and Proxy, […]Read more "SandBoxes personal evaluations"
Hello everybody, today is about speed improvements and new malware samples in malwarestats.org. If you followed the MalwareStats.org genesys you might remeber the early stage development where took between 8 to 10 minutes to visualize statistics over 43k Malware Analysis. Today it runs much better alost 15 seconds to visualize 76.2K Malware Analysis (ok, I […]Read more "MalwareStats.org: New "Speed" and New Samples Available now."
Hello everybody, today I’d like to share some infos on “Shifu” a new incredibly interesting banking trojan. At this point you might think: “Why are you writing about Shifu among many other new threats (even more discussed) out there ? “ Well… Shifu is a new banking trojan which actually attacks Japanese banks mostly, it’s […]Read more "Shifu: A new interesting Banking Trojan"
Often people, including students and security professionals asks me about Exploit kits (EK). EKs play a foundamental role in todays malware propagation because developed to deliver content through vulnerabilities. Aims of the EK is to exploit a target client machine through well known or sometimes “less known” vulnerabilities which usually target browsers, Java Runtime Environment, […]Read more "Exploit Kits on August 2015"
During the past month I’ve been dedicated some of my free time in building a Malware static analysis pipeline. Goal of this work is to give to Malware analists usefull statistics on what evasion techniques current Malware are implementing. If you are interested on Malware evasion techniques please have a look to my previous post […]Read more "Static Analysis Malware Statistics"
Let’s assume you’ve got a friend who asked you to have a look to his computer because he feels like something wrong is happening. What would you do? Option 1: “I have no idea about how to investigate on ‘computer stuff’, please contact your reseller “ Option 2: “Ok, Let me access to your computer, […]Read more "Volatility on Darkcomet"