Diaries by Keyword - SANS Internet Storm Center

Handler on Duty: Didier Stevens

Threat Level: green

Date	Author	Title
UNSTOPPABLE TECH SUPPORT MALWARE VISH
2010-07-06	Rob VandenBrink	Bogus Support Organizations use Live Operators to Install Malware
UNSTOPPABLE
2010-07-06/a>	Rob VandenBrink	Bogus Support Organizations use Live Operators to Install Malware
TECH
2014-08-12/a>	Adrien de Beaupre	Host discovery with nmap
2013-04-29/a>	Adam Swanger	Report Fake Tech Support Calls submission form reminder
2010-07-06/a>	Rob VandenBrink	Bogus Support Organizations use Live Operators to Install Malware
2008-06-17/a>	Kyle Haugsness	Why go high-tech?
SUPPORT
2024-06-17/a>	Xavier Mertens	New NetSupport Campaign Delivered Through MSIX Packages
2023-08-18/a>	Xavier Mertens	From a Zalando Phishing to a RAT
2022-10-21/a>	Brad Duncan	sczriptzzbn inject pushes malware for NetSupport RAT
2020-02-05/a>	Brad Duncan	Fake browser update pages are "still a thing"
2015-06-27/a>	Guy Bruneau	Is Windows XP still around in your Network a year after Support Ended?
2014-07-05/a>	Guy Bruneau	Java Support ends for Windows XP
2012-12-06/a>	Daniel Wesemann	Fake tech support calls - revisited
2012-10-03/a>	Kevin Shortt	Fake Support Calls Reported
2011-05-23/a>	Mark Hofman	Microsoft Support Scam (again)
2010-07-06/a>	Rob VandenBrink	Bogus Support Organizations use Live Operators to Install Malware
2010-06-15/a>	Manuel Humberto Santander Pelaez	Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild
2010-03-01/a>	Mark Hofman	Microsoft will drop support for Vista (without any Service Packs) on April 13 and support for XP SP2 ends July 13. (i.e. no more security updates). If you are still running these, it it time to update.
2010-02-03/a>	Rob VandenBrink	Support for Legacy Browsers
MALWARE
2024-11-19/a>	Xavier Mertens	Detecting the Presence of a Debugger in Linux
2024-11-07/a>	Xavier Mertens	Steam Account Checker Poisoned with Infostealer
2024-11-05/a>	Xavier Mertens	Python RAT with a Nice Screensharing Feature
2024-10-09/a>	Xavier Mertens	From Perfctl to InfoStealer
2024-09-18/a>	Xavier Mertens	Python Infostealer Patching Windows Exodus App
2024-09-17/a>	Xavier Mertens	23:59, Time to Exfiltrate!
2024-09-16/a>	Xavier Mertens	Managing PE Files With Overlays
2024-09-11/a>	Guy Bruneau	Hygiene, Hygiene, Hygiene! [Guest Diary]
2024-08-27/a>	Xavier Mertens	Why Is Python so Popular to Infect Windows Hosts?
2024-08-26/a>	Xavier Mertens	From Highly Obfuscated Batch File to XWorm and Redline
2024-08-19/a>	Xavier Mertens	Do you Like Donuts? Here is a Donut Shellcode Delivered Through PowerShell/Python
2024-08-14/a>	Xavier Mertens	Multiple Malware Dropped Through MSI Package
2024-07-26/a>	Xavier Mertens	ExelaStealer Delivered "From Russia With Love"
2024-07-25/a>	Xavier Mertens	XWorm Hidden With Process Hollowing
2024-07-24/a>	Xavier Mertens	"Mouse Logger" Malicious Python Script
2024-06-06/a>	Xavier Mertens	Malicious Python Script with a "Best Before" Date
2024-05-28/a>	Guy Bruneau	Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-05-22/a>	Guy Bruneau	Analysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary]
2024-04-29/a>	Guy Bruneau	Linux Trojan - Xorddos with Filename eyshcjdmzg
2024-04-25/a>	Jesse La Grew	Does it matter if iptables isn't running on my honeypot?
2024-03-28/a>	Xavier Mertens	From JavaScript to AsyncRAT
2024-03-13/a>	Xavier Mertens	Using ChatGPT to Deobfuscate Malicious Scripts
2024-02-29/a>	Jesse La Grew	[Guest Diary] Dissecting DarkGate: Modular Malware Delivery and Persistence as a Service.
2024-02-08/a>	Xavier Mertens	A Python MP3 Player with Builtin Keylogger Capability
2024-02-06/a>	Jan Kopriva	Computer viruses are celebrating their 40th birthday (well, 54th, really)
2024-01-26/a>	Xavier Mertens	A Batch File With Multiple Payloads
2024-01-25/a>	Xavier Mertens	Facebook AdsManager Targeted by a Python Infostealer
2024-01-24/a>	Johannes Ullrich	How Bad User Interfaces Make Security Tools Harmful
2024-01-19/a>	Xavier Mertens	macOS Python Script Replacing Wallet Applications with Rogue Apps
2024-01-07/a>	Guy Bruneau	Suspicious Prometei Botnet Activity
2024-01-03/a>	Jan Kopriva	Interesting large and small malspam attachments from 2023
2023-12-22/a>	Xavier Mertens	Shall We Play a Game?
2023-11-18/a>	Xavier Mertens	Quasar RAT Delivered Through Updated SharpLoader
2023-11-15/a>	Xavier Mertens	Redline Dropped Through MSIX Package
2023-11-09/a>	Xavier Mertens	Visual Examples of Code Injection
2023-11-01/a>	Xavier Mertens	Malware Dropped Through a ZPAQ Archive
2023-10-31/a>	Xavier Mertens	Multiple Layers of Anti-Sandboxing Techniques
2023-10-28/a>	Xavier Mertens	Size Matters for Many Security Controls
2023-10-18/a>	Jesse La Grew	Hiding in Hex
2023-09-30/a>	Xavier Mertens	Simple Netcat Backdoor in Python Script
2023-09-29/a>	Xavier Mertens	Are You Still Storing Passwords In Plain Text Files?
2023-08-25/a>	Xavier Mertens	Python Malware Using Postgresql for C2 Communications
2023-08-23/a>	Xavier Mertens	More Exotic Excel Files Dropping AgentTesla
2023-08-22/a>	Xavier Mertens	Have You Ever Heard of the Fernet Encryption Algorithm?
2023-08-21/a>	Xavier Mertens	Quick Malware Triage With Inotify Tools
2023-08-20/a>	Guy Bruneau	SystemBC Malware Activity
2023-08-18/a>	Xavier Mertens	From a Zalando Phishing to a RAT
2023-08-11/a>	Xavier Mertens	Show me All Your Windows!
2023-08-03/a>	Jan Kopriva	From small LNK to large malicious BAT file with zero VT score
2023-07-29/a>	Xavier Mertens	Do Attackers Pay More Attention to IPv6?
2023-07-28/a>	Xavier Mertens	ShellCode Hidden with Steganography
2023-07-26/a>	Xavier Mertens	Suspicious IP Addresses Avoided by Malware Samples
2023-06-27/a>	Xavier Mertens	The Importance of Malware Triage
2023-06-23/a>	Xavier Mertens	Word Document with an Online Attached Template
2023-06-21/a>	Yee Ching Tok	Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators
2023-06-20/a>	Xavier Mertens	Malicious Code Can Be Anywhere
2023-06-19/a>	Xavier Mertens	Malware Delivered Through .inf File
2023-06-16/a>	Xavier Mertens	Another RAT Delivered Through VBS
2023-05-17/a>	Xavier Mertens	Increase in Malicious RAR SFX files
2023-04-07/a>	Xavier Mertens	Detecting Suspicious API Usage with YARA Rules
2023-04-04/a>	Johannes Ullrich	Analyzing the efile.com Malware "efail"
2023-03-30/a>	Xavier Mertens	Bypassing PowerShell Strong Obfuscation
2023-03-26/a>	Didier Stevens	Extra: "String Obfuscation: Character Pair Reversal"
2023-03-01/a>	Xavier Mertens	Python Infostealer Targeting Gamers
2023-02-09/a>	Xavier Mertens	A Backdoor with Smart Screenshot Capability
2023-02-04/a>	Guy Bruneau	Assemblyline as a Malware Analysis Sandbox
2023-01-25/a>	Xavier Mertens	A First Malicious OneNote Document
2023-01-16/a>	Johannes Ullrich	PSA: Why you must run an ad blocker when using Google
2023-01-06/a>	Xavier Mertens	AutoIT Remains Popular in the Malware Landscape
2023-01-05/a>	Brad Duncan	More Brazil malspam pushing Astaroth (Guildma) in January 2023
2022-12-21/a>	Guy Bruneau	DShield Sensor Setup in Azure
2022-12-18/a>	Guy Bruneau	Infostealer Malware with Double Extension
2022-11-19/a>	Guy Bruneau	McAfee Fake Antivirus Phishing Campaign is Back!
2022-11-09/a>	Xavier Mertens	Another Script-Based Ransomware
2022-11-05/a>	Guy Bruneau	Windows Malware with VHD Extension
2022-11-04/a>	Xavier Mertens	Remcos Downloader with Unicode Obfuscation
2022-10-24/a>	Xavier Mertens	C2 Communications Through outlook.com
2022-10-21/a>	Brad Duncan	sczriptzzbn inject pushes malware for NetSupport RAT
2022-10-18/a>	Xavier Mertens	Python Obfuscation for Dummies
2022-10-17/a>	Xavier Mertens	Fileless Powershell Dropper
2022-10-15/a>	Guy Bruneau	Malware - Covid Vaccination Supplier Declaration
2022-10-07/a>	Xavier Mertens	Powershell Backdoor with DGA Capability
2022-09-25/a>	Didier Stevens	Downloading Samples From Takendown Domains
2022-09-24/a>	Didier Stevens	Maldoc Analysis Info On MalwareBazaar
2022-09-23/a>	Xavier Mertens	Kids Like Cookies, Malware Too!
2022-09-22/a>	Xavier Mertens	RAT Delivered Through FODHelper
2022-09-15/a>	Xavier Mertens	Malicious Word Document with a Frameset
2022-09-14/a>	Xavier Mertens	Easy Process Injection within Python
2022-09-10/a>	Guy Bruneau	Phishing Word Documents with Suspicious URL
2022-09-03/a>	Didier Stevens	Video: James Webb JPEG With Malware
2022-09-02/a>	Didier Stevens	James Webb JPEG With Malware
2022-08-30/a>	Johannes Ullrich	Two things that will never die: bash scripts and IRC!
2022-08-22/a>	Xavier Mertens	32 or 64 bits Malware?
2022-07-29/a>	Johannes Ullrich	PDF Analysis Intro and OpenActions Entries
2022-07-25/a>	Xavier Mertens	PowerShell Script with Fileless Capability
2022-07-20/a>	Xavier Mertens	Malicious Python Script Behaving Like a Rubber Ducky
2022-06-25/a>	Xavier Mertens	Malicious Code Passed to PowerShell via the Clipboard
2022-06-22/a>	Xavier Mertens	Malicious PowerShell Targeting Cryptocurrency Browser Extensions
2022-06-16/a>	Xavier Mertens	Houdini is Back Delivered Through a JavaScript Dropper
2022-06-04/a>	Guy Bruneau	Spam Email Contains a Very Large ISO file
2022-06-03/a>	Xavier Mertens	Sandbox Evasion... With Just a Filename!
2022-05-31/a>	Xavier Mertens	First Exploitation of Follina Seen in the Wild
2022-05-20/a>	Xavier Mertens	A 'Zip Bomb' to Bypass Security Controls & Sandboxes
2022-05-19/a>	Brad Duncan	Bumblebee Malware from TransferXL URLs
2022-05-11/a>	Brad Duncan	TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
2022-05-07/a>	Guy Bruneau	Phishing PDF Received in my ISC Mailbox
2022-05-06/a>	Jan Kopriva	What is the simplest malware in the world?
2022-05-05/a>	Brad Duncan	Password-protected Excel spreadsheet pushes Remcos RAT
2022-04-21/a>	Xavier Mertens	Multi-Cryptocurrency Clipboard Swapper
2022-04-06/a>	Brad Duncan	Windows MetaStealer Malware
2022-03-25/a>	Xavier Mertens	XLSB Files: Because Binary is Stealthier Than XML
2022-03-24/a>	Xavier Mertens	Malware Delivered Through Free Sharing Tool
2022-03-23/a>	Brad Duncan	Arkei Variants: From Vidar to Mars Stealer
2022-03-11/a>	Xavier Mertens	Keep an Eye on WebSockets
2022-03-09/a>	Xavier Mertens	Infostealer in a Batch File
2022-02-22/a>	Xavier Mertens	A Good Old Equation Editor Vulnerability Delivering Malware
2022-02-18/a>	Xavier Mertens	Remcos RAT Delivered Through Double Compressed Archive
2022-02-11/a>	Xavier Mertens	CinaRAT Delivered Through HTML ID Attributes
2022-01-20/a>	Xavier Mertens	RedLine Stealer Delivered Through FTP
2022-01-07/a>	Xavier Mertens	Custom Python RAT Builder
2022-01-06/a>	Xavier Mertens	Malicious Python Script Targeting Chinese People
2022-01-05/a>	Xavier Mertens	Code Reuse In the Malware Landscape
2021-12-21/a>	Xavier Mertens	More Undetected PowerShell Dropper
2021-12-15/a>	Xavier Mertens	Simple but Undetected PowerShell Backdoor
2021-12-03/a>	Xavier Mertens	The UPX Packer Will Never Die!
2021-12-02/a>	Brad Duncan	TA551 (Shathak) pushes IcedID (Bokbot)
2021-11-19/a>	Xavier Mertens	Downloader Disguised as Excel Add-In (XLL)
2021-11-18/a>	Xavier Mertens	JavaScript Downloader Delivers Agent Tesla Trojan
2021-10-21/a>	Brad Duncan	"Stolen Images Evidence" campaign pushes Sliver-based malware
2021-10-01/a>	Xavier Mertens	New Tool to Add to Your LOLBAS List: cvtres.exe
2021-09-23/a>	Xavier Mertens	Excel Recipe: Some VBA Code with a Touch of Excel4 Macro
2021-09-01/a>	Brad Duncan	STRRAT: a Java-based RAT that doesn't care if you have Java
2021-08-30/a>	Xavier Mertens	Cryptocurrency Clipboard Swapper Delivered With Love
2021-08-20/a>	Xavier Mertens	Waiting for the C2 to Show Up
2021-08-15/a>	Didier Stevens	Simple Tips For Triage Of MALWARE Bazaar's Daily Malware Batches
2021-08-07/a>	Didier Stevens	MALWARE Bazaar "Download daily malware batches"
2021-08-06/a>	Xavier Mertens	Malicious Microsoft Word Remains A Key Infection Vector
2021-07-30/a>	Xavier Mertens	Infected With a .reg File
2021-07-29/a>	Xavier Mertens	Malicious Content Delivered Through archive.org
2021-07-24/a>	Xavier Mertens	Agent.Tesla Dropped via a .daa Image and Talking to Telegram
2021-07-16/a>	Xavier Mertens	Multiple BaseXX Obfuscations
2021-07-06/a>	Xavier Mertens	Python DLL Injection Check
2021-06-30/a>	Brad Duncan	June 2021 Forensic Contest: Answers and Analysis
2021-06-11/a>	Xavier Mertens	Keeping an Eye on Dangerous Python Modules
2021-06-09/a>	Jan Kopriva	Architecture, compilers and black magic, or "what else affects the ability of AVs to detect malicious files"
2021-06-04/a>	Xavier Mertens	Russian Dolls VBS Obfuscation
2021-05-28/a>	Xavier Mertens	Malicious PowerShell Hosted on script.google.com
2021-05-27/a>	Jan Kopriva	All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not
2021-05-21/a>	Xavier Mertens	Locking Kernel32.dll As Anti-Debugging Technique
2021-05-19/a>	Brad Duncan	May 2021 Forensic Contest: Answers and Analysis
2021-05-18/a>	Xavier Mertens	From RunDLL32 to JavaScript then PowerShell
2021-05-06/a>	Xavier Mertens	Alternative Ways To Perform Basic Tasks
2021-05-05/a>	Brad Duncan	May 2021 Forensic Contest
2021-04-29/a>	Xavier Mertens	From Python to .Net
2021-04-28/a>	Xavier Mertens	Deeper Analyzis of my Last Malicious PowerPoint Add-On
2021-04-23/a>	Xavier Mertens	Malicious PowerPoint Add-On: "Small Is Beautiful"
2021-04-09/a>	Xavier Mertens	No Python Interpreter? This Simple RAT Installs Its Own Copy
2021-04-08/a>	Xavier Mertens	Simple Powershell Ransomware Creating a 7Z Archive of your Files
2021-04-06/a>	Jan Kopriva	Malspam with Lokibot vs. Outlook and RFCs
2021-04-02/a>	Xavier Mertens	C2 Activity: Sandboxes or Real Victims?
2021-04-01/a>	Brad Duncan	April 2021 Forensic Quiz
2021-03-31/a>	Xavier Mertens	Quick Analysis of a Modular InfoStealer
2021-03-19/a>	Xavier Mertens	Pastebin.com Used As a Simple C2 Channel
2021-03-18/a>	Xavier Mertens	Simple Python Keylogger
2021-03-17/a>	Xavier Mertens	Defenders, Know Your Operating System Like Attackers Do!
2021-03-16/a>	Jan Kopriva	50 years of malware? Not really. 50 years of computer worms? That's a different story...
2021-03-04/a>	Xavier Mertens	From VBS, PowerShell, C Sharp, Process Hollowing to RAT
2021-02-19/a>	Xavier Mertens	Dynamic Data Exchange (DDE) is Back in the Wild?
2021-02-14/a>	Didier Stevens	Video: tshark & Malware Analysis
2021-02-12/a>	Xavier Mertens	AgentTesla Dropped Through Automatic Click in Microsoft Help File
2021-02-11/a>	Jan Kopriva	Agent Tesla hidden in a historical anti-malware tool
2021-02-03/a>	Brad Duncan	Excel spreadsheets push SystemBC malware
2021-02-02/a>	Xavier Mertens	New Example of XSL Script Processing aka "Mitre T1220"
2021-01-22/a>	Xavier Mertens	Another File Extension to Block in your MTA: .jnlp
2021-01-21/a>	Xavier Mertens	Powershell Dropping a REvil Ransomware
2021-01-04/a>	Jan Kopriva	From a small BAT file to Mass Logger infostealer
2021-01-02/a>	Guy Bruneau	Protecting Home Office and Enterprise in 2021
2020-12-24/a>	Xavier Mertens	Malicious Word Document Delivering an Octopus Backdoor
2020-12-22/a>	Xavier Mertens	Malware Victim Selection Through WiFi Identification
2020-12-03/a>	Brad Duncan	Traffic Analysis Quiz: Mr Natural
2020-11-25/a>	Xavier Mertens	Live Patching Windows API Calls Using PowerShell
2020-11-23/a>	Didier Stevens	Quick Tip: Cobalt Strike Beacon Analysis
2020-11-09/a>	Xavier Mertens	How Attackers Brush Up Their Malicious Scripts
2020-10-25/a>	Didier Stevens	Video: Pascal Strings
2020-10-21/a>	Daniel Wesemann	Shipping dangerous goods
2020-09-24/a>	Xavier Mertens	Party in Ibiza with PowerShell
2020-09-23/a>	Xavier Mertens	Malicious Word Document with Dynamic Content
2020-09-18/a>	Xavier Mertens	A Mix of Python & VBA in a Malicious Word Document
2020-09-15/a>	Brad Duncan	Traffic Analysis Quiz: Oh No... Another Infection!
2020-09-04/a>	Jan Kopriva	A blast from the past - XXEncoded VB6.0 Trojan
2020-09-03/a>	Xavier Mertens	Sandbox Evasion Using NTP
2020-08-28/a>	Xavier Mertens	Example of Malicious DLL Injected in PowerShell
2020-08-26/a>	Xavier Mertens	Malicious Excel Sheet with a NULL VT Score
2020-08-24/a>	Xavier Mertens	Tracking A Malware Campaign Through VT
2020-08-19/a>	Xavier Mertens	Example of Word Document Delivering Qakbot
2020-08-18/a>	Xavier Mertens	Using API's to Track Attackers
2020-08-14/a>	Jan Kopriva	Definition of 'overkill' - using 130 MB executable to hide 24 kB malware
2020-08-06/a>	Xavier Mertens	A Fork of the FTCode Powershell Ransomware
2020-08-05/a>	Brad Duncan	Traffic Analysis Quiz: What's the Malware From This Infection?
2020-07-24/a>	Xavier Mertens	Compromized Desktop Applications by Web Technologies
2020-07-15/a>	Brad Duncan	Word docs with macros for IcedID (Bokbot)
2020-07-10/a>	Brad Duncan	Excel spreasheet macro kicks off Formbook infection
2020-07-08/a>	Xavier Mertens	If You Want Something Done Right, You Have To Do It Yourself... Malware Too!
2020-06-13/a>	Guy Bruneau	Mirai Botnet Activity
2020-06-04/a>	Xavier Mertens	Anti-Debugging Technique based on Memory Protection
2020-06-01/a>	Jim Clausing	Stackstrings, type 2
2020-05-23/a>	Xavier Mertens	AgentTesla Delivered via a Malicious PowerPoint Add-In
2020-05-21/a>	Xavier Mertens	Malware Triage with FLOSS: API Calls Based Behavior
2020-05-20/a>	Brad Duncan	Microsoft Word document with malicious macro pushes IcedID (Bokbot)
2020-05-06/a>	Xavier Mertens	Keeping an Eye on Malicious Files Life Time
2020-04-27/a>	Xavier Mertens	Powershell Payload Stored in a PSCredential Object
2020-04-25/a>	Didier Stevens	MALWARE Bazaar
2020-04-24/a>	Xavier Mertens	Malicious Excel With a Strong Obfuscation and Sandbox Evasion
2020-04-20/a>	Didier Stevens	KPOT AutoIt Script: Analysis
2020-04-17/a>	Xavier Mertens	Weaponized RTF Document Generator & Mailer in PowerShell
2020-04-12/a>	Didier Stevens	Reader Analysis: "Dynamic analysis technique to get decrypted KPOT Malware."
2020-04-10/a>	Xavier Mertens	PowerShell Sample Extracting Payload From SSL
2020-04-03/a>	Xavier Mertens	Obfuscated with a Simple 0x0A
2020-03-31/a>	Johannes Ullrich	Kwampirs Targeted Attacks Involving Healthcare Sector
2020-03-27/a>	Xavier Mertens	Malicious JavaScript Dropping Payload in the Registry
2020-03-26/a>	Xavier Mertens	Very Large Sample as Evasion Technique?
2020-03-23/a>	Didier Stevens	KPOT Deployed via AutoIt Script
2020-03-22/a>	Didier Stevens	More COVID-19 Themed Malware
2020-03-21/a>	Guy Bruneau	Honeypot - Scanning and Targeting Devices & Services
2020-03-19/a>	Xavier Mertens	COVID-19 Themed Multistage Malware
2020-03-11/a>	Xavier Mertens	Agent Tesla Delivered via Fake Canon EOS Notification on Free OwnCloud Account
2020-03-06/a>	Xavier Mertens	A Safe Excel Sheet Not So Safe
2020-02-21/a>	Xavier Mertens	Quick Analysis of an Encrypted Compound Document Format
2020-02-14/a>	Xavier Mertens	Keep an Eye on Command-Line Browsers
2020-02-07/a>	Xavier Mertens	Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript
2020-02-03/a>	Jan Kopriva	Analysis of a triple-encrypted AZORult downloader
2020-01-16/a>	Jan Kopriva	Picks of 2019 malware - the large, the small and the one full of null bytes
2020-01-10/a>	Xavier Mertens	More Data Exfiltration
2020-01-09/a>	Xavier Mertens	Quick Analyzis of a(nother) Maldoc
2020-01-02/a>	Xavier Mertens	Ransomware in Node.js
2019-12-24/a>	Brad Duncan	Malspam with links to Word docs pushes IcedID (Bokbot)
2019-12-12/a>	Xavier Mertens	Code & Data Reuse in the Malware Ecosystem
2019-11-23/a>	Guy Bruneau	Local Malware Analysis with Malice
2019-10-18/a>	Xavier Mertens	Quick Malicious VBS Analysis
2019-10-03/a>	Xavier Mertens	"Lost_Files" Ransomware
2019-09-19/a>	Xavier Mertens	Agent Tesla Trojan Abusing Corporate Email Accounts
2019-08-30/a>	Xavier Mertens	Malware Dropping a Local Node.js Instance
2019-08-28/a>	Xavier Mertens	Malware Samples Compiling Their Next Stage on Premise
2019-08-22/a>	Xavier Mertens	Simple Mimikatz & RDPWrapper Dropper
2019-08-18/a>	Didier Stevens	Video: Analyzing DAA Files
2019-08-16/a>	Didier Stevens	The DAA File Format
2019-08-12/a>	Didier Stevens	Malicious .DAA Attachments
2019-07-18/a>	Xavier Mertens	Malicious PHP Script Back on Stage?
2019-07-11/a>	Xavier Mertens	Russian Dolls Malicious Script Delivering Ursnif
2019-07-02/a>	Xavier Mertens	Malicious Script With Multiple Payloads
2019-06-14/a>	Jim Clausing	A few Ghidra tips for IDA users, part 4 - function call graphs
2019-06-10/a>	Xavier Mertens	Interesting JavaScript Obfuscation Example
2019-05-29/a>	Xavier Mertens	Behavioural Malware Analysis with Microsoft ASA
2019-05-13/a>	Xavier Mertens	From Phishing To Ransomware?
2019-05-03/a>	Jim Clausing	A few Ghidra tips for IDA users, part 3 - conversion, labels, and comments
2019-05-01/a>	Xavier Mertens	Another Day, Another Suspicious UDF File
2019-04-19/a>	Didier Stevens	Analyzing UDF Files with Python
2019-04-17/a>	Jim Clausing	A few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-17/a>	Xavier Mertens	Malware Sample Delivered Through UDF Image
2019-04-08/a>	Jim Clausing	A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-03/a>	Jim Clausing	A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2019-03-30/a>	Didier Stevens	"404" is not Malware
2019-03-10/a>	Didier Stevens	Malicious HTA Analysis by a Reader
2019-03-10/a>	Didier Stevens	Quick and Dirty Malicious HTA Analysis
2019-02-14/a>	Xavier Mertens	Old H-Worm Delivered Through GitHub
2019-01-16/a>	Brad Duncan	Emotet infections and follow-up malware
2019-01-06/a>	Didier Stevens	Malicious .tar Attachments
2019-01-05/a>	Didier Stevens	A Malicious JPEG? Second Example
2019-01-04/a>	Didier Stevens	A Malicious JPEG?
2019-01-02/a>	Xavier Mertens	Malicious Script Leaking Data via FTP
2018-12-09/a>	Didier Stevens	Quickie: String Analysis is Still Useful
2018-12-08/a>	Didier Stevens	Reader Malware Submission: MHT File Inside a ZIP File
2018-11-27/a>	Xavier Mertens	More obfuscated shell scripts: Fake MacOS Flash update
2018-11-26/a>	Xavier Mertens	Obfuscated bash script targeting QNap boxes
2018-11-22/a>	Xavier Mertens	Divided Payload in Multiple Pasties
2018-11-06/a>	Xavier Mertens	Malicious Powershell Script Dissection
2018-10-23/a>	Xavier Mertens	Diving into Malicious AutoIT Code
2018-10-22/a>	Xavier Mertens	Malicious Powershell using a Decoy Picture
2018-10-21/a>	Pasquale Stirparo	Beyond good ol’ LaunchAgent - part 0
2018-10-12/a>	Xavier Mertens	More Equation Editor Exploit Waves
2018-09-28/a>	Xavier Mertens	More Excel DDE Code Injection
2018-09-22/a>	Didier Stevens	Suspicious DNS Requests ... Issued by a Firewall
2018-09-16/a>	Didier Stevens	20/20 malware vision
2018-09-13/a>	Xavier Mertens	Malware Delivered Through MHT Files
2018-09-05/a>	Xavier Mertens	Malicious PowerShell Compiling C# Code on the Fly
2018-08-31/a>	Jim Clausing	Quickie: Using radare2 to disassemble shellcode
2018-08-30/a>	Xavier Mertens	Crypto Mining Is More Popular Than Ever!
2018-08-26/a>	Didier Stevens	Identifying numeric obfuscation
2018-08-26/a>	Didier Stevens	"When was this machine infected?"
2018-08-24/a>	Xavier Mertens	Microsoft Publisher Files Delivering Malware
2018-08-21/a>	Xavier Mertens	Malicious DLL Loaded Through AutoIT
2018-08-06/a>	Didier Stevens	Numeric obfuscation: another example
2018-08-04/a>	Didier Stevens	Dealing with numeric obfuscation in malicious scripts
2018-08-02/a>	Brad Duncan	DHL-themed malspam reveals embedded malware in animated gif
2018-07-26/a>	Xavier Mertens	Windows Batch File Deobfuscation
2018-07-09/a>	Renato Marinho	Criminals Don't Read Instructions or Use Strong Passwords
2018-06-07/a>	Remco Verhoef	Automated twitter loot collection
2018-06-05/a>	Xavier Mertens	Malicious Post-Exploitation Batch File
2018-06-01/a>	Remco Verhoef	Binary analysis with Radare2
2018-05-22/a>	Xavier Mertens	Malware Distributed via .slk Files
2018-05-19/a>	Xavier Mertens	Malicious Powershell Targeting UK Bank Customers
2018-05-09/a>	Xavier Mertens	Nice Phishing Sample Delivering Trickbot
2018-05-07/a>	Xavier Mertens	Adding Persistence Via Scheduled Tasks
2018-05-01/a>	Xavier Mertens	Diving into a Simple Maldoc Generator
2018-03-05/a>	Xavier Mertens	Malicious Bash Script with Multiple Features
2018-03-04/a>	Xavier Mertens	The Crypto Miners Fight For CPU Cycles
2018-02-25/a>	Didier Stevens	Retrieving malware over Tor on Windows
2018-02-02/a>	Xavier Mertens	Simple but Effective Malicious XLS Sheet
2018-01-28/a>	Didier Stevens	Is this a pentest?
2018-01-26/a>	Xavier Mertens	Investigating Microsoft BITS Activity
2018-01-25/a>	Xavier Mertens	Ransomware as a Service
2018-01-11/a>	Xavier Mertens	Mining or Nothing!
2017-12-19/a>	Xavier Mertens	Example of 'MouseOver' Link in a Powerpoint File
2017-12-16/a>	Xavier Mertens	Microsoft Office VBA Macro Obfuscation via Metadata
2017-11-29/a>	Xavier Mertens	Fileless Malicious PowerShell Sample
2017-11-16/a>	Xavier Mertens	Suspicious Domains Tracking Dashboard
2017-11-15/a>	Xavier Mertens	If you want something done right, do it yourself!
2017-11-13/a>	Guy Bruneau	VBE Embeded Script (info.zip)
2017-11-07/a>	Xavier Mertens	Interesting VBA Dropper
2017-11-03/a>	Xavier Mertens	Simple Analysis of an Obfuscated JAR File
2017-10-31/a>	Xavier Mertens	Some Powershell Malicious Code
2017-10-29/a>	Didier Stevens	Remember ACE files?
2017-10-24/a>	Xavier Mertens	BadRabbit: New ransomware wave hitting RU & UA
2017-10-15/a>	Didier Stevens	Peeking into .msg files
2017-09-09/a>	Didier Stevens	Malware analysis output sanitization
2017-09-02/a>	Xavier Mertens	AutoIT based malware back in the wild
2017-08-26/a>	Didier Stevens	Malware analysis: searching for dots
2017-08-25/a>	Xavier Mertens	Malicious AutoIT script delivered in a self-extracting RAR file
2017-08-23/a>	Xavier Mertens	Malicious script dropping an executable signed by Avast?
2017-08-18/a>	Renato Marinho	EngineBox Malware Supports 10+ Brazilian Banks
2017-07-21/a>	Didier Stevens	Malicious .iso Attachments
2017-07-09/a>	Russ McRee	Adversary hunting with SOF-ELK
2017-07-05/a>	Didier Stevens	Selecting domains with random names
2017-06-22/a>	Xavier Mertens	Obfuscating without XOR
2017-06-06/a>	Didier Stevens	Malware and XOR - Part 2
2017-06-05/a>	Didier Stevens	Malware and XOR - Part 1
2017-05-16/a>	Russ McRee	WannaCry? Do your own data analysis.
2017-05-13/a>	Guy Bruneau	Microsoft Released Guidance for WannaCrypt
2017-04-28/a>	Xavier Mertens	Another Day, Another Obfuscation Technique
2017-04-19/a>	Xavier Mertens	Hunting for Malicious Excel Sheets
2017-04-05/a>	Xavier Mertens	Whitelists: The Holy Grail of Attackers
2017-03-18/a>	Xavier Mertens	Example of Multiple Stages Dropper
2017-03-12/a>	Guy Bruneau	Honeypot Logs and Tracking a VBE Script
2017-03-08/a>	Xavier Mertens	Not All Malware Samples Are Complex
2017-02-05/a>	Xavier Mertens	Many Malware Samples Found on Pastebin
2017-01-31/a>	Johannes Ullrich	Malicious Office files using fileless UAC bypass to drop KEYBASE malware
2017-01-24/a>	Xavier Mertens	Malicious SVG Files in the Wild
2017-01-06/a>	John Bambenek	Ransomware Operators Cold Calling UK Schools to Get Malware Through
2017-01-05/a>	John Bambenek	New Year's Resolution: Build Your Own Malware Lab?
2017-01-01/a>	Didier Stevens	py2exe Decompiling - Part 1
2016-12-13/a>	Xavier Mertens	UAC Bypass in JScript Dropper
2016-11-11/a>	Rick Wanner	Benevolent malware? reincarna/Linux.Wifatch
2016-10-30/a>	Pasquale Stirparo	Volatility Bot: Automated Memory Analysis
2016-09-30/a>	Xavier Mertens	Another Day, Another Malicious Behaviour
2016-09-13/a>	Rob VandenBrink	If it's Free, YOU are the Product
2016-09-05/a>	Xavier Mertens	Malware Delivered via '.pub' Files
2016-09-01/a>	Xavier Mertens	Maxmind.com (Ab)used As Anti-Analysis Technique
2016-08-25/a>	Xavier Mertens	Out-of-Band iOS Patch Fixes 0-Day Vulnerabilities
2016-08-24/a>	Xavier Mertens	Example of Targeted Attack Through a Proxy PAC File
2016-08-23/a>	Xavier Mertens	Voice Message Notifications Deliver Ransomware
2016-08-01/a>	Daniel Wesemann	Are you getting I-CANNED ?
2016-07-27/a>	Xavier Mertens	Analyze of a Linux botnet client source code
2016-07-25/a>	Didier Stevens	Python Malware - Part 4
2016-07-16/a>	Didier Stevens	Python Malware - Part 3
2016-07-12/a>	Xavier Mertens	Hunting for Malicious Files with MISP + OSSEC
2016-06-20/a>	Xavier Mertens	Ongoing Spam Campaign Related to Swift
2016-06-18/a>	Rob VandenBrink	Controlling JavaScript Malware Before it Runs
2016-05-15/a>	Didier Stevens	Python Malware - Part 1
2016-05-13/a>	Xavier Mertens	MISP - Malware Information Sharing Platform
2016-05-05/a>	Xavier Mertens	Microsoft BITS Used to Download Payloads
2016-05-02/a>	Rick Wanner	Fake Chrome update for Android
2016-04-21/a>	Daniel Wesemann	Decoding Pseudo-Darkleech (#1)
2016-04-21/a>	Daniel Wesemann	Decoding Pseudo-Darkleech (Part #2)
2016-04-10/a>	Didier Stevens	Handling Malware Samples
2016-03-07/a>	Xavier Mertens	Another Malicious Document, Another Way to Deliver Malicious Code
2016-02-24/a>	Xavier Mertens	Analyzis of a Malicious .lnk File with an Embedded Payload
2016-02-18/a>	Xavier Mertens	Hunting for Executable Code in Windows Environments
2016-02-11/a>	Tom Webb	Tomcat IR with XOR.DDoS
2016-01-24/a>	Didier Stevens	Obfuscated MIME Files
2016-01-15/a>	Xavier Mertens	JavaScript Deobfuscation Tool
2016-01-01/a>	Didier Stevens	Failure Is An Option
2015-12-26/a>	Didier Stevens	Malfunctioning Malware
2015-12-16/a>	Xavier Mertens	Playing With Sandboxes Like a Boss
2015-12-06/a>	Mark Hofman	Malware SPAM a new run has started.
2015-11-09/a>	John Bambenek	Protecting Users and Enterprises from the Mobile Malware Threat
2015-09-29/a>	Pedro Bueno	Tricks for DLL analysis
2015-09-28/a>	Johannes Ullrich	"Transport of London" Malicious E-Mail
2015-09-21/a>	Xavier Mertens	Detecting XCodeGhost Activity
2015-04-24/a>	Basil Alawi S.Taher	Fileless Malware
2015-04-09/a>	Brad Duncan	An example of the malicious emails sometimes sent to the ISC handler addresses
2015-03-18/a>	Daniel Wesemann	New SANS memory forensics poster
2015-03-14/a>	Didier Stevens	Maldoc VBA Sandbox/Virtualization Detection
2015-03-08/a>	Brad Duncan	What Happened to You, Asprox Botnet?
2015-02-19/a>	Daniel Wesemann	Macros? Really?!
2014-10-03/a>	Johannes Ullrich	CSAM: The Power of Virustotal to Turn Harmless Binaries Malicious
2014-09-22/a>	Johannes Ullrich	Fake LogMeIn Certificate Update with Bad AV Detection Rate
2014-08-06/a>	Chris Mohan	Free Service to Help CryptoLocker Victims by FireEye and Fox-IT
2014-07-22/a>	Daniel Wesemann	Ivan's Order of Magnitude
2014-07-19/a>	Russ McRee	Keeping the RATs out: the trap is sprung - Part 3
2014-07-18/a>	Russ McRee	Keeping the RATs out: **it happens - Part 2
2014-07-18/a>	Russ McRee	Gameover Zeus reported as "returned from the dead"
2014-07-16/a>	Russ McRee	Keeping the RATs out: an exercise in building IOCs - Part 1
2014-07-05/a>	Guy Bruneau	Malware Analysis with pedump
2014-06-22/a>	Russ McRee	OfficeMalScanner helps identify the source of a compromise
2014-06-08/a>	Guy Bruneau	efax Spam Containing Malware
2014-04-06/a>	Basil Alawi S.Taher	"Power Worm" PowerShell based Malware
2014-04-05/a>	Jim Clausing	Those strange e-mails with URLs in them can lead to Android malware
2014-03-04/a>	Daniel Wesemann	XPired!
2014-02-28/a>	Daniel Wesemann	Fiesta!
2014-01-19/a>	Rick Wanner	Anatomy of a Malware distribution campaign
2013-12-24/a>	Daniel Wesemann	Mr Jones wants you to appear in court!
2013-12-23/a>	Daniel Wesemann	Costco, BestBuy, Walmart really want to send you a package!
2013-12-07/a>	Guy Bruneau	Suspected Active Rovnix Botnet Controller
2013-11-02/a>	Rick Wanner	Protecting Your Family's Computers
2013-10-31/a>	Russ McRee	Happy Halloween: The Ghost Really May Be In The Machine
2013-10-30/a>	Russ McRee	SIR v15: Five good reasons to leave Windows XP behind
2013-10-28/a>	Daniel Wesemann	Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities
2013-10-24/a>	Johannes Ullrich	False Positive: php.net Malware Alert
2013-09-30/a>	Adrien de Beaupre	Twitter DM spam/malware
2013-09-12/a>	Daniel Wesemann	37.58.73.42 / 95.156.228.69 / 195.210.43.42, anyone?
2013-09-10/a>	Swa Frantzen	Macs need to patch too!
2013-08-29/a>	Russ McRee	Suspect Sendori software
2013-07-04/a>	Russ McRee	Celebrating 4th of July With a Malware PCAP Visualization
2013-06-18/a>	Russ McRee	Volatility rules...any questions?
2013-05-21/a>	Adrien de Beaupre	Moore, Oklahoma tornado charitable organization scams, malware, and phishing
2013-05-17/a>	Daniel Wesemann	e-netprotections.su ?
2013-05-16/a>	Daniel Wesemann	Extracting signatures from Apple .apps
2013-05-11/a>	Lenny Zeltser	Extracting Digital Signatures from Signed Malware
2013-05-01/a>	Daniel Wesemann	The cost of cleaning up
2013-04-10/a>	Manuel Humberto Santander Pelaez	Massive Google scam sent by email to Colombian domains
2013-03-22/a>	Mark Baggett	Wipe the drive! Stealthy Malware Persistence - Part 4
2013-03-20/a>	Mark Baggett	Wipe the drive! Stealthy Malware Persistence - Part 3
2013-03-19/a>	Johannes Ullrich	Scam of the day: More fake CNN e-mails
2013-03-15/a>	Mark Baggett	AVG detect legit file as virus
2013-03-14/a>	Mark Baggett	Wipe the drive! Stealthy Malware Persistence - Part 2
2013-03-13/a>	Mark Baggett	Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1
2013-02-25/a>	Johannes Ullrich	Mass-Customized Malware Lures: Don't trust your cat!
2013-01-08/a>	Jim Clausing	Cuckoo 0.5 is out and the world didn't end
2012-12-18/a>	Rob VandenBrink	All I Want for Christmas is to Not Get Hacked !
2012-12-03/a>	Kevin Liston	Mobile Malware: Request for Field Reports
2012-11-02/a>	Daniel Wesemann	Lamiabiocasa
2012-11-01/a>	Daniel Wesemann	Patched your Java yet?
2012-10-14/a>	Pedro Bueno	Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1
2012-09-21/a>	Guy Bruneau	Storing your Collection of Malware Samples with Malwarehouse
2012-09-14/a>	Lenny Zeltser	Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-07-21/a>	Rick Wanner	OpenDNS is looking for a few good malware people!
2012-07-05/a>	Adrien de Beaupre	New OS X trojan backdoor MaControl variant reported
2012-06-27/a>	Swa Frantzen	Online Banking Heists
2012-06-26/a>	Daniel Wesemann	Run, Forest! (Update)
2012-06-25/a>	Rick Wanner	Targeted Malware for Industrial Espionage?
2012-06-25/a>	Swa Frantzen	Belgian online banking customers hacked.
2012-06-22/a>	Daniel Wesemann	Run, Forest!
2012-06-21/a>	Russ McRee	Analysis of drive-by attack sample set
2012-06-21/a>	Raul Siles	Print Bomb? (Take 2)
2012-06-19/a>	Daniel Wesemann	Vulnerabilityqueerprocessbrittleness
2012-06-04/a>	Lenny Zeltser	Decoding Common XOR Obfuscation in Malicious Code
2012-04-26/a>	Richard Porter	Define Irony: A medical device with a Virus?
2012-04-25/a>	Daniel Wesemann	Blacole's obfuscated JavaScript
2012-04-25/a>	Daniel Wesemann	Blacole's shell code
2012-04-12/a>	Guy Bruneau	HP ProCurve 5400 zl Switch, Flash Cards Infected with Malware
2012-04-12/a>	Guy Bruneau	Apple Java Updates for Mac OS X
2012-03-25/a>	Daniel Wesemann	evilcode.class
2012-03-03/a>	Jim Clausing	New automated sandbox for Android malware
2012-02-24/a>	Guy Bruneau	Flashback Trojan in the Wild
2012-02-20/a>	Pedro Bueno	Simple Malware Research Tools
2012-02-20/a>	Rick Wanner	DNSChanger resolver shutdown deadline is March 8th
2012-01-14/a>	Daniel Wesemann	Hello, Antony!
2011-12-28/a>	Daniel Wesemann	.nl.ai ?
2011-12-10/a>	Daniel Wesemann	Unwanted Presents
2011-12-07/a>	Lenny Zeltser	V8 as an Alternative to SpiderMonkey for JavaScript Deobfuscation
2011-11-04/a>	Guy Bruneau	Duqu Mitigation
2011-10-20/a>	Johannes Ullrich	Evil Printers Sending Mail
2011-09-07/a>	Lenny Zeltser	Analyzing Mobile Device Malware - Honeynet Forensic Challenge 9 and Some Tools
2011-08-29/a>	Kevin Shortt	Internet Worm in the Wild
2011-06-15/a>	Pedro Bueno	Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)...
2011-05-25/a>	Daniel Wesemann	Apple advisory on "MacDefender" malware
2011-05-19/a>	Daniel Wesemann	Fake AV Bingo
2011-05-14/a>	Guy Bruneau	Websense Study Claims Canada Next Hotbed for Cybercrime Web Hosting Activity
2011-05-03/a>	Johannes Ullrich	Update on Osama Bin Laden themed Malware
2011-05-02/a>	Johannes Ullrich	Bin Laden Death Related Malware
2011-04-23/a>	Manuel Humberto Santander Pelaez	Image search can lead to malware download
2011-03-01/a>	Daniel Wesemann	AV software and "sharing samples"
2011-02-07/a>	Pedro Bueno	The Good , the Bad and the Unknown Online Scanners
2011-02-01/a>	Lenny Zeltser	The Importance of HTTP Headers When Investigating Malicious Sites
2010-12-29/a>	Daniel Wesemann	Beware of strange web sites bearing gifts ...
2010-12-29/a>	Daniel Wesemann	Malware Domains 2234.in, 0000002.in & co
2010-10-26/a>	Pedro Bueno	Cyber Security Awareness Month - Day 26 - Sharing Office Files
2010-09-09/a>	Marcus Sachs	'Here You Have' Email
2010-07-21/a>	Adrien de Beaupre	Dell PowerEdge R410 replacement motherboard firmware contains malware
2010-07-21/a>	Adrien de Beaupre	autorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010-07-06/a>	Rob VandenBrink	Bogus Support Organizations use Live Operators to Install Malware
2010-07-04/a>	Manuel Humberto Santander Pelaez	Malware inside PDF Files
2010-06-17/a>	Deborah Hale	FYI - Another bogus site
2010-06-14/a>	Manuel Humberto Santander Pelaez	Rogue facebook application acting like a worm
2010-06-07/a>	Manuel Humberto Santander Pelaez	Software Restriction Policy to keep malware away
2010-06-02/a>	Rob VandenBrink	New Mac malware - OSX/Onionspy
2010-05-26/a>	Bojan Zdrnja	Malware modularization and AV detection evasion
2010-05-23/a>	Manuel Humberto Santander Pelaez	e-mail scam announcing Fidel Castro's funeral ... and nasty malware to your computer.
2010-05-21/a>	Rick Wanner	IBM distributes malware at AusCERT!
2010-04-30/a>	Kevin Liston	The Importance of Small Files
2010-04-19/a>	Daniel Wesemann	Linked into scams?
2010-04-18/a>	Guy Bruneau	Some NetSol hosted sites breached
2010-04-13/a>	Johannes Ullrich	More Legal Threat Malware E-Mail
2010-03-30/a>	Pedro Bueno	Sharing the Tools
2010-03-26/a>	Daniel Wesemann	Getting the EXE out of the RTF again
2010-03-09/a>	Marcus Sachs	Energizer Malware
2010-03-04/a>	Daniel Wesemann	salefale-dot-com is bad
2010-03-03/a>	Johannes Ullrich	Reports about large number of fake Amazon order confirmations
2010-02-21/a>	Patrick Nolan	Looking for "more useful" malware information? Help develop the format.
2010-01-14/a>	Bojan Zdrnja	PDF Babushka
2010-01-07/a>	Daniel Wesemann	Static analysis of malicious PDFs
2010-01-07/a>	Daniel Wesemann	Static analysis of malicous PDFs (Part #2)
2009-12-17/a>	Daniel Wesemann	overlay.xul is back
2009-12-17/a>	Daniel Wesemann	In caches, danger lurks
2009-12-16/a>	Rob VandenBrink	Beware the Attack of the Christmas Greeting Cards !
2009-12-07/a>	Rick Wanner	Cheat Sheet: Analyzing Malicious Documents
2009-12-04/a>	Daniel Wesemann	Max Power's Malware Paradise
2009-12-02/a>	Rob VandenBrink	SPAM and Malware taking advantage of H1N1 concerns
2009-11-25/a>	Jim Clausing	Updates to my GREM Gold scripts and a new script
2009-09-25/a>	Lenny Zeltser	Categories of Common Malware Traits
2009-09-25/a>	Deborah Hale	Conficker Continues to Impact Networks
2009-09-25/a>	Deborah Hale	Malware delivered over Google and Yahoo Ad's?
2009-09-04/a>	Adrien de Beaupre	Fake anti-virus
2009-08-29/a>	Guy Bruneau	Immunet Protect - Cloud and Community Malware Protection
2009-08-26/a>	Johannes Ullrich	Malicious CD ROMs mailed to banks
2009-07-26/a>	Jim Clausing	New Volatility plugins
2009-07-03/a>	Adrien de Beaupre	Happy 4th of July!
2009-07-02/a>	Daniel Wesemann	Getting the EXE out of the RTF
2009-07-02/a>	Bojan Zdrnja	Cold Fusion web sites getting compromised
2009-06-16/a>	John Bambenek	Iran Internet Blackout: Using Twitter for Operational Intelligence
2009-06-16/a>	John Bambenek	URL Shortening Service Cligs Hacked
2009-06-04/a>	Raul Siles	Malware targetting banks ATM's
2009-06-04/a>	Raul Siles	Targeted e-mail attacks asking to verify wire transfer details
2009-06-01/a>	G. N. White	Yet another "Digital Certificate" malware campaign
2009-05-20/a>	Pedro Bueno	Cyber Warfare and Kylin thoughts
2009-05-07/a>	Deborah Hale	Malicious Content on the Web
2009-05-04/a>	Tom Liston	Facebook phishing malware
2009-04-24/a>	Pedro Bueno	Did you check your conference goodies?
2009-03-13/a>	Bojan Zdrnja	When web application security, Microsoft and the AV vendors all fail
2009-02-23/a>	Daniel Wesemann	Turf War
2009-02-23/a>	Daniel Wesemann	And the Oscar goes to...
2009-02-10/a>	Bojan Zdrnja	More tricks from Conficker and VM detection
2009-02-09/a>	Bojan Zdrnja	Some tricks from Conficker's bag
2009-02-04/a>	Daniel Wesemann	Titan Shields up!
2009-01-31/a>	John Bambenek	Google Search Engine's Malware Detection Broken
2009-01-24/a>	Pedro Bueno	Identifying and Removing the iWork09 Trojan
2009-01-18/a>	Daniel Wesemann	3322. org
2009-01-15/a>	Bojan Zdrnja	Conficker's autorun and social engineering
2009-01-12/a>	William Salusky	Downadup / Conficker - MS08-067 exploit and Windows domain account lockout
2009-01-07/a>	Bojan Zdrnja	An Israeli patriot program or a trojan
2009-01-02/a>	Rick Wanner	Tools on my Christmas list.
2008-12-25/a>	Maarten Van Horenbeeck	Merry Christmas, and beware of digital hitchhikers!
2008-12-25/a>	Maarten Van Horenbeeck	Christmas Ecard Malware
2008-12-17/a>	donald smith	Team CYMRU's Malware Hash Registry
2008-12-05/a>	Daniel Wesemann	Been updatin' your Flash player lately?
2008-12-05/a>	Daniel Wesemann	Baby, baby!
2008-12-04/a>	Bojan Zdrnja	Rogue DHCP servers
2008-11-17/a>	Jim Clausing	Finding stealth injected DLLs
2008-11-16/a>	Maarten Van Horenbeeck	Detection of Trojan control channels
2008-11-12/a>	John Bambenek	Thoughts on Security Intelligence (McColo Corp alleged spam/malware host knocked offline)
2008-11-11/a>	Swa Frantzen	Acrobat continued activity in the wild
2008-11-10/a>	Stephen Hall	Adobe Reader Vulnerability - part 2
2008-10-07/a>	Kyle Haugsness	Good reading and a malware challenge
2008-09-29/a>	Daniel Wesemann	ASPROX mutant
2008-09-22/a>	Maarten Van Horenbeeck	Data exfiltration and the use of anonymity providers
2008-09-18/a>	Bojan Zdrnja	Monitoring HTTP User-Agent fields
2008-09-07/a>	Lorna Hutcheson	Malware Analysis: Tools are only so good
2008-09-03/a>	Daniel Wesemann	Static analysis of Shellcode
2008-09-03/a>	Daniel Wesemann	Static analysis of Shellcode - Part 2
2008-09-01/a>	John Bambenek	The Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months
2008-08-13/a>	Adrien de Beaupre	CNN switched to MSNBC
2008-08-05/a>	Daniel Wesemann	The news update you never asked for
2008-07-20/a>	Kevin Liston	Malware Intelligence: Making it Actionable
2008-07-15/a>	Maarten Van Horenbeeck	Extracting scripts and data from suspect PDF files
2008-07-14/a>	Daniel Wesemann	Obfuscated JavaScript Redux
2008-07-07/a>	Pedro Bueno	Bad url classification
2008-06-18/a>	Marcus Sachs	Olympics Part II
2008-06-14/a>	Lorna Hutcheson	Malware Detection - Take the Blinders Off
2008-06-10/a>	Swa Frantzen	Ransomware keybreaking
2008-06-01/a>	Mark Hofman	Free Yahoo email account! Sign me up, Ok well maybe not.
2008-05-28/a>	Adrien de Beaupre	Another example of malicious SWF
2008-05-27/a>	Adrien de Beaupre	Malicious swf files?
2008-05-26/a>	Marcus Sachs	Predictable Response
2008-05-14/a>	Bojan Zdrnja	War of the worlds?
2008-05-02/a>	Adrien de Beaupre	Hi, remember me?...
2008-04-30/a>	Bojan Zdrnja	(Minor) evolution in Mac DNS changer malware
2008-04-24/a>	Maarten Van Horenbeeck	Targeted attacks using malicious PDF files
2008-04-16/a>	Bojan Zdrnja	The 10.000 web sites infection mystery solved
2008-04-15/a>	Johannes Ullrich	SRI Malware Threat Center
2008-04-14/a>	John Bambenek	A Federal Subpoena or Just Some More Spam & Malware?
2008-04-07/a>	John Bambenek	HP USB Keys Shipped with Malware for your Proliant Server
2008-04-07/a>	John Bambenek	Got Kraken?
2008-04-07/a>	John Bambenek	Kraken Technical Details: UPDATED x3
2008-04-06/a>	Daniel Wesemann	Advanced obfuscated JavaScript analysis
2008-04-04/a>	Daniel Wesemann	nmidahena
2008-04-03/a>	Bojan Zdrnja	VB detection: is it so difficult?
2008-04-02/a>	Adrien de Beaupre	When is a DMG file not a DMG file
2008-03-27/a>	Maarten Van Horenbeeck	Guarding the guardians: a story of PGP key ring theft
2006-08-31/a>	Swa Frantzen	NT botnet submitted
2000-01-02/a>	Deborah Hale	2010 A Look Back - 2011 A Look Ahead
VISH
2012-11-08/a>	Daniel Wesemann	Get a 40% discount on your hotel room!
2010-07-06/a>	Rob VandenBrink	Bogus Support Organizations use Live Operators to Install Malware
2008-10-20/a>	Johannes Ullrich	Fraudulent ATM Reactivation Phone Calls.

UNSTOPPABLE TECH SUPPORT MALWARE VISH

UNSTOPPABLE

TECH

SUPPORT

MALWARE

VISH