Malware Analysis - Page 2 of 3

While I was reverse engineering ZeroAccess in order to write a monitoring system, I had an idea which would allow me to use ZeroAccess C&C

Necurs.P2P – A New Hybrid Peer-to-Peer Botnet

February 22, 2016November 21, 2021

Last week I received a tip about a sample displaying some indication that it could be peer-to-peer (a large amount of UDP traffic being sent to

Malware Analysis Threat Intelligence

Exploring Peer to Peer Botnets

January 11, 2016November 21, 2021

Peer to Peer and Everything In between Back in October I’d gotten bored of the endless stream of cryptolockers and PoS trojan, so decided to

Malware Analysis Reverse Engineering

Kelihos Analysis – Part 1

December 7, 2015November 21, 2021

In the recent years I’ve noticed a shift in the malware economy from botnets to ransomware, which is likely due to the AV industry employing

Malware Analysis Reverse Engineering

Bootkit Disk Forensics – Part 3

March 10, 2015November 21, 2021

Getting Original Pointers XP is a little more complicated than newer systems due to the use of a single driver for both port and miniport;

Malware Analysis Reverse Engineering

Bootkit Disk Forensics – Part 2

March 4, 2015November 21, 2021

DriverStartIo As I explained in the previous article: DriverStartIo is used by older miniports to actually perform the disk I/O, it takes 2 parameters (a

Malware Analysis Reverse Engineering

Bootkit Disk Forensics – Part 1

February 26, 2015November 21, 2021

Recently I got the idea to play around with bypassing bootkit disk filters from an email i received, which highlighted that my MBR spoofing code

Malware Analysis Reverse Engineering

OphionLocker Analysis: Proof Anyone Really Can Write Malware

December 15, 2014November 21, 2021

OphionLocker is supposedly the new ransomware on the block and is already being compared with sophisticated operations such as CryptoLocker and CryptoWall, so i decided