Malware

In late February, while tracking a malicious spam campaign from the Qakbot distributor “TR,” Binary Defense’s analysts identified a new version of IcedID being delivered through malicious Word and Excel files. The updated IcedID has a new first stage loading mechanism, which we’ve dubbed “gziploader,” along with new encryption algorithms for hiding its configuration and […]

In this blog, we cover all things GuLoader – a new malware family – including its main shellcode, anti-analysis techniques and final payload delivery mechanism.

Obfuscate specific windows apis with different apis - GitHub - d35ha/CallObfuscator: Obfuscate specific windows apis with different apis

Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are very interesting to analyze, we are always looking out for these kinds of samples […]

Automatic and platform-independent unpacker for Windows binaries based on emulation - GitHub - unipacker/unipacker: Automatic and platform-independent unpacker for Windows binaries based on emulation

Reflective PE packer. Contribute to EgeBalci/amber development by creating an account on GitHub.

BPFDoor is an stealthy Linux backdoor operating for years undetected. We disclose full technical details and detection techniques here.

Updated samples indicate access to original source code and active development, signaling that GOLD SOUTHFIELD has resumed operations.

A curated list of awesome resources related to executable packing - GitHub - dhondta/awesome-executable-packing: A curated list of awesome resources related to executable packing

The latest version of the BluStealer loader syscalls to bypass EDRs. We break it down and analyze how it works.

Unofficial revival of the well known .NET debugger and assembly editor, dnSpy - GitHub - dnSpyEx/dnSpy: Unofficial revival of the well known .NET debugger and assembly editor, dnSpy

In the second of a two-part series of blogs, we examine the communications and networking features of Daxin.

In the first of a two-part series of blogs, we will delve deeper into Daxin, examining the driver initialization, networking, key exchange, and backdoor functionality of the malware.

Evasion techniques

Windows kernel and user mode emulation. Contribute to mandiant/speakeasy development by creating an account on GitHub.

The FLARE team's open-source tool to identify capabilities in executable files. - mandiant/capa: The FLARE team's open-source tool to identify capabilities in executable files.

At the beginning of April, Carbon Black Threat Research began analyzing a malware variant commonly referred to as Red Leaves, which appears to have code reuse from the PlugX family. During the last month, this malware family has been referenced in several security blogs and government