My random thoughts about programming, malwares and other cool tech related stuff.

The Malware Analyst's Cookbook is a great book. In it the authors talked about an interesting technique they called 'process hollowing'. When I read about it, I was intrigued and played around a bit with the examples from the book....

This technical blog digs into BokBot's core module and shows how BokBot infections have become more prevalent due to Emotet campaigns that leverage BokBot as a means to go after a victim’s personal banking information.

Materials available at https://samsclass.info/126/PMA.shtml
DEFCON25 Practical Malware Analysis CTF Workshop offered exclusively for Women in Infosec!
Learn how to analyze malware, including computer viruses,
Trojans, and rootkits, using disassemblers, debuggers…

Creating a custom command and control (C&C) server for someone else's malware has a myriad of benefits. If you can take over it a domain, you then may able to fully hijack other hackers' infected hosts. A more prosaic benefit is expediting analysis. While…

Noriben - Portable, Simple, Malware Analysis Sandbox - Rurik/Noriben

There are (among others) two types of calling conventions - stdcall and cdecl. I have few questions on them:
When a cdecl function is called, how does a caller
know if it should free up the stack ?...

Write ups from our Team Members

Trend Micro è leader mondiale di soluzioni enterprise di sicurezza in cloud, XDR e piattaforme di cybersecurity per aziende, datacenter, ambienti cloud, reti ed endpoint.

Antivirus (AV) is a great target for vulnerability hunting: Large attack surface, complex parsing, and various components executing with…

Unit 42 found a backdoor, T9000, that allows the attacker to capture encrypted data, take screenshots of specific applications, and target Skype users.

You can control the specific location from which any given DLL is loaded by specifying a full path. If you don't use that method, then the system searches for the DLL at load time as described in this topic.