Clik here to view.
Increase in MySQL Attacks: Dynamic Analysis — Continuing on
Seeing an increase in MySQL attacks hitting your network and interested in knowing more about them? This post finishes the dynamic analysis and, for those who wish I’d hurry up and get to the point,...
View ArticleClik here to view.
Automated Unpacking: A Behaviour Based Approach
Certain memory conditions have to be met before malware can unpack code and run it — the memory has to be writeable to unpack code to it, and executable to be able to execute it. The question is, can...
View ArticleClik here to view.
Capturing the cna12 MySQL Attacks with Dionaea
To analyse the cna12 MySQL attacks, I had to install MySQL Express Server as the attacks were prematurely exiting when connecting to Dionaea. Extracting the binary files from the libpcap files was...
View ArticleClik here to view.
Beyond Automated Unpacking: Extracting Decrypted/Decompressed Memory Blocks
It’s been about a year and a half since I wrote about a behavioural approach to automated unpacking, and I figured it was time to add some more functionality to unpack.py. This time, I’m going to look...
View ArticleClik here to view.
My Malware Analysis Setup
I was just in the middle of doing a post on analysing a malware sample and I thought that I should start it off by documenting my setup. It then occurred to me that doing so was making my post somewhat...
View ArticleClik here to view.
An Exercise in Deobfuscating MS Word Macros Using Linux
… and without touching Perl I might add. So, someone has just handed you a collection of Microsoft Word documents that they believe are malicious and you’re keen to investigate them to see if you can...
View ArticleClik here to view.
Analysing CryptoLocker with unpack.py: Initial Analysis (part 1)
My automated unpacking script (which really needs a sensible name!) is a few years old now, so I was interested to see how it would go with some malware that was developed after it was. That is, I...
View ArticleClik here to view.
Analysing CryptoLocker with unpack.py: The unpacked payload (part 2)
This is the second part in a series of posts showing how we can use my unpack.py script to find quite a bit of useful information about a CryptoLocker variant. This post will analyse the unpacked...
View ArticleClik here to view.
Analysing CryptoLocker with unpack.py: Network Communications (part 3)
Previous posts in this series have demonstrated how unpack.py, when used on a CryptoLocker variant, extracts the malicious PE file injected in to explorer.exe, and how it can also be used to analyse...
View ArticleClik here to view.
A Thousand Monkeys Writing a JavaScript Malware Downloader: De-obfuscating...
There’s a theory that a thousand monkeys typing away at a thousand typewriters will eventually reproduce the works of Shakespeare. I got home one day to find a JavaScript downloader semi-randomly...
View Article
