Malware Analysis Reports

Author: Adam Krasuski

malware_types:botnet source_tag:analysis source_tag:malware source_tag:tofsee

MMD-0057-2016 - Linux/LuaBot - IoT botnet as service

2016-09-06

Author: unixfreaxjp

platforms:linux architecture:arm file_types:sh file_types:elf malware_types:botnet malware_types:backdoor file_types:javascript file_types:js malware_types:trojan techniques:encryption

Necurs – hybrid spam botnet

2016-09-02

Author: Adam Krasuski

malware_types:botnet source_tag:analysis source_tag:malware source_tag:necurs

MMD-0056-2016 - Linux/Mirai, how an old ELF malcode is recycled

2016-09-01

Author: unixfreaxjp

platforms:linux file_types:bin file_types:exe architecture:arm architecture:mips techniques:honeypot file_types:sh file_types:elf malware_types:backdoor architecture:powerpc

MMD-0055-2016 - Linux/PnScan ; A worm that still circles around

2016-08-24

Author: unixfreaxjp

platforms:linux architecture:arm debugger:gdb architecture:mips disassembler:objdump file_types:elf malware_types:worm malware_types:rootkit malware_types:virus techniques:persistence

Click File, App Opens

2016-08-23

file_types:html file_types:so techniques:persistence file_types:cmd file_types:xml platforms:macos platforms:ios file_types:mach-o debugger:lldb malware_types:adware

Network traffic periodicity analysis of dark address space

2016-08-01

Author: piotrb

source_tag:analysis source_tag:dark space source_tag:dft

Persisting via a Finder Sync

2016-07-24

malware_types:loader file_types:so techniques:persistence file_types:xml platforms:macos

MMD-0054-2016 - ATMOS botnet facts you should know

2016-06-07

Author: unixfreaxjp

malware_types:rat malware_types:botnet file_types:so file_types:go malware_types:trojan techniques:encryption malware_families:zeus malware_types:crypter platforms:windows

Newest addition to a happy family: KBOT

2016-05-17

Author: mak

source_tag:analysis source_tag:malware source_tag:kbot

Are you from the Mac App Store?

2016-05-01

malware_types:ransomware file_types:so techniques:sandbox platforms:ios

Towards Generic Ransomware Detection

2016-04-20

malware_types:ransomware file_types:rar file_types:zip file_types:txt architecture:x86 file_types:bin techniques:honeypot file_types:sh file_types:javascript malware_types:trojan

MMD-0053-2016 - Linux/STD IRC Botnet: x00's CBack aka xxx.pokemon.inc

2016-04-16

Author: unixfreaxjp

platforms:linux file_types:bin file_types:html disassembler:objdump techniques:unpacking file_types:sh file_types:elf file_types:php malware_types:virus platforms:debian

Analysis of an Intrusive Cross-Platform Adware; OSX/Pirrit

2016-04-05

file_types:zip platforms:linux file_types:txt file_types:python file_types:sh techniques:sandbox techniques:privilege escalation malware_types:keylogger file_types:iso file_types:mach-o

HackingTeam Reborn; A Brief Analysis of an RCS Implant Installer

2016-02-26

file_types:bin file_types:dat techniques:unpacking file_types:so malware_types:virus techniques:persistence malware_types:dropper techniques:decryptor disassembler:ida pro file_types:mach-o

MMD-0052-2016 - Overview of Overall "SkidDDoS" Linux Botnet

2016-02-07

Author: unixfreaxjp

file_types:ruby platforms:linux file_types:bin architecture:arm file_types:python file_types:sh malware_types:botnet file_types:so file_types:go file_types:php

Analyzing the Anti-Analysis Logic of an Adware Installer

2016-02-07

architecture:x86_64 malware_types:downloader platforms:windows platforms:macos file_types:mach-o debugger:lldb techniques:anti-analysis malware_types:adware techniques:string obfuscation techniques:debugger detection

MMD-0051-2016 - Debunking a Tiny Shellhock's ELF backdoor

2016-02-03

Author: unixfreaxjp

platforms:linux architecture:x86 file_types:bin file_types:sh file_types:elf file_types:so file_types:go malware_types:downloader malware_types:virus malware_types:backdoor

MMD-0050-2016 - Linux/Torte infection (in Wordpress)

2016-01-12

Author: unixfreaxjp

platforms:linux file_types:elf malware_types:botnet file_types:so file_types:php malware_types:backdoor platforms:windows platforms:linux server file_types:img file_types:bat

MMD-0049-2016 - Java Trojan Downloader/RCE) for minerd

2016-01-09