FAUTLReports

MMD-0067-2021 - Recent talks on Linux process injection and shellcode analysis series (ROOTCON-2020, R2CON-2020 ++)

2021-03-03

Author: unixfreaxjp

platforms:linux malware_types:fileless architecture:arm debugger:gdb malware_types:loader architecture:mips file_types:html disassembler:objdump disassembler:die techniques:code injection

ROOTCON 2020 - Deeper diving into shellcode (advanced users)

2021-03-03

MalwareMustDie

Author: unixfreaxjp

platforms:linux malware_types:fileless architecture:arm debugger:gdb malware_types:loader architecture:mips file_types:html disassembler:objdump disassembler:die techniques:code injection

R2CON 2020 - So you don't like shellcode too? (for r2 RE beginners)

2021-03-03

MalwareMustDie

Author: unixfreaxjp

platforms:linux malware_types:fileless architecture:arm debugger:gdb malware_types:loader architecture:mips file_types:html disassembler:objdump disassembler:die techniques:code injection

Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities

2021-03-02

VOLEXITY

Author: Josh Grunzweig, Matthew Meltzer, Sean Koessel, Steven Adair, Thomas Lancaster

file_types:javascript malware_types:zero-day cve:cve-2021-26855

Arm'd & Dangerous

2021-02-14

Objective-See

Author: Patrick Wardle

file_types:bin architecture:arm architecture:x86_64 file_types:sh file_types:so file_types:go malware_types:trojan platforms:macos architecture:arm64 file_types:mach-o

Discharging ElectroRAT

2021-01-05

Objective-See

Author: Patrick Wardle

platforms:linux file_types:bin architecture:x86_64 file_types:python file_types:javascript malware_types:keylogger file_types:css file_types:json file_types:mach-o malware_types:password stealer

The Mac Malware of 2020

2021-01-01

Objective-See

Author: Patrick Wardle

malware_types:ransomware platforms:linux file_types:dat architecture:arm architecture:x86_64 file_types:python file_types:javascript file_types:mach-o techniques:malware analysis tools techniques:kernel-mode rootkit

Responding to the SolarWinds Breach: Detect, Prevent, and Remediate the Dark Halo Supply Chain Attack

2020-12-16

VOLEXITY

Author: Volexity Threat Research

file_types:pdf

Detecting SSH Activity via Process Monitoring

2020-12-10

Objective-See

Author: Jaron Bradley

platforms:linux file_types:bin file_types:sh file_types:so file_types:bash file_types:xml platforms:macos techniques:living off the land file_types:ksh file_types:zsh

Adventures in Anti-Gravity (Part II)

2020-11-27

Objective-See

Author: Patrick Wardle

platforms:linux file_types:html architecture:x86_64 file_types:python file_types:php file_types:javascript cloud_environments:vmware file_types:css platforms:macos file_types:mach-o

OceanLotus: Extending Cyber Espionage Operations Through Fake Websites

2020-11-06

VOLEXITY

Author: Steven Adair, Thomas Lancaster, Volexity Threat Research

disassembler:die

Adventures in Anti-Gravity (Part I)

2020-11-03

Objective-See

Author: Patrick Wardle

malware_types:ransomware platforms:linux file_types:bin architecture:x86_64 file_types:python file_types:php techniques:persistence malware_types:spyware platforms:macos file_types:mach-o

Property List Parsing Bug(s)

2020-10-21

Objective-See

Author: @OSCartography

file_types:so file_types:go platforms:windows file_types:xml platforms:macos platforms:ios debugger:lldb file_types:dylib file_types:objective-c disassembler:ghidra

FinFisher Filleted

2020-09-26

Objective-See

Author: Patrick Wardle

file_types:zip platforms:linux file_types:bin file_types:dat architecture:x86_64 file_types:python techniques:privilege escalation file_types:mach-o file_types:objective-c techniques:kernel-mode rootkit

Apple Approved Malware

2020-08-30

Objective-See

Author: Patrick Wardle

architecture:x86_64 file_types:sh file_types:bash malware_types:virus malware_types:backdoor file_types:java cloud_environments:vmware platforms:macos file_types:mach-o malware_types:adware

Office Drama on macOS

2020-08-04

Objective-See

Author: Patrick Wardle

file_types:zip file_types:bin file_types:dat file_types:python file_types:so platforms:windows techniques:sandbox file_types:doc file_types:swift cve:cve-2019-1457

CVE-2020–9854: "Unauthd"

2020-08-01

Objective-See

Author: Ilias Morad

file_types:so file_types:go file_types:c file_types:xml platforms:macos

CVE-2020–9934: Bypassing TCC for Unauthorized Access

2020-07-29

Objective-See

Author: Matt Shockley

file_types:so file_types:swift platforms:macos platforms:ios disassembler:ghidra

Low-Level Process Hunting on macOS

2020-07-19

Objective-See

Author: Jaron Bradely

file_types:bin techniques:system calls disassembler:die file_types:sh file_types:so file_types:go file_types:bash platforms:macos file_types:ksh file_types:zsh

OSX.EvilQuest Uncovered (part two)

2020-07-03

Objective-See

Author: Patrick Wardle

malware_types:ransomware file_types:rar file_types:zip file_types:txt file_types:pdf file_types:dat architecture:x86_64 file_types:json file_types:pptx file_types:rtf

Malware Analysis Reports