FAUTLReports

The Dacls RAT ...now on macOS!

2020-05-05

Author: Patrick Wardle

platforms:linux file_types:bin architecture:x86_64 file_types:so platforms:windows file_types:iso file_types:swift file_types:mach-o techniques:anti-disassembly cve:cve-2019-3396

Evil Eye Threat Actor Resurfaces with iOS Exploit and Updated Implant

2020-04-21

VOLEXITY

Author: Andrew Case, Dave Lassalle, Matthew Meltzer, Sean Koessel, Steven Adair, Thomas Lancaster

platforms:android platforms:ios

Storm Cloud Unleashed: Tibetan Focus of Highly Targeted Fake Flash Campaign

2020-03-31

VOLEXITY

Author: Volexity Threat Research

file_types:javascript

The 'S' in Zoom, Stands for Security

2020-03-30

Objective-See

Author: Patrick Wardle

file_types:dll file_types:bin malware_types:loader architecture:x86_64 file_types:sh file_types:so file_types:go techniques:privilege escalation platforms:macos file_types:mach-o

Weaponizing a Lazarus Group Implant

2020-03-22

Objective-See

Author: Patrick Wardle

malware_types:fileless malware_types:loader file_types:python file_types:so techniques:persistence malware_types:trojan techniques:encryption platforms:macos file_types:mach-o debugger:lldb

Sniffing Authentication References on macOS

2020-03-17

Objective-See

Author: Patrick Wardle

architecture:x86_64 file_types:so file_types:cmd file_types:cpp techniques:privilege escalation platforms:macos debugger:lldb cve:cve-2017-7170

MMD-0066-2020 - Linux/Mirai-Fbot - A re-emerged IoT threat

2020-02-24

MalwareMustDie

Author: unixfreaxjp

platforms:linux architecture:x86 file_types:pdf file_types:bin architecture:arm malware_types:loader architecture:x86_64 file_types:python techniques:unpacking techniques:honeypot

What’s up Emotet?

2020-02-18

CERT.PL

Author: Michał Praszmo

source_tag:analysis source_tag:malware malware_families:emotet

MMD-0065-2020 - Linux/Mirai-Fbot's new encryption explained

2020-01-15

MalwareMustDie

Author: unixfreaxjp

platforms:linux techniques:system calls architecture:arm architecture:mips disassembler:die architecture:x86_64 file_types:sh file_types:elf malware_types:botnet file_types:so

The Mac Malware of 2019

2020-01-01

Objective-See

Author: Patrick Wardle

file_types:ruby file_types:dat malware_types:loader architecture:x86_64 file_types:python file_types:javascript platforms:ubuntu file_types:mach-o techniques:malware analysis tools cve:cve-2019-11707

Mass Surveillance, is an (un)Complicated Business

2019-12-20

Objective-See

Author: Patrick Wardle

file_types:zip file_types:bin file_types:html file_types:python file_types:so techniques:encryption file_types:cmd file_types:xml platforms:ios techniques:virtualization

Lazarus Group Goes 'Fileless'

2019-12-03

Objective-See

Author: Patrick Wardle

file_types:bin malware_types:fileless architecture:x86_64 file_types:sh techniques:persistence malware_types:trojan file_types:xml platforms:macos file_types:mach-o malware_types:adware

Brushaloader gaining new layers like a pro

2019-11-19

CERT.PL

Author: Michał Praszmo

malware_types:loader file_types:so malware_types:dropper source_tag:analysis source_tag:malware source_tag:brushaloader file_types:xls

[0day] Abusing XLM Macros in SYLK Files

2019-11-03

Objective-See

Author: Patrick Wardle

file_types:so file_types:c malware_types:backdoor techniques:sandbox file_types:xml file_types:doc file_types:xls platforms:macos file_types:dylib

HACK.LU 2019 Keynote talk: "Fileless Malware Infection and Linux Process Injection"

2019-10-28

MalwareMustDie

Author: unixfreaxjp

platforms:linux malware_types:fileless debugger:gdb techniques:code injection file_types:elf file_types:so file_types:go disassembler:radare2 techniques:privilege escalation architecture:sparc

Pass the AppleJeus

2019-10-12

Objective-See

Author: Patrick Wardle

file_types:bin architecture:x86_64 file_types:sh file_types:php malware_types:backdoor architecture:x64 file_types:xml platforms:macos file_types:mach-o debugger:lldb

MMD-0064-2019 - Linux/AirDropBot

2019-09-28

MalwareMustDie

Author: unixfreaxjp

platforms:linux architecture:x86 file_types:pdf architecture:arm architecture:x86_64 techniques:unpacking file_types:sh malware_types:botnet file_types:so malware_types:worm

MMD-0063-2019 - Summary of three years research (Sept 2016-Sept 2019)

2019-09-21

MalwareMustDie

Author: unixfreaxjp

file_types:ruby platforms:linux file_types:powershell architecture:arm techniques:unpacking file_types:elf file_types:so file_types:macho malware_types:rootkit file_types:go

Writing a File Monitor with Apple's Endpoint Security Framework

2019-09-17

Objective-See

Author: Patrick Wardle

malware_types:ransomware file_types:bin file_types:so file_types:c techniques:persistence platforms:macos file_types:zsh

Writing a Process Monitor with Apple's Endpoint Security Framework

2019-09-16

Objective-See

Author: Patrick Wardle

malware_types:ransomware file_types:bin file_types:so file_types:c techniques:persistence techniques:encryption platforms:macos platforms:ios debugger:lldb file_types:zsh

Malware Analysis Reports