FAUTLReports

Automating String Decoding in Malware: Analysing StealC V1 with IDAPython

2025-06-04

file_types:python file_types:elf file_types:so file_types:c techniques:encryption techniques:obfuscation techniques:anti-analysis techniques:string obfuscation debugger:pdb

Restoring Reflective Code Loading on macOS

2024-12-16

Objective-See

Author: Patrick Wardle

malware_types:fileless malware_types:loader file_types:so file_types:go techniques:encryption platforms:windows file_types:cpp platforms:macos file_types:mach-o file_types:dylib

Analyzing DPRK's SpectralBlur

2024-01-04

Objective-See

Author: Patrick Wardle

file_types:zip file_types:bin architecture:x86_64 file_types:sh file_types:so malware_types:backdoor techniques:encryption platforms:macos file_types:mach-o debugger:lldb

Weaponizing a Lazarus Group Implant

2020-03-22

Objective-See

Author: Patrick Wardle

malware_types:fileless malware_types:loader file_types:python file_types:so techniques:persistence malware_types:trojan techniques:encryption platforms:macos file_types:mach-o debugger:lldb

Mass Surveillance, is an (un)Complicated Business

2019-12-20

Objective-See

Author: Patrick Wardle

file_types:zip file_types:bin file_types:html file_types:python file_types:so techniques:encryption file_types:cmd file_types:xml platforms:ios techniques:virtualization

Writing a Process Monitor with Apple's Endpoint Security Framework

2019-09-16

Objective-See

Author: Patrick Wardle

malware_types:ransomware file_types:bin file_types:so file_types:c techniques:persistence techniques:encryption platforms:macos platforms:ios debugger:lldb file_types:zsh

An Insecurity in Apple's Security Framework?

2018-05-02

Objective-See

malware_types:ransomware file_types:so file_types:c techniques:encryption file_types:cpp file_types:swift platforms:macos platforms:ios debugger:lldb

OSX/MacRansom: Analyzing new Ransomware Targeting Macs

2017-06-12

Objective-See

malware_types:ransomware file_types:txt file_types:bin file_types:so file_types:bash techniques:persistence techniques:encryption platforms:macos debugger:lldb techniques:anti-analysis

Mole ransomware: analysis and decryptor

2017-05-30

CERT.PL

Author: Jarosław Jedynak

malware_types:ransomware file_types:so techniques:encryption techniques:decryptor source_tag:analysis source_tag:malware source_tag:tools

Two Bugs, One Func(), part one

2017-03-27

Objective-See

malware_types:ransomware platforms:linux file_types:bin file_types:sh file_types:so file_types:bash techniques:encryption disassembler:ida pro platforms:macos debugger:lldb

MMD-0057-2016 - Linux/LuaBot - IoT botnet as service

2016-09-06

MalwareMustDie

Author: unixfreaxjp

platforms:linux architecture:arm file_types:sh file_types:elf malware_types:botnet malware_types:backdoor file_types:javascript file_types:js malware_types:trojan techniques:encryption

MMD-0054-2016 - ATMOS botnet facts you should know

2016-06-07

MalwareMustDie

Author: unixfreaxjp

malware_types:rat malware_types:botnet file_types:so file_types:go malware_types:trojan techniques:encryption malware_families:zeus malware_types:crypter platforms:windows

MMD-0046-2015 - Kelihos 10 nodes C2 / CNC on NJIIX (US) and its actor(Severa)

2015-12-21

MalwareMustDie

Author: unixfreaxjp

file_types:pe file_types:html malware_types:botnet file_types:so file_types:go file_types:c file_types:javascript file_types:js techniques:encryption

MMD-0036-2015 - KINS (ZeusVM)v2.0.0. builder & panel leaks

2015-07-05

MalwareMustDie

Author: unixfreaxjp

techniques:code injection malware_types:botnet file_types:so file_types:go file_types:php malware_types:virus techniques:encryption malware_families:zeus

MMD-0029-2014 - Warning of Linux/Mayhem attack in Shellshock

2014-10-07

MalwareMustDie

Author: unixfreaxjp

platforms:linux architecture:x86 file_types:bin file_types:elf malware_types:botnet file_types:so file_types:php malware_types:virus techniques:encryption architecture:x64

MMD-0021-2014 - Linux/Elknot: China's origin ELF DDoS+backdoor

2014-05-13

MalwareMustDie

Author: unixfreaxjp

platforms:linux techniques:system calls file_types:exe file_types:html file_types:elf file_types:so malware_types:virus malware_types:backdoor techniques:encryption file_types:cpp

MMD-0015-2014 - One upon the time with Phishing Session..

2014-02-05

MalwareMustDie

Author: unixfreaxjp

techniques:phishing file_types:html techniques:honeypot malware_types:botnet file_types:so file_types:go file_types:javascript file_types:js techniques:encryption cloud_environments:aws

MMD-0014-2014 - New Locker: Prison Locker (aka: Power Locker)

2014-01-03

MalwareMustDie

Author: unixfreaxjp

malware_types:ransomware file_types:bin file_types:pe file_types:exe file_types:so file_types:go techniques:encryption file_types:cmd techniques:decryptor techniques:hooking

BOTCONF 2013 - Kelihos: Botnet, Takedown, Mule Actor

2013-12-11

MalwareMustDie

Author: unixfreaxjp

malware_types:loader file_types:html malware_types:botnet file_types:so file_types:go malware_types:downloader file_types:php techniques:encryption file_types:xml malware_families:cryptolocker

Cracking of Strong Encrypted PHP / IRC Bot (PBOT)

2012-09-04

MalwareMustDie

Author: unixfreaxjp

platforms:linux file_types:so file_types:go file_types:php malware_types:virus file_types:c malware_types:backdoor file_types:js techniques:encryption

Malware Analysis Reports