Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2023-09-25 ⋅ cocomelonc ⋅ cocomelonc
@online{cocomelonc:20230925:malware:536902a, author = {cocomelonc}, title = {{Malware development trick - part 36: Enumerate process modules. Simple C++ example.}}, date = {2023-09-25}, organization = {cocomelonc}, url = {https://cocomelonc.github.io/malware/2023/09/25/malware-trick-36.html}, language = {English}, urldate = {2023-09-29} } Malware development trick - part 36: Enumerate process modules. Simple C++ example.
4h_rat Aria-body
2023-08-28 ⋅ Github (cocomelonc) ⋅ cocomelonc
@online{cocomelonc:20230828:malware:860380d, author = {cocomelonc}, title = {{Malware and cryptography 20: encrypt/decrypt payload via Skipjack. Simple C++ example.}}, date = {2023-08-28}, organization = {Github (cocomelonc)}, url = {https://cocomelonc.github.io/malware/2023/08/28/malware-cryptography-20.html}, language = {English}, urldate = {2023-08-31} } Malware and cryptography 20: encrypt/decrypt payload via Skipjack. Simple C++ example.
2023-08-13 ⋅ Github (cocomelonc) ⋅ cocomelonc
@online{cocomelonc:20230813:malware:1f15d71, author = {cocomelonc}, title = {{Malware and cryptography 1: encrypt/decrypt payload via RC5. Simple C++ example.}}, date = {2023-08-13}, organization = {Github (cocomelonc)}, url = {https://cocomelonc.github.io/malware/2023/08/13/malware-cryptography-1.html}, language = {English}, urldate = {2023-08-31} } Malware and cryptography 1: encrypt/decrypt payload via RC5. Simple C++ example.
2023-07-26 ⋅ cocomelonc ⋅ cocomelonc
@online{cocomelonc:20230726:malware:44a5642, author = {cocomelonc}, title = {{Malware development trick - part 35: Store payload in alternate data streams. Simple C++ example.}}, date = {2023-07-26}, organization = {cocomelonc}, url = {https://cocomelonc.github.io/malware/2023/07/26/malware-tricks-35.html}, language = {English}, urldate = {2023-07-28} } Malware development trick - part 35: Store payload in alternate data streams. Simple C++ example.
Valak POWERSOURCE Gazer PowerDuke
2023-07-16 ⋅ Github (cocomelonc) ⋅ cocomelonc
@online{cocomelonc:20230716:malware:d7e4f1a, author = {cocomelonc}, title = {{Malware development: persistence - part 22. Windows Setup. Simple C++ example.}}, date = {2023-07-16}, organization = {Github (cocomelonc)}, url = {https://cocomelonc.github.io/persistence/2023/07/16/malware-pers-22.html}, language = {English}, urldate = {2023-07-28} } Malware development: persistence - part 22. Windows Setup. Simple C++ example.
2023-07-15 ⋅ MSSP Lab ⋅ cocomelonc
@online{cocomelonc:20230715:malware:8986fa9, author = {cocomelonc}, title = {{Malware source code investigation: BlackLotus - part 1}}, date = {2023-07-15}, organization = {MSSP Lab}, url = {https://mssplab.github.io/threat-hunting/2023/07/15/malware-src-blacklotus.html}, language = {English}, urldate = {2023-07-17} } Malware source code investigation: BlackLotus - part 1
BlackLotus
2023-07-13 ⋅ MSSP Lab ⋅ cocomelonc
@online{cocomelonc:20230713:malware:3f2bf4a, author = {cocomelonc}, title = {{Malware analysis report: BlackCat ransomware}}, date = {2023-07-13}, organization = {MSSP Lab}, url = {https://mssplab.github.io/threat-hunting/2023/07/13/malware-analysis-blackcat.html}, language = {English}, urldate = {2023-07-17} } Malware analysis report: BlackCat ransomware
BlackCat BlackCat
2023-07-07 ⋅ Github (cocomelonc) ⋅ cocomelonc
@online{cocomelonc:20230707:malware:01cfaa2, author = {cocomelonc}, title = {{Malware development trick - part 34: Find PID via WTSEnumerateProcesses. Simple C++ example.}}, date = {2023-07-07}, organization = {Github (cocomelonc)}, url = {https://cocomelonc.github.io/malware/2023/07/07/malware-tricks-34.html}, language = {English}, urldate = {2023-07-10} } Malware development trick - part 34: Find PID via WTSEnumerateProcesses. Simple C++ example.
2023-06-26 ⋅ Github (cocomelonc) ⋅ cocomelonc
@online{cocomelonc:20230626:malware:8c17615, author = {cocomelonc}, title = {{Malware AV/VM evasion - part 18: encrypt/decrypt payload via modular multiplication-based block cipher. Simple C++ example.}}, date = {2023-06-26}, organization = {Github (cocomelonc)}, url = {https://cocomelonc.github.io/malware/2023/06/26/malware-av-evasion-18.html}, language = {English}, urldate = {2023-07-05} } Malware AV/VM evasion - part 18: encrypt/decrypt payload via modular multiplication-based block cipher. Simple C++ example.
2023-06-23 ⋅ MSSP Lab ⋅ cocomelonc
@online{cocomelonc:20230623:malware:a6cd3d8, author = {cocomelonc}, title = {{Malware source code investigation: Paradise Ransomware}}, date = {2023-06-23}, organization = {MSSP Lab}, url = {https://mssplab.github.io/threat-hunting/2023/06/23/src-paradise.html}, language = {English}, urldate = {2023-06-26} } Malware source code investigation: Paradise Ransomware
Paradise
2023-06-19 ⋅ Github (cocomelonc) ⋅ cocomelonc
@online{cocomelonc:20230619:malware:cddf668, author = {cocomelonc}, title = {{Malware AV/VM evasion - part 17: bypass UAC via fodhelper.exe. Simple C++ example.}}, date = {2023-06-19}, organization = {Github (cocomelonc)}, url = {https://cocomelonc.github.io/malware/2023/06/19/malware-av-evasion-17.html}, language = {English}, urldate = {2023-06-22} } Malware AV/VM evasion - part 17: bypass UAC via fodhelper.exe. Simple C++ example.
Glupteba
2023-06-15 ⋅ Github (cocomelonc) ⋅ cocomelonc
@online{cocomelonc:20230615:malware:c399e93, author = {cocomelonc}, title = {{Malware analysis report: Babuk ransomware}}, date = {2023-06-15}, organization = {Github (cocomelonc)}, url = {https://mssplab.github.io/threat-hunting/2023/06/15/malware-analysis-babuk.html}, language = {English}, urldate = {2023-06-22} } Malware analysis report: Babuk ransomware
Babuk
2023-06-09 ⋅ cocomelonc ⋅ cocomelonc
@online{cocomelonc:20230609:malware:c402dbb, author = {cocomelonc}, title = {{Malware development trick - part 33. Syscalls - part 2. Simple C++ example.}}, date = {2023-06-09}, organization = {cocomelonc}, url = {https://cocomelonc.github.io/malware/2023/06/09/syscalls-2.html}, language = {English}, urldate = {2023-06-22} } Malware development trick - part 33. Syscalls - part 2. Simple C++ example.
2023-06-07 ⋅ cocomelonc ⋅ cocomelonc
@online{cocomelonc:20230607:malware:d2403bd, author = {cocomelonc}, title = {{Malware development trick - part 32. Syscalls - part 1. Simple C++ example.}}, date = {2023-06-07}, organization = {cocomelonc}, url = {https://cocomelonc.github.io/malware/2023/06/07/syscalls-1.html}, language = {English}, urldate = {2023-06-22} } Malware development trick - part 32. Syscalls - part 1. Simple C++ example.
2023-06-04 ⋅ Github (cocomelonc) ⋅ cocomelonc
@online{cocomelonc:20230604:malware:da9637f, author = {cocomelonc}, title = {{Malware development trick - part 31: Run shellcode via SetTimer. Simple C++ example.}}, date = {2023-06-04}, organization = {Github (cocomelonc)}, url = {https://cocomelonc.github.io/malware/2023/06/04/malware-tricks-31.html}, language = {English}, urldate = {2023-06-22} } Malware development trick - part 31: Run shellcode via SetTimer. Simple C++ example.
2023-06-02 ⋅ MSSP Lab ⋅ cocomelonc
@online{cocomelonc:20230602:malware:6b0c57b, author = {cocomelonc}, title = {{Malware analysis report: SNOWYAMBER (+APT29 related malwares)}}, date = {2023-06-02}, organization = {MSSP Lab}, url = {https://mssplab.github.io/threat-hunting/2023/06/02/malware-analysis-apt29.html}, language = {English}, urldate = {2023-06-05} } Malware analysis report: SNOWYAMBER (+APT29 related malwares)
GraphicalNeutrino
2023-05-26 ⋅ cocomelonc ⋅ cocomelonc
@online{cocomelonc:20230526:malware:2af92da, author = {cocomelonc}, title = {{Malware development trick - part 30: Find PID via NtGetNextProcess. Simple C++ example.}}, date = {2023-05-26}, organization = {cocomelonc}, url = {https://cocomelonc.github.io/malware/2023/05/26/malware-tricks-30.html}, language = {English}, urldate = {2023-05-30} } Malware development trick - part 30: Find PID via NtGetNextProcess. Simple C++ example.
2023-05-19 ⋅ cocomelonc ⋅ cocomelonc
@online{cocomelonc:20230519:malware:3b9112f, author = {cocomelonc}, title = {{Malware source code investigation: AsyncRAT}}, date = {2023-05-19}, organization = {cocomelonc}, url = {https://mssplab.github.io/threat-hunting/2023/05/19/malware-src-asyncrat.html}, language = {English}, urldate = {2023-05-26} } Malware source code investigation: AsyncRAT
AsyncRAT
2023-05-11 ⋅ cocomelonc ⋅ cocomelonc
@online{cocomelonc:20230511:malware:f557876, author = {cocomelonc}, title = {{Malware development trick - part 28: Dump lsass.exe. Simple C++ example.}}, date = {2023-05-11}, organization = {cocomelonc}, url = {https://cocomelonc.github.io/malware/2023/05/11/malware-tricks-28.html}, language = {English}, urldate = {2023-05-15} } Malware development trick - part 28: Dump lsass.exe. Simple C++ example.
Cobalt Strike APT3 Keylogger
2023-05-08 ⋅ cocomelonc ⋅ cocomelonc
@online{cocomelonc:20230508:malware:d344f4a, author = {cocomelonc}, title = {{Malware analysis report: WinDealer (LuoYu Threat Group)}}, date = {2023-05-08}, organization = {cocomelonc}, url = {https://mssplab.github.io/threat-hunting/2023/05/08/malware-analysis-windealer.html}, language = {English}, urldate = {2023-05-10} } Malware analysis report: WinDealer (LuoYu Threat Group)
WinDealer