Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2021-07-09 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Hancitor tries XLL as initial malware file
Cobalt Strike Hancitor
2021-04-19 ⋅ InfoSec Handlers Diary Blog ⋅ Jan Kopriva
Hunting phishing websites with favicon hashes
2021-04-14 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
April 2021 Forensic Quiz: Answers and Analysis
Anchor BazarBackdoor Cobalt Strike
2021-04-06 ⋅ InfoSec Handlers Diary Blog ⋅ Jan Kopriva
Malspam with Lokibot vs. Outlook and RFCs
Loki Password Stealer (PWS)
2021-03-31 ⋅ InfoSec Handlers Diary Blog ⋅ Xavier Mertens
Quick Analysis of a Modular InfoStealer
Amadey
2021-03-29 ⋅ InfoSec Handlers Diary Blog ⋅ Xavier Mertens
Jumping into Shellcode
2021-03-27 ⋅ InfoSec Handlers Diary Blog ⋅ Guy Bruneau
Malware Analysis with elastic-agent and Microsoft Sandbox
2021-03-07 ⋅ InfoSec Handlers Diary Blog ⋅ Didier Stevens
PCAPs and Beacons
Cobalt Strike
2021-02-12 ⋅ InfoSec Handlers Diary Blog ⋅ Xavier Mertens
AgentTesla Dropped Through Automatic Click in Microsoft Help File
Agent Tesla
2021-02-11 ⋅ InfoSec Handlers Diary Blog ⋅ Jan Kopriva
Agent Tesla hidden in a historical anti-malware tool
Agent Tesla
2021-02-04 ⋅ InfoSec Handlers Diary Blog ⋅ Bojan Zdrnja
Abusing Google Chrome extension syncing for data exfiltration and C&C
2021-02-03 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Excel spreadsheets push SystemBC malware
Cobalt Strike SystemBC
2021-01-28 ⋅ InfoSec Handlers Diary Blog ⋅ Daniel Wesemann
Emotet vs. Windows Attack Surface Reduction
Emotet
2021-01-22 ⋅ InfoSec Handlers Diary Blog ⋅ Xavier Mertens
Another File Extension to Block in your MTA: .jnlp
2021-01-21 ⋅ InfoSec Handlers Diary Blog ⋅ Xavier Mertens
Powershell Dropping a REvil Ransomware
REvil
2021-01-13 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Hancitor activity resumes after a hoilday break
Hancitor
2020-12-24 ⋅ InfoSec Handlers Diary Blog ⋅ Xavier Mertens
Malicious Word Document Delivering an Octopus Backdoor
Octopus
2020-12-15 ⋅ InfoSec Handlers Diary Blog ⋅ Didier Stevens
Analyzing FireEye Maldocs
2020-12-09 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Recent Qakbot (Qbot) activity
Cobalt Strike QakBot
2020-11-03 ⋅ InfoSec Handlers Diary Blog ⋅ Renato Marinho
Attackers Exploiting WebLogic Servers via CVE-2020-14882 to install Cobalt Strike
Cobalt Strike
2020-05-31 ⋅ InfoSec Handlers Diary Blog ⋅ Renato Marinho
Guildma is now using Finger and Signed Binary Proxy Execution to evade defenses
Astaroth
2020-05-23 ⋅ InfoSec Handlers Diary Blog ⋅ Xavier Mertens
AgentTesla Delivered via a Malicious PowerPoint Add-In
Agent Tesla
2020-04-12 ⋅ InfoSec Handlers Diary Blog ⋅ Vinnie
Dynamic analysis technique to get decrypted KPOT Malware
KPOT Stealer
2019-08-26 ⋅ InfoSec Handlers Diary Blog ⋅ Didier Stevens
The DAA File Format
2019-07-11 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Recent AZORult activity
Azorult
2018-03-07 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Ransomware news: GlobeImposter gets a facelift, GandCrab is still out there
Gandcrab GlobeImposter
2017-09-05 ⋅ InfoSec Handlers Diary Blog ⋅ Johannes Ullrich
The Mirai Botnet: A Look Back and Ahead At What's Next
2017-08-29 ⋅ InfoSec Handlers Diary Blog ⋅ Renato Marinho
Second Google Chrome Extension Banker Malware in Two Weeks
IDKEY
2017-07-08 ⋅ InfoSec Handlers Diary Blog ⋅ Xavier Mertens
A VBScript with Obfuscated Base64 Data
Revenge RAT
2009-11-03 ⋅ InfoSec Handlers Diary Blog ⋅ Bojan Zdrnja
Opachki, from (and to) Russia with love
Opachki