Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2023-10-27 ⋅ Twitter (@embee_research) ⋅ Embee_research
Remcos Downloader Analysis - Manual Deobfuscation of Visual Basic and Powershell
Remcos
2023-10-23 ⋅ Twitter (@embee_research) ⋅ Embee_research
Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation
Cobalt Strike
2023-10-20 ⋅ Twitter (@embee_research) ⋅ Embee_research
Decoding a Cobalt Strike .hta Loader Using CyberChef and Emulation
Cobalt Strike
2023-10-18 ⋅ Twitter (@embee_research) ⋅ Embee_research
Ghidra Tutorial - Using Entropy To Locate a Cobalt Strike Decryption Function
Cobalt Strike
2023-10-16 ⋅ Twitter (@embee_research) ⋅ Embee_research
Decoding a Simple Visual Basic (.vbs) Script - DarkGate Loader
DarkGate
2023-10-13 ⋅ Twitter (@JAMESWT_MHT) ⋅ JamesWT
Tweets on Wikiloader delivering ISFB
ISFB WikiLoader
2023-10-10 ⋅ Twitter (@embee_research) ⋅ Embee_research
How To Develop Yara Rules for .NET Malware Using IL ByteCodes
RedLine Stealer
2023-10-05 ⋅ Twitter (@embee_research) ⋅ Embee_research
Introduction to DotNet Configuration Extraction - RevengeRAT
Revenge RAT
2023-10-04 ⋅ Twitter (@embee_research) ⋅ Embee_research
Developing Yara Signatures for Malware - Practical Examples
DarkGate Lu0Bot
2023-09-19 ⋅ Medium (@DCSO_CyTec) ⋅ Johann Aydinbas
#ShortAndMalicious — DarkGate
DarkGate
2023-08-23 ⋅ Twitter (@embee_research) ⋅ Embee_research, Huntress Labs
Extracting Xworm from Bloated Golang Executable
XWorm
2023-08-23 ⋅ Twitter (@cyberwar_15) ⋅ cyberwar_15
Tweet about VT upload of "Cloud agnostic IAM permissions enumerator" from North Korea
2023-07-23 ⋅ irfan_eternal ⋅ Muhammed Irfan V A
Guloader Deobfuscation using Ghidra
CloudEyE
2023-07-23 ⋅ Medium infoSec Write-ups ⋅ mov_eax_27
Unpacking an Emotet Trojan
Emotet
2023-07-11 ⋅ Twitter (@embee_research) ⋅ Embee_research
Tweets on Ransomware Infrastructure Analysis With Censys and GrabbrApp
DarkSide
2023-06-24 ⋅ Twitter (@embee_research) ⋅ Embee_research
SmokeLoader - Malware Analysis and Decoding With Procmon
SmokeLoader
2023-06-08 ⋅ Twitter (@embee_research) ⋅ Embee_research
Practical Queries for Identifying Malware Infrastructure: An informal page for storing Censys/Shodan queries
Amadey AsyncRAT Cobalt Strike QakBot Quasar RAT Sliver solarmarker
2023-05-19 ⋅ Twitter (@embee_research) ⋅ Embee_research
Analysis of Amadey Bot Infrastructure Using Shodan
Amadey
2023-05-18 ⋅ Twitter (@embee_research) ⋅ Embee_research
Identifying Laplas Infrastructure Using Shodan and Censys
LaplasClipper
2023-05-17 ⋅ Medium (@DCSO_CyTec) ⋅ Axel Wauer, Emilia Neuber, Jiro Minier, Johann Aydinbas, Kritika Roy
Andariel’s “Jupiter” malware and the case of the curious C2
Jupiter