Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2020-11-17Cisco TalosNikhil Hegde
@online{hegde:20201117:nibiru:7a0faf4, author = {Nikhil Hegde}, title = {{Nibiru ransomware variant decryptor}}, date = {2020-11-17}, organization = {Cisco Talos}, url = {https://blog.talosintelligence.com/2020/11/Nibiru-ransomware.html}, language = {English}, urldate = {2020-11-19} } Nibiru ransomware variant decryptor
Nibiru
2020-09-18Github (gdbinit)Pedro Vilaça
@online{vilaa:20200918:evilquestthiefquest:a7625a8, author = {Pedro Vilaça}, title = {{EvilQuest/ThiefQuest strings decrypt/deobfuscator}}, date = {2020-09-18}, organization = {Github (gdbinit)}, url = {https://github.com/gdbinit/evilquest_deobfuscator}, language = {English}, urldate = {2020-09-19} } EvilQuest/ThiefQuest strings decrypt/deobfuscator
EvilQuest
2020-09-10QuoSec GmbHQuosec Blog
@online{blog:20200910:grap:d2f055d, author = {Quosec Blog}, title = {{grap: Automating QakBot strings decryption}}, date = {2020-09-10}, organization = {QuoSec GmbH}, url = {https://blog.quosec.net/posts/grap_qakbot_strings/}, language = {English}, urldate = {2020-11-09} } grap: Automating QakBot strings decryption
QakBot
2020-09-10Medium mariohenkelMario Henkel
@online{henkel:20200910:decrypting:2bcb10d, author = {Mario Henkel}, title = {{Decrypting NanoCore config and dump all plugins}}, date = {2020-09-10}, organization = {Medium mariohenkel}, url = {https://medium.com/@mariohenkel/decrypting-nanocore-config-and-dump-all-plugins-f4944bfaba52}, language = {English}, urldate = {2020-09-10} } Decrypting NanoCore config and dump all plugins
Nanocore RAT
2020-09-03Medium mariohenkelMario Henkel
@online{henkel:20200903:decrypting:16cd7a9, author = {Mario Henkel}, title = {{Decrypting AgentTesla strings and config}}, date = {2020-09-03}, organization = {Medium mariohenkel}, url = {https://medium.com/@mariohenkel/decrypting-agenttesla-strings-and-config-b9000b18c996?sk=fcead9538516eeb3daa7b53cb537f6f4}, language = {English}, urldate = {2020-09-03} } Decrypting AgentTesla strings and config
Agent Tesla
2020-08-21Palo Alto Networks Unit 42Brad Duncan
@online{duncan:20200821:wireshark:d98d5ed, author = {Brad Duncan}, title = {{Wireshark Tutorial: Decrypting HTTPS Traffic}}, date = {2020-08-21}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/wireshark-tutorial-decrypting-https-traffic/}, language = {English}, urldate = {2020-08-25} } Wireshark Tutorial: Decrypting HTTPS Traffic
Dridex
2020-08-18Medium mariohenkelMario Henkel
@online{henkel:20200818:decrypt:e395f6d, author = {Mario Henkel}, title = {{Decrypt MassLogger 2.4.0.0 configuration}}, date = {2020-08-18}, organization = {Medium mariohenkel}, url = {https://medium.com/@mariohenkel/decrypt-masslogger-2-4-0-0-configuration-eff3ee0720a7}, language = {English}, urldate = {2020-08-18} } Decrypt MassLogger 2.4.0.0 configuration
MASS Logger
2020-07-27Sophos LabsSean Gallagher
@online{gallagher:20200727:prolock:4992cfc, author = {Sean Gallagher}, title = {{ProLock ransomware gives you the first 8 kilobytes of decryption for free}}, date = {2020-07-27}, organization = {Sophos Labs}, url = {https://news.sophos.com/en-us/2020/07/27/prolock-ransomware-gives-you-the-first-8-kilobytes-of-decryption-for-free/}, language = {English}, urldate = {2020-07-30} } ProLock ransomware gives you the first 8 kilobytes of decryption for free
PwndLocker
2020-06-24ESET ResearchLukáš Štefanko
@online{tefanko:20200624:new:ccea4e8, author = {Lukáš Štefanko}, title = {{New ransomware posing as COVID‑19 tracing app targets Canada; ESET offers decryptor}}, date = {2020-06-24}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/06/24/new-ransomware-uses-covid19-tracing-guise-target-canada-eset-decryptor/}, language = {English}, urldate = {2020-06-24} } New ransomware posing as COVID‑19 tracing app targets Canada; ESET offers decryptor
CryCryptor
2020-06-11Twitter (@Securityinbits)Security-in-Bits
@online{securityinbits:20200611:avaddon:b50486e, author = {Security-in-Bits}, title = {{Tweet on Avaddon ransomware with Python script for decrypting strings}}, date = {2020-06-11}, organization = {Twitter (@Securityinbits)}, url = {https://twitter.com/Securityinbits/status/1271065316903120902}, language = {English}, urldate = {2020-06-12} } Tweet on Avaddon ransomware with Python script for decrypting strings
Avaddon Ransomware
2020-05-18Github (dlegezo)Denis Legezo
@online{legezo:20200518:microcin:b3147b6, author = {Denis Legezo}, title = {{Microcin Decryptor}}, date = {2020-05-18}, organization = {Github (dlegezo)}, url = {https://github.com/dlegezo/common}, language = {English}, urldate = {2020-05-19} } Microcin Decryptor
Microcin
2020-05-07BitdefenderBitdefender Team
@online{team:20200507:gogoogle:d6b8c14, author = {Bitdefender Team}, title = {{GoGoogle Decryption Tool}}, date = {2020-05-07}, organization = {Bitdefender}, url = {https://labs.bitdefender.com/2020/05/gogoogle-decryption-tool/}, language = {English}, urldate = {2020-07-07} } GoGoogle Decryption Tool
GoGoogle
2020-05-07Github (mlodic)Matteo Lodi
@online{lodi:20200507:ursnif:5654de4, author = {Matteo Lodi}, title = {{Ursnif beacon decryptor}}, date = {2020-05-07}, organization = {Github (mlodic)}, url = {https://github.com/mlodic/ursnif_beacon_decryptor}, language = {English}, urldate = {2020-05-07} } Ursnif beacon decryptor
Gozi ISFB
2020-05-02BitdefenderBitdefender Team
@online{team:20200502:shade:a1481f9, author = {Bitdefender Team}, title = {{Shade / Troldesh Ransomware decryption tool}}, date = {2020-05-02}, organization = {Bitdefender}, url = {https://labs.bitdefender.com/2020/05/shade-troldesh-ransomware-decryption-tool/}, language = {English}, urldate = {2020-05-05} } Shade / Troldesh Ransomware decryption tool
Troldesh
2020-04-27ZDNetCatalin Cimpanu
@online{cimpanu:20200427:shade:4d47bf1, author = {Catalin Cimpanu}, title = {{Shade (Troldesh) ransomware shuts down and releases decryption keys}}, date = {2020-04-27}, organization = {ZDNet}, url = {https://www.zdnet.com/article/shade-troldesh-ransomware-shuts-down-and-releases-all-decryption-keys/}, language = {English}, urldate = {2020-04-28} } Shade (Troldesh) ransomware shuts down and releases decryption keys
Troldesh
2020-04-26Nullteilerfrei BlogLars Wallenborn
@online{wallenborn:20200426:use:04235ea, author = {Lars Wallenborn}, title = {{use Ghidra to Decrypt Strings of KPOTstealer Malware}}, date = {2020-04-26}, organization = {Nullteilerfrei Blog}, url = {https://blag.nullteilerfrei.de/2020/04/26/use-ghidra-to-decrypt-strings-of-kpotstealer-malware/}, language = {English}, urldate = {2020-05-05} } use Ghidra to Decrypt Strings of KPOTstealer Malware
KPOT Stealer
2020-04-12InfoSec Handlers Diary BlogVinnie
@online{vinnie:20200412:dynamic:191820f, author = {Vinnie}, title = {{Dynamic analysis technique to get decrypted KPOT Malware}}, date = {2020-04-12}, organization = {InfoSec Handlers Diary Blog}, url = {https://isc.sans.edu/diary/26010}, language = {English}, urldate = {2020-04-26} } Dynamic analysis technique to get decrypted KPOT Malware
KPOT Stealer
2020-03-05Bleeping ComputerLawrence Abrams
@online{abrams:20200305:pwndlocker:d9b200a, author = {Lawrence Abrams}, title = {{PwndLocker Ransomware Gets Pwned: Decryption Now Available}}, date = {2020-03-05}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/}, language = {English}, urldate = {2020-03-05} } PwndLocker Ransomware Gets Pwned: Decryption Now Available
PwndLocker
2020-01-26Youtube (OALabs)Sergei Frankoff, Sean Wilson
@online{frankoff:20200126:ida:a8194b4, author = {Sergei Frankoff and Sean Wilson}, title = {{IDA Pro Automated String Decryption For REvil Ransomware}}, date = {2020-01-26}, organization = {Youtube (OALabs)}, url = {https://www.youtube.com/watch?v=l2P5CMH9TE0}, language = {English}, urldate = {2020-01-27} } IDA Pro Automated String Decryption For REvil Ransomware
REvil
2020-01-24Github (TheEnergyStory)R136a1
@online{r136a1:20200124:project:668d490, author = {R136a1}, title = {{Project TajMahal IOCs and Registry Data Decrypter}}, date = {2020-01-24}, organization = {Github (TheEnergyStory)}, url = {https://github.com/TheEnergyStory/malware_analysis/tree/master/TajMahal}, language = {English}, urldate = {2020-01-27} } Project TajMahal IOCs and Registry Data Decrypter
Chaperone