Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2026-08-21 ⋅ Netresec ⋅ Erik Hjelmvik
CNCMachineRMS C2 Protocol
Babadeda
2026-07-27 ⋅ Netresec ⋅ Erik Hjelmvik
PureLogs, PureRAT and misleading zgRAT
PureLogs Stealer PureRAT zgRAT
2026-06-25 ⋅ Netresec ⋅ Erik Hjelmvik
Ping32 RMM and ValleyRAT
ValleyRAT
2026-02-02 ⋅ Netresec ⋅ Erik Hjelmvik
njRAT runs MassLogger
MASS Logger NjRAT
2025-12-10 ⋅ Netresec ⋅ Erik Hjelmvik
Latrodectus BackConnect
IcedID Keyhole Latrodectus
2025-09-24 ⋅ Netresec ⋅ Erik Hjelmvik
Gh0stKCP Protocol
PseudoManuscrypt ValleyRAT
2025-08-12 ⋅ Netresec ⋅ Erik Hjelmvik
PureRAT = ResolverRAT = PureHVNC
PureRAT
2025-07-02 ⋅ Netresec ⋅ Erik Hjelmvik
PureLogs Forensics
PureLogs Stealer
2025-06-09 ⋅ Netresec ⋅ Erik Hjelmvik
Detecting PureLogs traffic with CapLoader
PureLogs Stealer
2025-04-28 ⋅ Netresec ⋅ Erik Hjelmvik
Decoding njRAT traffic with NetworkMiner
NjRAT
2024-01-04 ⋅ Netresec ⋅ Erik Hjelmvik
Hunting for Cobalt Strike in PCAP
Cobalt Strike
2023-10-12 ⋅ Netresec ⋅ Erik Hjelmvik
Forensic Timeline of an IcedID Infection
Cobalt Strike IcedID IcedID Downloader
2023-04-26 ⋅ Netresec ⋅ Erik Hjelmvik
EvilExtractor Network Forensics
EvilExtractor
2023-03-02 ⋅ Netresec ⋅ Erik Hjelmvik
QakBot C2 Traffic
QakBot
2023-02-15 ⋅ Netresec ⋅ Erik Hjelmvik
How to Identify IcedID Network Traffic
IcedID
2022-10-12 ⋅ Netresec ⋅ Erik Hjelmvik
IcedID BackConnect Protocol
IcedID
2022-05-09 ⋅ Netresec ⋅ Erik Hjelmvik
Emotet C2 and Spam Traffic Video
Emotet
2022-04-25 ⋅ Netresec ⋅ Erik Hjelmvik
Industroyer2 IEC-104 Analysis
INDUSTROYER2
2021-04-19 ⋅ Netresec ⋅ Erik Hjelmvik
Analysing a malware PCAP with IcedID and Cobalt Strike traffic
Cobalt Strike IcedID
2021-02-17 ⋅ Netresec ⋅ Erik Hjelmvik
Targeting Process for the SolarWinds Backdoor
SUNBURST
2021-01-25 ⋅ Netresec ⋅ Erik Hjelmvik
Twenty-three SUNBURST Targets Identified
SUNBURST
2021-01-11 ⋅ Netresec ⋅ Erik Hjelmvik
Robust Indicators of Compromise for SUNBURST
SUNBURST
2021-01-04 ⋅ Netresec ⋅ Erik Hjelmvik
Finding Targeted SUNBURST Victims with pDNS
SUNBURST
2020-12-29 ⋅ Netresec ⋅ Erik Hjelmvik
Extracting Security Products from SUNBURST DNS Beacons
SUNBURST
2020-12-17 ⋅ Netresec ⋅ Erik Hjelmvik
Reassembling Victim Domain Fragments from SUNBURST DNS
SUNBURST
2014-10-27 ⋅ Netresec ⋅ Erik Hjelmvik
Full Disclosure of Havex Trojans
ENERGETIC BEAR