Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2023-07-06 ⋅ kienmanowar Blog ⋅ Tran Trung Kien, m4n0w4r
@online{kien:20230706:quicknote:20dc1f1, author = {Tran Trung Kien and m4n0w4r}, title = {{[QuickNote] Examining Formbook Campaign via Phishing Emails}}, date = {2023-07-06}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2023/07/06/quicknote-examining-formbook-campaign-via-phishing-emails/}, language = {English}, urldate = {2023-07-13} } [QuickNote] Examining Formbook Campaign via Phishing Emails
Formbook
2023-05-22 ⋅ kienmanowar Blog ⋅ m4n0w4r
@online{m4n0w4r:20230522:case:c053ed3, author = {m4n0w4r}, title = {{[Case study] Decrypt strings using Dumpulator}}, date = {2023-05-22}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2023/05/22/case-study-decrypt-strings-using-dumpulator/}, language = {English}, urldate = {2023-05-25} } [Case study] Decrypt strings using Dumpulator
2023-04-08 ⋅ kienmanowar Blog ⋅ Tran Trung Kien, m4n0w4r
@online{kien:20230408:quicknote:e44f40f, author = {Tran Trung Kien and m4n0w4r}, title = {{[QuickNote] Uncovering Suspected Malware Distributed By Individuals from Vietnam}}, date = {2023-04-08}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2023/04/08/quicknote-uncovering-suspected-malware-distributed-by-individuals-from-vietnam/}, language = {English}, urldate = {2023-04-08} } [QuickNote] Uncovering Suspected Malware Distributed By Individuals from Vietnam
AsyncRAT DCRat WorldWind
2023-03-25 ⋅ kienmanowar Blog ⋅ Tran Trung Kien, m4n0w4r
@online{kien:20230325:quicknote:c2b9de4, author = {Tran Trung Kien and m4n0w4r}, title = {{[QuickNote] Decrypting the C2 configuration of Warzone RAT}}, date = {2023-03-25}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2023/03/25/quicknote-decrypting-the-c2-configuration-of-warzone-rat/}, language = {English}, urldate = {2023-03-27} } [QuickNote] Decrypting the C2 configuration of Warzone RAT
Ave Maria
2023-01-09 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
@online{m4n0w4r:20230109:quicknote:5a8b18c, author = {m4n0w4r and Tran Trung Kien}, title = {{[QuickNote] Another nice PlugX sample}}, date = {2023-01-09}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2023/01/09/quicknote-another-nice-plugx-sample/}, language = {English}, urldate = {2023-01-10} } [QuickNote] Another nice PlugX sample
PlugX
2022-12-27 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
@online{m4n0w4r:20221227:diving:857147e, author = {m4n0w4r and Tran Trung Kien}, title = {{Diving into a PlugX sample of Mustang Panda group}}, date = {2022-12-27}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2022/12/27/diving-into-a-plugx-sample-of-mustang-panda-group/}, language = {English}, urldate = {2022-12-29} } Diving into a PlugX sample of Mustang Panda group
PlugX
2022-12-19 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
@online{m4n0w4r:20221219:z2abimonthly:8edee72, author = {m4n0w4r and Tran Trung Kien}, title = {{[Z2A]Bimonthly malware challege – Emotet (Back From the Dead)}}, date = {2022-12-19}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2022/12/19/z2abimonthly-malware-challege-emotet-back-from-the-dead/}, language = {English}, urldate = {2022-12-20} } [Z2A]Bimonthly malware challege – Emotet (Back From the Dead)
Emotet
2022-12-17 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
@online{m4n0w4r:20221217:quicknote:9b33765, author = {m4n0w4r and Tran Trung Kien}, title = {{[QuickNote] VidarStealer Analysis}}, date = {2022-12-17}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2022/12/17/quicknote-vidarstealer-analysis/}, language = {English}, urldate = {2022-12-19} } [QuickNote] VidarStealer Analysis
Vidar
2022-06-04 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
@online{m4n0w4r:20220604:quicknote:dc79142, author = {m4n0w4r and Tran Trung Kien}, title = {{[QuickNote] CobaltStrike SMB Beacon Analysis}}, date = {2022-06-04}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2022/06/04/quicknote-cobaltstrike-smb-beacon-analysis-2/}, language = {English}, urldate = {2022-06-07} } [QuickNote] CobaltStrike SMB Beacon Analysis
Cobalt Strike
2022-02-24 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
@online{m4n0w4r:20220224:quicknote:bea9238, author = {m4n0w4r and Tran Trung Kien}, title = {{[QuickNote] Techniques for decrypting BazarLoader strings}}, date = {2022-02-24}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2022/02/24/quicknote-techniques-for-decrypting-bazarloader-strings/}, language = {English}, urldate = {2022-03-01} } [QuickNote] Techniques for decrypting BazarLoader strings
BazarBackdoor
2022-01-23 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
@online{m4n0w4r:20220123:quicknote:852995b, author = {m4n0w4r and Tran Trung Kien}, title = {{[QuickNote] Emotet epoch4 & epoch5 tactics}}, date = {2022-01-23}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2022/01/23/quicknote-emotet-epoch4-epoch5-tactics/}, language = {English}, urldate = {2022-01-25} } [QuickNote] Emotet epoch4 & epoch5 tactics
Emotet
2021-09-06 ⋅ kienmanowar Blog ⋅ m4n0w4r
@online{m4n0w4r:20210906:quick:0a892b2, author = {m4n0w4r}, title = {{Quick analysis CobaltStrike loader and shellcode}}, date = {2021-09-06}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2021/09/06/quick-analysis-cobaltstrike-loader-and-shellcode/}, language = {English}, urldate = {2021-09-10} } Quick analysis CobaltStrike loader and shellcode
Cobalt Strike
2021-08-04 ⋅ kienmanowar Blog ⋅ m4n0w4r, Tran Trung Kien
@online{m4n0w4r:20210804:quicknote:791df11, author = {m4n0w4r and Tran Trung Kien}, title = {{[QuickNote] MountLocker – Some pseudo-code snippets}}, date = {2021-08-04}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2021/08/04/quicknote-mountlocker-some-pseudo-code-snippets/}, language = {English}, urldate = {2021-09-09} } [QuickNote] MountLocker – Some pseudo-code snippets
Mount Locker
2021-05-11 ⋅ kienmanowar Blog ⋅ m4n0w4r
@online{m4n0w4r:20210511:quick:34539c5, author = {m4n0w4r}, title = {{Quick analysis note about DealPly (Adware)}}, date = {2021-05-11}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2021/05/11/quick-analysis-note-about-dealply-adware/}, language = {English}, urldate = {2021-05-19} } Quick analysis note about DealPly (Adware)
DealPly
2020-08-16 ⋅ kienmanowar Blog ⋅ m4n0w4r
@online{m4n0w4r:20200816:manual:7a970b8, author = {m4n0w4r}, title = {{Manual Unpacking IcedID Write-up}}, date = {2020-08-16}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2020/08/16/manual-unpacking-icedid-write-up/}, language = {English}, urldate = {2020-08-20} } Manual Unpacking IcedID Write-up
IcedID
2020-06-27 ⋅ kienmanowar Blog ⋅ m4n0w4r
@online{m4n0w4r:20200627:quick:4b18a32, author = {m4n0w4r}, title = {{Quick analysis note about GuLoader (or CloudEyE)}}, date = {2020-06-27}, organization = {kienmanowar Blog}, url = {https://kienmanowar.wordpress.com/2020/06/27/quick-analysis-note-about-guloader-or-cloudeye/}, language = {English}, urldate = {2020-07-13} } Quick analysis note about GuLoader (or CloudEyE)
CloudEyE