Chances are you have heard about how easy it can be to evade
antivirus. Often, this is because the signatures used by vendors are
too simplistic and can be successfully duped without changing the
functionality of the malware. Have you ever attemp…
Chances are you have heard about how easy it can be to evade
antivirus. Often, this is because the signatures used by vendors are
too simplistic and can be successfully duped without changing the
functionality of the malware. Have you ever attemp…
FireEye’s Innovation and Custom Engineering (ICE) team released a
tool today called GoCrack that allows red
teams to efficiently manage password cracking tasks across multiple
GPU servers by providing an easy-to-use, web-based real-time UI
(Fig…
FireEye’s Innovation and Custom Engineering (ICE) team released a
tool today called GoCrack that allows red
teams to efficiently manage password cracking tasks across multiple
GPU servers by providing an easy-to-use, web-based real-time UI
(Fig…
I (Matthew Haigh) recently contributed to FLARE’s FakeNet-NG
network simulator by adding content-based protocol detection and
configuration. This feature is useful for analyzing malware that uses
a protocol over a non-standard port; for example, …
I (Matthew Haigh) recently contributed to FLARE’s FakeNet-NG
network simulator by adding content-based protocol detection and
configuration. This feature is useful for analyzing malware that uses
a protocol over a non-standard port; for example, …
Introduction
In 2016, FLARE introduced
FakeNet-NG, an open-source network analysis tool written in
Python. FakeNet-NG allows security analysts to observe and interact
with network applications using standard or custom protocols on a
single Win…
Introduction
In 2016, FLARE introduced
FakeNet-NG, an open-source network analysis tool written in
Python. FakeNet-NG allows security analysts to observe and interact
with network applications using standard or custom protocols on a
single Win…
Introduction
The following blog discusses a couple of common techniques that
malware uses to obscure its access to the Windows API. In both forms
examined, analysts must calculate the API start address and resolve
the symbol from the runtime pro…
Introduction
The following blog discusses a couple of common techniques that
malware uses to obscure its access to the Windows API. In both forms
examined, analysts must calculate the API start address and resolve
the symbol from the runtime pro…
