malc0de

Let’s play (again) with Predator the thief fumik0.com/2019/12/25/let…

Just published my paper on largely undocumented #LazarusGroup/#DPRK campaigns targeting cryptocurrency individuals/orgs (both big and small). The research covers new implants/tactics not currently covered in the media regarding 'fake jobs' campaigns. proofpoint.com/us/threat-insi…

Dusted off honeytrap, my low-interaction honeypot, for the second dawn of remote exploits and migrated it to github github.com/tillmannw/hone…

CVE aging and Exploit Kits (those used in mass blind attack) in the past 5 years: freshest working RCE exploit is now patched since a year.

Generic Unpacking with r2pipe blog.devit.co/unpacking-with…

[blog post / tool] ApiScout: Painless Windows API information recovery. byte-atlas.blogspot.com/2017/04/apisco…

IDA pro plugin to find crypto constants (and more) based on YARA github.com/polymorf/findc…

contagio: Russian APT - APT28 collection of samples including OSX XAgent bit.ly/2loSHSM

Sundown integrating CVE-2016-7200 & CVE-2016-7201 (Edge) malware.dontneedcoffee.com/2017/01/CVE-20…

VolUtility Version 1.0 Release - web front end for the #Volatility memory analysis framework techanarchy.net/2016/11/voluti…

Introducing Pafish Macro, the Office document to check your favorite sandbox against recent VBA / Macro evasions! bit.ly/2dJAlYw

The "AdGholas" malvertising : steganography & files whitelist to hide in plain sight proofpoint.com/us/threat-insi…

No more angler, so ekdeco+=neutrino, github.com/mak/ekdeco/blo… seems to work on recent dumps from @malware_traffic ;]

Loffice - Analyzing malicious documents using WinDbg thembits.blogspot.com/2016/06/loffic…

Is it the End of Angler EK ? malware.dontneedcoffee.com/2016/06/is-it-…

Bedep has raised its game vs Bot Zombies malware.dontneedcoffee.com/2016/04/bedepa…

CVE-2016-1001 has been added to Angler EK. malware.dontneedcoffee.com/2016/03/flash-…

RIG is exploiting CVE-2016-0034 (Silverlight). malware.dontneedcoffee.com/2016/02/cve-20… Spotted by @malc0de. ID by: @antonivanovm

Angler EK is now exploiting Silverlight up to 5.1.41105.0 (CVE-2016-0034 ? ) malware.dontneedcoffee.com/2016/02/cve-20…

Angler EK landing page decoder github.com/mak/ekdeco/blo…