Byte Atlas

[blog post] MalpediaFLOSSed danielplohmann.github.io/blog/2024/03/0…

[blog post] Upgraded MCRIT Feature: IDA Plugin danielplohmann.github.io/blog/2023/08/0…

[blog post] Knowledge Fragment: Hardening Win10 x64 on VirtualBox for Malware Analysis danielplohmann.github.io/blog/2023/08/0…

[blog post] MCRIT: The MinHash-based Code Relationship & Investigation Toolkit danielplohmann.github.io/blog/2023/06/0…

[blog post] Casting Sandbox Necromancy on DADSTACHE danielplohmann.github.io/blog/2020/07/1…

[blog post] I updated "The Big Zeus Family Similarity Showdown", now with almost twice the samples and 4 new zeus-like families! byte-atlas.blogspot.com/2018/05/zeus-s…

[blog post] Upgrading ApiScout: Introducing ApiVectors. byte-atlas.blogspot.de/2018/04/apivec…

[blog post] The Big Zeus Family Similarity Showdown. byte-atlas.blogspot.de/2018/01/zeus-s…

[blog post] Quick analysis / identification of the "link" function between the Lazarus and WannaCry sample: byte-atlas.blogspot.com/2017/05/wannac…

[blog post / tool] ApiScout: Painless Windows API information recovery. byte-atlas.blogspot.com/2017/04/apisco…

[blog post] Hardening Win7 x64 on VirtualBox for Malware Analysis byte-atlas.blogspot.com/2017/02/harden…

[blog post] Fobber Inline String Decryption byte-atlas.blogspot.com/2015/08/knowle…

[blog post] Unwrapping Fobber byte-atlas.blogspot.com/2015/08/knowle…

[blog post] Bruteforcing Andromeda C&C configurations. byte-atlas.blogspot.de/2015/04/kf-and…

Regex to check you web server access logs for CVE-2014-6271 Shell Shock exploitation (v2 egrep compatible) \(\)\s\{.*;\s*\};

@emgent @MalwareMustDie @sawaba @yinettesys @robertgraham @Botconf thx

@emgent @MalwareMustDie @sawaba @yinettesys @robertgraham @Botconf care share + provide context? 8dc64426f9d07587c19e10f1bb3d2799 not on VT.

@_g3nuin3 all from the binaries is listed here: zerobin.net/?4126dd143e521… - I didn't run the bot so I don't if they changed servers. :-/

cursory static analysis of DingleElite DDoS bot: zerobin.net/?4126dd143e521…

@MalwareMustDie @sawaba @yinettesys @robertgraham @emgent @Botconf here is a quick static analysis of that bot: zerobin.net/?4126dd143e521…