Comprehensive threat analyses, IOCs and research reports on RAT, Infostealer, Backdoor and other malware families.
WannaCry ransomware analysis. EternalBlue (CVE-2017-0144) Worm/ransomware using SMB deficit. Kill switch domain was detected. Dionaea is caught by honeypot.
MalwareBazaar labeled as NjRAT but malware analysis written with Go (Golang). Dropped by Amadey Loader. C2 encrypted.
RemusStealer infostealer analysis. The second example distributed as fake cx-programmer 9.1 crack. The same family with the first example, different campaigns.
RemusStealer infostealer analysis. .NET credential stealer distributed as fake Recuva Professional crack. Discord token, crypto wallet, browser password player.
AgentTesla infostealer analysis. SWIFT payment notice is distributed with themed phishing .NET-based RAT/stealer. SHA256: bc4b5891...
FormBook infostealer/form-grabber family analysis. SHA256: f9dcaff0... UPX packed PE. Keylogger, screenshot, form-grabbing capabilities.