This is a collection of our raw research notes. Each post is generated from a Jupyter Notebook that can be found in our GitHub Research repository. Notes may contain errors, spelling mistakes, grammar mistakes, and incorrect code. Please keep in mind these are all rough drafts. Pull requests are welcome!

Notes

• Lockbit 3.0 Ransomware Triage

  Taking a look at the new LockBit 3.0 Ransomware

  Jul 7, 2022

• Matanbuchus Triage Notes

  Matanbuchus loader triage and yara rule

  Jun 19, 2022

• Diceloader Triage Notes

  Researching malware downloaders, detection and triage

  Jun 16, 2022

• Malware Downloader Triage Notes

  Researching malware downloaders, detection and triage

  Jun 12, 2022

• Cobalt Strike Analysis

  Taking a look at Cobalt Strike config extraction and emulation

  Jun 9, 2022

• Triage Amadey Loader

  Triage of Amadey loader

  May 29, 2022

• Does Entropy Matter? A Pseudoscientific Study!

  How useful is entropy for identifying packed samples?

  May 26, 2022

• Emotet x64 Stack Strings Config Emulation

  Taking a look at the new Emotet stack strings config

  May 19, 2022

• Bumblebee Loader

  Taking a look at Bumblebee loader

  May 12, 2022

• Magniber Ransomware Triage

  Taking a look at Magniber ransomware and analyzing malware with syscalls

  May 6, 2022

• Syscall Reversing

  Helper scripts for statically reversing malware with syscalls

  May 3, 2022

• Emotet 64-bit

  Initial Triage of new Emotet 64-bit sample

  Apr 30, 2022

• Emotet Deobfuscation Generic Solution

  Removing obfsucation from Emotet with a generic solution

  Apr 20, 2022

• Symbolic Execution For Deobfuscation The Basics

  The Theory Behind Angr and Symbolic Execution and Control Flow Flattening

  Apr 13, 2022

• Emotet Deobfuscation

  Removing CFF Obfuscation From Emotet Using Angr and Symbolic Execution

  Apr 6, 2022