Find Golang binaries with YARA.
Author: Daniel
100 Days of YARA – Day 18: Yanluowang Ransomware
Another ransomware strain is known as Yanluowang. Here are some of my bookmarks that I've tagged as Yanluowang: https://pinboard.in/u:droberson/t:yanluowang/ This blog post by Symantec was very interesting to me, as it presented a lot of generic examples of post-exploitation activity that was observed by the operators of this ransomware: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue Particularly, this article mentions the …
Continue reading 100 Days of YARA – Day 18: Yanluowang Ransomware
100 Days of YARA – Day 17: BlackCat Ransomware
Find BlackCat ransomware with YARA.
100 Days of YARA – Day 16: Public Services
Malware authors often abuse free or public services to distribute malicious content. They may host payloads on DropBox or Discord, Google Drive, PasteBin, or a number of services. Searching for the domains used by these services can uncover malware in surprising places. Ngrok ngrok is used to tunnel traffic through HTTP. Despite being a legitimate …
100 Days of YARA – Day 15: njrat
Find njrat with YARA.
100 Days of YARA – Day 14: shc Generic Shell Script Compiler
Find binaries built with the generic shell script compiler with YARA.
100 Days of YARA – Day 13: Quasar RAT
Find QuasarRAT with YARA.
100 Days of YARA – Day 12: Neshta
Find Neshta-infected files with YARA.
100 Days of YARA – Day 11: UPX
Find UPX-packed binaries with YARA.
REVIEW: Reversing: Secrets of Reverse Engineering
Book review of Reversing: Secrets of Reverse Engineering.
REVIEW: Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
My review of Practical Malware Analysis.
100 Days of YARA – Day 10: WinSock
Detect applications utilizing WinSock with YARA.
DMFR SECURITY 