UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos
by Robin Dost Subscribe Newsletter Malware: HijackLoader / IDATLoader -> Remcos Agent 7.1.0 ProActor tracking: UAC-0184 / MB-0005Related analysis: UAC-0184:...
re
Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading
by Robin Dost Subscribe Newsletter A few months ago, I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a...
GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain
by Robin Dost Subscribe Newsletter Today, we are taking a look at malware linked to yet another threat actor, one...
Obfuscation Without Effort: Breaking a UAC-0226 GIFTEDCROOK Stealer
by Robin Dost Subscribe Newsletter EDIT: I have YARA rules available for this one, if you need them, contact me...
RustyStealer: Your Compiler Is Snitching on You
by Robin Dost Subscribe Newsletter As already mentioned in my last MuddyWater article, I originally planned to take a closer...
Crackme – RodrigoTeixeira’s Very easy disassembly execise
Since I want to dive deeper into reverse engineering, I’ve decided to regularly solve CrackMe challenges from https://crackmes.one; I’ll begin...