Compiled code no longer functions as an impenetrable shell protecting JSCeal. Check Point specialists recently developed a fully static deobfuscation method. This innovative technique effectively transforms the hidden malware into readable pseudocode. Crucially, it...
Malicious code no longer necessarily requires complex obfuscation to successfully evade neural network detection. Sometimes, merely inserting a specific phrase within a comment suffices. The artificial intelligence will subsequently refuse to continue its analysis...
The system drive serial number or computer name magically transformed into an indispensable key. Without it, the malicious program simply refused to decrypt its own payload. Recently, Kaspersky researchers uncovered two previously undocumented, highly...
What initially appeared to be a routine Cobalt Strike Beacon turned out to be something considerably more dangerous. Researchers have now dissected SakDriver – a fully realized Windows rootkit capable of operating at the...
The novel Linux implant, Quasar Linux, poses a formidable threat not merely to individual workstations but to the entire software supply chain. This malicious suite targets environments dedicated to the creation, compilation, and dissemination...
malware-check Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations. Analyzes source code, compiled executables (.exe, .dll, .elf), macOS bundles (.app, .dmg, .pkg), mobile apps (.apk, .ipa), and application...
MAPS Cloud Scanner A research tool for interacting with Windows Defender’s MAPS (Microsoft Active Protection Service) cloud-based file reputation and dynamic signature delivery system. MAPS is the cloud backend that powers Defender’s real-time protection verdicts, sample...
The Harvester threat collective has re-emerged, wielding a sophisticated instrument designed to elude conventional defensive parameters. Security researchers have identified a nascent iteration of the GoGra backdoor for Linux, which surreptitiously camouflages its presence...
Inexperienced North Korean cyber operatives have successfully exfiltrated millions of dollars in cryptocurrency over a span of several months. This feat was achieved not through the deployment of novel malware or the exploitation of...
A website administrator utilizing the Joomla platform observed a perplexing phenomenon: myriad surreptitious links to third-party merchandise had spontaneously manifested across various pages. Although the product catalog remained ostensibly unaltered and no novel entries...
IronPE is a minimal Windows PE manual loader written in Rust for both x86 and x64 PE files. The goal of IronPE is to explore how Windows loads Portable Executables internally and to demonstrate...
klint A Linux kernel integrity scanner that detects rootkits and kernel-level compromises. It works by cross-referencing multiple sources of system information (procfs, sysfs, netlink, MSRs, IDT, kernel symbols) and flagging inconsistencies that indicate tampering....
