Overview This write-up covers the Malops.io driver challenge built around NSecKrnl64.sys, a small, unpacked, signed Windows kernel driver. The analysis is static only. Findings are presented as co...
Overview This write-up documents the analysis of an Android sample identified as EagleSpy, a remote access trojan (RAT) distributed through a dropper application. This challenge was completed on M...
Overview This write-up covers AuraWiper, a challenge sample from Malops.io. AuraWiper is a destructive payload built to disable recovery options, terminate monitoring tools, corrupt the boot chain...
Lab 03 from Practical Malware Analysis covers four samples, each demonstrating a different flavor of Windows persistence and command and control. The set includes a minimal HTTP beacon, a service-i...
This post covers the initial static and dynamic analysis pass for the four samples in Practical Malware Analysis Lab 01: Lab01-01.dll, Lab01-01.exe, Lab01-02.exe, Lab01-03.exe, and Lab01-04.exe. Th...
Overview SOC104 - EventID 36 is a practice challenge on the letsdefend.io site. These challenges are designed to test a defender’s ability to spot and investigate malicious activity based on the in...
Overview Markup is a vulnerable machine from Hack the Box that requires some web app enumeration and using an xxe injection to read files. The foothold is accomplished after gaining access to a log...
Overview Base is a vulnerable machine from Hack the Box that requires some web app enumeration and a unique type juggling with php. The foothold is accomplished after digging into a unique file and...
Overview Querier is a vulnerable machine from Hack the Box that requires some smb enumeration and using SQL server authentication. The foothold is accomplished after logging into SQL Server, dumpin...
Overview Bastard is a vulnerable machine from Hack the Box that requires some web app enumeration and using a public exploit for remote code execution on a vulnerable service. The foothold is accom...