Overview This write-up covers the Singularity challenge from Malops.io. Although the sample presents as a 64-bit ELF, it is not a userland binary. It is a Linux loadable kernel module (LKM) rootki...

Overview This write-up covers the Malops.io driver challenge built around NSecKrnl64.sys, a small, unpacked, signed Windows kernel driver. The analysis is static only. Findings are presented as co...

Overview This write-up documents the analysis of an Android sample identified as EagleSpy, a remote access trojan (RAT) distributed through a dropper application. This challenge was completed on M...

Overview This write-up covers AuraWiper, a challenge sample from Malops.io. AuraWiper is a destructive payload built to disable recovery options, terminate monitoring tools, corrupt the boot chain...

Lab 03 from Practical Malware Analysis covers four samples, each demonstrating a different flavor of Windows persistence and command and control. The set includes a minimal HTTP beacon, a service-i...

This post covers the initial static and dynamic analysis pass for the four samples in Practical Malware Analysis Lab 01: Lab01-01.dll, Lab01-01.exe, Lab01-02.exe, Lab01-03.exe, and Lab01-04.exe. Th...

Overview SOC104 - EventID 36 is a practice challenge on the letsdefend.io site. These challenges are designed to test a defender’s ability to spot and investigate malicious activity based on the in...

Overview Markup is a vulnerable machine from Hack the Box that requires some web app enumeration and using an xxe injection to read files. The foothold is accomplished after gaining access to a log...

Overview Base is a vulnerable machine from Hack the Box that requires some web app enumeration and a unique type juggling with php. The foothold is accomplished after digging into a unique file and...

Overview Querier is a vulnerable machine from Hack the Box that requires some smb enumeration and using SQL server authentication. The foothold is accomplished after logging into SQL Server, dumpin...