Research Archive

[5 Investigations]

Corrupt .NET Snake Keylogger Payload

Corrupted payload halted deep static and dynamic analysis. Here is what I found anyway, and how I wrote my first YARA rules from it.

Analysis of a multi-stage fileless dropper using JScript, PowerShell, and process hollowing to deliver a reversed Base64 PE payload via Dynamic DNS.

Analysis of a stage 2 OysterLoader payload.

Analysis of a trojanized WinSCP installer functioning as the OysterLoader and attempting to retrieve a second-stage payload

Analysing Socgholish, a Javascript malware Loader.