Exfiltration over Telegram Bots: Skidding Infostealer Logs
An investigation of Telegram bot exfiltration, infostealer log formats, and the visibility those records provide.
Windows
Hunting PrivateLoader: The Malware Behind InstallsKey PPI Service
Tracing changes in PrivateLoader protocols and string obfuscation, with YARA and Suricata detection.
Data Insights on AgentTesla and OriginLogger Victims
Configuration and infection-data analysis of AgentTesla and OriginLogger, including their exfiltration methods.
Tofsee Botnet: Proxying and Mining
Investigating the proxying, spam, and cryptocurrency-mining activity of the modular Tofsee botnet.
Unpacking Colibri Loader: A Russian APT-linked Campaign
A Colibri Loader unpacking walkthrough covering anti-analysis techniques, string decryption, and YARA detection.
Tracking PrivateLoader: Malware Distribution Service
Tracking PrivateLoader delivery chains and identifying 30 malware families in the collected payloads.
Decrypting and Hunting PrivateLoader
Building a PrivateLoader string decryptor and YARA rule from a stack-based XOR pattern.