SANS FOR610 Training The full name of the FOR610 training from SANS is “Reverse-Engineering Malware: Malware Analysis Tools and Techniques”. The goal is to learn how to efficiently analyze malwares in various forms (mainly Windows and Script files) depending on what is the purpose of the analysis : to understand how a security incident started, […]
SANS FOR610 Training & GREM – Certification Review Read More »
Attackers started recently to use Microsoft OneNote file to distribute malwares by email. I’ve decided to take a to public sample and analyse it (Thanks @pr0xylife for sharing it !). To proceed, I’ll use my Malware Analysis Lab as described here. I’ll start with a static analysis of the file to discover what will be
From OneNote to Quakbot (BB12) Read More »
In order to safely analyze malwares, the very first step is to setup a lab. I’ve read multiple articles about it but I’ve decided to write my own guide compiling all the small details that were important to me. This guide is for beginners and I hope it can help someone starting his journey into
Installing a Malware Analysis Lab Read More »
I recently received a phishing email to analyze, let’s see how to unbox all the components and identify them using Malcat. We can notice how good is this phishing attempt :– the sender was known by the recipient– the mail was written in correct french (quite unusual)– the mail contains and old discussion from 2021
Unboxing a Quakbot Campaign with Malcat Read More »
I’ve been asked to investigate a case in which a user received a phishing email, asking the user to click on a link to open a PDF Document. The link points to a Google Drive hosted file, which is not a PDF but a VBS (Visual Basic Script) file. Please note that the file is
Malware Analysis 11/02/2022 Read More »