Tags
Static reverse engineering of two 32-bit PE binaries identified as Ryuk ransomware (Hermes variant). Covers the dropper/loader and the encryption payload, including persistence, process injection, and VSS deletion behavior.
Read full articleStatic/dynamic analysis of two 32-bit PE binaries — a WinMain-based narrow-down analysis using IDA
Read full articleAn introduction to malware analysis techniques — static/dynamic analysis, malware types, and Windows DLL import analysis
Read full articleStatic and dynamic analysis of the Anubis banking trojan/stealer: persistence mechanisms, C2 communication, and credential theft techniques
Read full article