ROP_ROCKET

介绍 ROP ROCKET 这个全新、先进的 ROP 框架在 DEF CON 31 上首次亮相，具备一些前所未有的能力。ROCKET 可以生成多种类型的链，并提供了新的模式或技术。 请注意，这仍是一个进行中的工作，后续将添加一些更新和增强的功能。更新应该是定期的。如果你遇到问题，请在 issues 中提出或发送邮件给我，我会解决它们。此外，还会添加生成某些类型 gadget 的替代方法。 目前正在持续工作，定期添加新功能。请定期回来查看。 强大的 ROP 能力 ROP ROCKET 非常强大，具有一些独特的能力，包括以下几个方面： 它可以为 NtAllocateVirtualMemory...

Stealers, stealers and more stealers

Introduction Stealers are a prominent threat in the malware landscape. Over the past year we published our research into several stealers see here, here and here, and for now, the trend seems to persist. In the past months, we wrote several private reports on stealers as we discovered Acrid a new...

Hijack Loader Malware Employs Process Hollowing, UAC Bypass in Latest Version

A newer version of a malware loader called Hijack Loader has been observed incorporating an updated set of anti-analysis techniques to fly under the radar. "These enhancements aim to increase the malware's stealthiness, thereby remaining undetected for longer periods of time," Zscaler ThreatLabz...

RATs and stealers rush through “Heaven’s Gate” with new loader

By Holger Unterbrink and Edmund Brumaghin. Executive summary Malware is constantly finding new ways to avoid detection. This doesn't mean that some will never be detected, but it does allow adversaries to increase the period of time between initial release and detection. Flying under the radar fo...

A week in security (January 15 – January 21)

Last week on Labs, we gave you some background information about cookies, specifically which ones to worry about and why. We also warned you about scams surrounding the Mega Millions winner, who promised to donate his money to good causes. We analyzed a cryptocurrency miner using a very old...

A coin miner with a “Heaven’s Gate”

You might call the last two years the years of ransomware. Ransomware was, without a doubt, the most popular type of malware. But at the end of last year, we started observing that ransomware was losing its popularity to coin miners. It is very much possible that this trend will grow as 2018...

Locky, Cerber Ransomware Skilled at Avoiding Detection

The latest versions of Cerber and Locky ransomware have been, since mid-January, finding great success in bypassing existing security detection systems through the use of a common infrastructure that allows the malicious code to bury itself inside NSIS installers, and use several layers of...