HeaderLessPE

HeaderLessPE はじめに 中国語 HeaderLessPEは、Icedidトロイの木馬で使用されるメモリPEローディング技術です。この技術に基づき、HVNCを使用したファイルレス攻撃の新しい方法を提案します。この拡張により、HeaderLessPEをグラフィカルなハッキングツールに制限なくインジェクトして実行できるようになります。 MemDllのような他のインメモリローディング技術と比較して、拡張されたHeaderLessPEには2つの利点があります： 従来のDOSヘッダーとPEヘッダーのIOCを回避 DOSヘッダーとPEヘッダーはメモリスキャンの焦点となることが多く、Coba...

A week in security (December 2 – December 8)

Last week on Malwarebytes Labs, we took a look at a new version of the IcedID Trojan, described web skimmers up to no good, and took a deep dive into containerization. We also explored a report bringing bad news for organizations and insider threats, and threw a spotlight on a video game phish...

New version of IcedID Trojan uses steganographic payloads

This blog post was authored by @hasherezade, with contributions from @siriurz and Jérôme Segura. Security firm Proofpoint recently published a report about a series of malspam campaigns they attribute to a threat actor called TA2101. Originally targeting German and Italian users with Cobalt Strik...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

New IcedID Trojan Targets US Banks

Researchers are warning users about a wave of recent attacks targeting U.S. financial institutions that leverage a new banking Trojan dubbed IcedID. The IcedID Trojan was spotted in September by researchers at IBM’s X-Force Research team. They said the Trojan has several standout techniques and...