cosa-nostra

Cosa Nostra Cosa Nostra est un toolkit de clustering open source axé sur l'analyse de malwares. Il peut créer des arbres phylogénétiques d'échantillons de malwares binaires structurellement similaires. Il a été initialement présenté lors du SyScan360 Shanghai 2016. Je le maintiens depuis 2016 pou...

Clustering Malware at Scale: A First Full-Benchmark Study

Recent years have shown that malware attacks still happen with high frequency. Malware experts seek to categorize and classify incoming samples to confirm their trustworthiness or prove their maliciousness. One of the ways in which groups of malware samples can be identified is through malware...

fn_fuzzy: Fast Multiple Binary Diffing Triage with IDA

Summary This week at HITBSecConf, Takahiro Haruyama, a Senior Threat Researcher for the CB Threat Analysis Unit TAU, presented his work on fnfuzzy, a tool which aims to help researchers and reverse engineers triage samples quicker. This blog post details the motivation for and current standing of...