Lastenzug

LastenZug 该项目实现了一个基于 websockets 的 Socka4a 代理。 客户端组件使用 C 语言实现，可编译为完全位置无关代码（PIC）。 在编译过程中，借助位于 LastenPIC/SpiderPIC 的第二个工具 SpiderPIC ，在汇编层面应用混淆。 SpiderPIC 混淆包括： 指令替换 添加垃圾指令并跳转越过垃圾指令 添加无用指令 这旨在破坏静态签名，但您需要记住，API 哈希、字符串和其他常量在此过程中不会被混淆。 用法 客户端 makefile 同时生成 PIC socks 客户端和用于 shellcode 的示例加载器。 您可以使用以下原型调用...

Fileless malware: part deux

In part one of this series, we focused on an introduction to the concepts fileless malware, providing examples of the problems that we in the security industry face when dealing with these types of attacks. In part two, I will be walking through a few demonstrations of fileless malware attacks th...

Stop Scanning My Macro

FireEye Labs detected an interesting evasion strategy in two recent, large Dridex campaigns. These campaigns changed the attachment file-type and location of malicious logic in an attempt to avoid scanners. Overview Both campaigns used an invoice theme and came from a wide variety of sending...