Acknowledgements: A special “thank you” goes to Michael Tigges for his extraordinary contributions in unraveling this incident. Background In August, Huntress onboarded an organization post-incident,…
Key takeaways li]:list-disc”> EMOTET encryption mechanisms Reviewing the EMOTET C2 list Interesting EMOTET strings The EMOTET configuration extractor utility Encryption keys EMOTET uses embedded Elliptic…
Configuration extractor to dump out hardcoded passwords with BPFDoor. Download bpfdoor-config-extractor.tar.gz Overview This tool provides a Python module and command line tool that will extract…
Python script to extract the configuration from QBOT samples. Download qbot-config-extractor.tar.gz Getting Started This tool provides a Python module and command line tool that will…
Python script to extract the payload from ICEDID samples. Download icedid-configuration-extractor.tar.gz For information on the ICEDID malware and network infrastructure, check out the following resources:…
Python script to extract the payload from PARALLAX samples. Download parallax-payload-extractor.tar.gz For information on the PARALLAX malware loader and campaign observations, check out our blog…
Key Takeaways li]:list-disc”> Writing and executing a VBS script that uses PowerShell to add a Windows Defender exclusion on the root directory (C:) Writing and…
Microsoft has begun rolling out user-mode Hardware Stack Protection (HSP) starting in Windows 10 20H1. HSP is an exploit mitigation technology that prevents corruption of…
Summary As a part of Elastic Security’s ongoing threat detection and monitoring efforts, we have recently observed a ransomware intrusion by the CUBA ransomware threat…
This article demonstrates a flaw that allows attackers to bypass a Windows security mechanism which protects anti-malware products from various forms of attack. This is…
Preamble Elastic Security has identified an ongoing campaign targeting a Vietnamese financial services institution with the PHOREAL/RIZZO backdoor. While this malware has been in use…
ICEDID is a malware family first described in 2017 by IBM X-force researchers and is associated with the theft of login credentials, banking information, and…
