CyberChef Tutorials
Advanced Cyberchef Techniques - Defeating Nanocore Obfuscation With Math and Flow Control
Applying Flow Control and Mathematical operators to deobfuscate a .vbs loader for Nanocore malware.
Matthew
How To Use CyberChef
Decoding a Cobalt Strike Downloader Script With CyberChef
Decoding a Cobalt Strike script with CyberChef and VsCode.
Threat Intelligence Guides
Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars
Tracking APT SideWinder Domains With Regular Expressions, Whois Records and Domain Registrars
Threat Intelligence Guides
How To Track Malicious Infrastructure With DNS Records - Vultur Banking Trojan
Tracking Malware Infrastructure Through Subdomain Analysis
Threat Intelligence Guides
How To Track Malware Infrastructure - Identifying MatanBuchus Domains Through Hardcoded Certificate Values
Identifying malicious infrastructure through hardcoded TLS Certificates and Subdomains.
Threat Intelligence Guides
Tracking Malware Infrastructure With Passive DNS and 302 Redirects
Finding phishing domains passive DNS tooling and 302 redirects.
Threat Intelligence Guides
Tracking Gamaredon Infrastructure With Passive DNS Records and Subdomain Analysis
Leveraging Passive DNS to identify APT infrastructure. Building on public intelligence reports.
Threat Intelligence Guides
Introduction To Malware Infrastructure Analysis With Passive DNS
Malware Infrastructure Tracking Using Passive DNS Intelligence.
Malware Analysis Tutorials
Latrodectus Malware Analysis - Decoding Obfuscated Malware By Removing Junk Comments
Identifying and Removing Obfuscation in a Self-Referencing Latrodectus Loader
Malware Analysis Tutorials
Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples
Advanced CyberChef techniques using Registers, Regex and Flow Control
Threat Intelligence Guides
Practical Queries for Identifying Malware Infrastructure With FOFA
Identifying malware infrastructure with the FOFA scanner.
Malware Analysis Tutorials
How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers
Manual analysis of Cobalt Strike Shellcode with Ghidra. Identifying function calls and resolving API hashing.