Byte Atlas

Blog on Malware Research and Reverse Engineering by @push_pnx.

[Byte Atlas @ByteAtlas]

[blog post] MalpediaFLOSSed
https://t.co/9WDsJ4Xixo

[Byte Atlas @ByteAtlas]

[blog post] Upgraded MCRIT Feature: IDA Plugin
https://t.co/EMH0IiqmzY

[Byte Atlas @ByteAtlas]

[blog post] Knowledge Fragment: Hardening Win10 x64 on VirtualBox for Malware Analysis
https://t.co/XGlyEACfPD

[Byte Atlas @ByteAtlas]

[blog post] MCRIT: The MinHash-based Code Relationship & Investigation Toolkit
https://t.co/Qiq8riM5O5

[Byte Atlas @ByteAtlas]

[blog post] Casting Sandbox Necromancy on DADSTACHE
https://t.co/bC0bSsy1d2

[Byte Atlas @ByteAtlas]

[blog post] I updated "The Big Zeus Family Similarity Showdown", now with almost twice the samples and 4 new zeus-like families!
https://t.co/Z8P6A8XxgL

[Byte Atlas @ByteAtlas]

[blog post]
Upgrading ApiScout: Introducing ApiVectors.
https://t.co/AEMBcrePUV

[Byte Atlas @ByteAtlas]

[blog post] The Big Zeus Family Similarity Showdown. https://t.co/jAXlF38ZU3

[Byte Atlas @ByteAtlas]

[blog post] Quick analysis / identification of the "link" function between the Lazarus and WannaCry sample: https://t.co/KaLx9ex3OL

[Byte Atlas @ByteAtlas]

[blog post / tool] ApiScout: Painless Windows API information recovery. https://t.co/0rkvpHtrZG

[Byte Atlas @ByteAtlas]

[blog post] Hardening Win7 x64 on VirtualBox for Malware Analysis
https://t.co/FHWjbf1qD3

[Byte Atlas @ByteAtlas]

[blog post] Fobber Inline String Decryption http://t.co/HIHcuwLP8g

[Byte Atlas @ByteAtlas]

[blog post] Unwrapping Fobber http://t.co/3aylgVR0Tp

[Byte Atlas @ByteAtlas]

[blog post] Bruteforcing Andromeda C&C configurations. http://t.co/1nbqgLjvT2

[Florian Roth ⚡️ @cyb3rops]

Regex to check you web server access logs for CVE-2014-6271 Shell Shock exploitation (v2 egrep compatible)
\(\)\s\{.*;\s*\};

[Byte Atlas @ByteAtlas]

@emgent @MalwareMustDie @sawaba @yinettesys @robertgraham @Botconf thx

[Byte Atlas @ByteAtlas]

@emgent @MalwareMustDie @sawaba @yinettesys @robertgraham @Botconf care share + provide context? 8dc64426f9d07587c19e10f1bb3d2799 not on VT.

[Byte Atlas @ByteAtlas]

@_g3nuin3 all from the binaries is listed here: https://t.co/50l8h1XZFm - I didn't run the bot so I don't if they changed servers. :-/

[Byte Atlas @ByteAtlas]

cursory static analysis of DingleElite DDoS bot: https://t.co/50l8h1XZFm

[Byte Atlas @ByteAtlas]

@MalwareMustDie @sawaba @yinettesys @robertgraham @emgent @Botconf here is a quick static analysis of that bot: https://t.co/50l8h1XZFm