Malware threats can use different approaches for well-known operations, such as deleting a file:
1. CreateFile( ) + SetFileInformationByHandle( ) + CloseHandle( )
2. CreateFile( ), specifying FILE_FLAG_DELETE_ON_CLOSE + CloseHandle( )
3. DeleteFile( ) -- of course
#malware
Malwoverview 4.3 is alive! I've included support for Malware Bazaar and ThreatFox (@abuse_ch):
https://t.co/SfVTmQUgEC
It also offers information from VT, HA, Malpedia, Polyswarm, URLHaus, Alien Vault, ThreatCrowd, Malshare and Valhalla.
#threathunting#malware#cyberthreats
Two years ago, during a very important conference, I remembered on a common technique used by malware using native code to load .NET runtime and execute malicious managed code. Surprisingly, the same technique has been still used frequently.
#malware#dotnet#programming