Malware Analysis

April 13, 2018

THREAT RESEARCH

Malware monitor – leveraging PyREBox for malware analysis

This post was authored by Xabier Ugarte Pedrero In July 2017 we released PyREBox, a Python Scriptable Reverse Engineering Sandbox as an open source tool. This project is part...

April 2, 2018

THREAT RESEARCH

Fake AV Investigation Unearths KevDroid, New Android Malware

Talos identified two variants of the Android Remote Administration Tool (RAT) with the capability to steal information on the compromised device (contacts, SMS and phone history) and record phone calls.

March 5, 2018

SECURITY

Don’t Let Malware Slip Through Your Fingers

Detecting and stopping malware is a difficult problem to solve. As the methods of detection and prevention become more advanced so too do the techniques used by malware authors.

February 1, 2018

SECURITY

Secure by Design: Enhanced Interfaces Improve Email Security and Malware Analysis

In the infosec world, it’s well established that time is a precious commodity. Time to detection and time to resolution are critical concepts that can mean the difference between a...

January 31, 2018

SECURITY

The new face of Threat Grid for 2018

Threat Grid's engineering team is always working on improvements to our leading malware analysis and threat intelligence platform. In the latter part of 2017 and into early 2018, the team...

January 26, 2018

SECURITY

Demystifying the API (Using Threat Grid as an Example)

Let's talk about API usage. An API is a means of interacting with a program via another program. Just like a UI is a User Interface, an API is an...

December 8, 2017

SECURITY

Black Hat Europe 2017: Malware Analysis in the SOC

New Cisco Threat Grid dashboard yields faster malware analysis and response Black Hat Europe kicked off just after the X Factor series finale was recorded live at the London ExCel Center, briefly mixing the Network Operations Centre (NOC) and Security Operations Centre (SOC) staff with hordes of teenaged fans. A few team members confessed to […]

November 27, 2017

THREAT RESEARCH

ROKRAT Reloaded

This post was authored by Warren Mercer, Paul Rascagneres and with contributions from Jungsoo An. Earlier this year, Talos published 2 articles concerning South Korean threats. The first one was about the use of a malicious HWP document which dropped downloaders used to retrieve malicious payloads on several compromised websites. One of the website was a compromised government website. We […]

August 14, 2017

THREAT RESEARCH

When combining exploits for added effect goes wrong

Since public disclosure in April 2017, CVE-2017-0199 has been frequently used within malicious Office documents. The vulnerability allows attackers to include Ole2Link objects within RTF documents to launch remote code when HTA applications are opened and parsed by Microsoft Word. In this recent campaign, attackers combined CVE-2017-0199 exploitation with an earlier exploit, CVE-2012-0158, possibly in […]