ShadowMe #2 - Dynamic Malware Analysis
YouTube video by Ali Hadi
www.youtube.com
November 14, 2024 at 4:05 AM
I once got stuck in a do loop for six months with USCYBERCOM J6 over their desire to have me attest that we would keep our malware analysis environment free from malware at all times and I will never get that time back
I feel like I got out of FFRDC work just in time. I once got into a heated argument with the govt over whether our *malware lab* needed to be certified and accredited and run the full set of security controls. Can't imagine having to deal with that now. Eventually, the work just won't get done.
August 25, 2024 at 1:05 PM
I once got stuck in a do loop for six months with USCYBERCOM J6 over their desire to have me attest that we would keep our malware analysis environment free from malware at all times and I will never get that time back
AI hive mind malware found by a new analysis tool
Cisco Talos released CAIRN, an open-source tool that discovered CLOSEDQUORUM malware, which uses multiple LLMs for autonomous command and control. This is beyond AI-assisted hacking; it's an AI making its own decisions.
Cisco Talos released CAIRN, an open-source tool that discovered CLOSEDQUORUM malware, which uses multiple LLMs for autonomous command and control. This is beyond AI-assisted hacking; it's an AI making its own decisions.
September 22, 2026 at 10:56 AM
AI hive mind malware found by a new analysis tool
Cisco Talos released CAIRN, an open-source tool that discovered CLOSEDQUORUM malware, which uses multiple LLMs for autonomous command and control. This is beyond AI-assisted hacking; it's an AI making its own decisions.
Cisco Talos released CAIRN, an open-source tool that discovered CLOSEDQUORUM malware, which uses multiple LLMs for autonomous command and control. This is beyond AI-assisted hacking; it's an AI making its own decisions.
Introduction to reverse engineering and malware analysis
Part 1: intezer.com/blog/malware...
Part 2: intezer.com/blog/inciden...
#malware #cybersecurity
Part 1: intezer.com/blog/malware...
Part 2: intezer.com/blog/inciden...
#malware #cybersecurity
February 1, 2025 at 1:41 PM
Introduction to reverse engineering and malware analysis
Part 1: intezer.com/blog/malware...
Part 2: intezer.com/blog/inciden...
#malware #cybersecurity
Part 1: intezer.com/blog/malware...
Part 2: intezer.com/blog/inciden...
#malware #cybersecurity
So since we are rebuilding stuff and people migrating here…
Here’s a short post I made 2 years ago on how to analyze Malware:
hal3.medium.com/novice-guide...
^_^
Here’s a short post I made 2 years ago on how to analyze Malware:
hal3.medium.com/novice-guide...
^_^
Novice guide to Malware Analysis
For this first Malware Analysis Blog, I present you the Malware sample from HuskyHacks. For this entry, I will be using FLARE VM where I…
hal3.medium.com
November 7, 2024 at 12:38 PM
So since we are rebuilding stuff and people migrating here…
Here’s a short post I made 2 years ago on how to analyze Malware:
hal3.medium.com/novice-guide...
^_^
Here’s a short post I made 2 years ago on how to analyze Malware:
hal3.medium.com/novice-guide...
^_^
A new malware loader named Sauron is being advertised on underground hacking forums.
According to DCSO, the malware is sold exclusively to Russian-speaking individuals and has already been seen in the wild in Germany.
medium.com/@DCSO_CyTec/...
According to DCSO, the malware is sold exclusively to Russian-speaking individuals and has already been seen in the wild in Germany.
medium.com/@DCSO_CyTec/...
Sauron Loader: A New Loader Lurking in Underground Forums
Technical analysis of a novel loader sold in Russian underground forums
medium.com
September 24, 2026 at 7:12 PM
A new malware loader named Sauron is being advertised on underground hacking forums.
According to DCSO, the malware is sold exclusively to Russian-speaking individuals and has already been seen in the wild in Germany.
medium.com/@DCSO_CyTec/...
According to DCSO, the malware is sold exclusively to Russian-speaking individuals and has already been seen in the wild in Germany.
medium.com/@DCSO_CyTec/...
Reverse engineering and malware analysis (introduction for beginners)
Part 1: intezer.com/blog/malware...
Part 2: intezer.com/blog/inciden...
#malware #infosec
Part 1: intezer.com/blog/malware...
Part 2: intezer.com/blog/inciden...
#malware #infosec
March 2, 2025 at 8:27 PM
Reverse engineering and malware analysis (introduction for beginners)
Part 1: intezer.com/blog/malware...
Part 2: intezer.com/blog/inciden...
#malware #infosec
Part 1: intezer.com/blog/malware...
Part 2: intezer.com/blog/inciden...
#malware #infosec
CISA has released Thorium, a malware analysis platform
www.cisa.gov/resources-to...
Also on GitHub: github.com/cisagov/thor...
www.cisa.gov/resources-to...
Also on GitHub: github.com/cisagov/thor...
July 31, 2025 at 6:11 PM
CISA has released Thorium, a malware analysis platform
www.cisa.gov/resources-to...
Also on GitHub: github.com/cisagov/thor...
www.cisa.gov/resources-to...
Also on GitHub: github.com/cisagov/thor...
🎬 New YouTube-Videos video!
Build a Secure Malware Analysis Network: Step-by-Step Guide #shorts
https://www.youtube.com/watch?v=NkfRKoCCqgI
#Cybersecurity #MalwareAnalysis #NetworkSecurity #HomeLab #InfoSec
Build a Secure Malware Analysis Network: Step-by-Step Guide #shorts
https://www.youtube.com/watch?v=NkfRKoCCqgI
#Cybersecurity #MalwareAnalysis #NetworkSecurity #HomeLab #InfoSec
Build a Secure Malware Analysis Network: Step-by-Step Guide #shorts
Creating a dedicated, physically separated network for malware analysis with VLANs, a Tpot server, and sensor nodes. Securely relay logs to your main SIEM for comprehensive threat detection. #MalwareA
www.youtube.com
September 22, 2026 at 4:13 PM
🎬 New YouTube-Videos video!
Build a Secure Malware Analysis Network: Step-by-Step Guide #shorts
https://www.youtube.com/watch?v=NkfRKoCCqgI
#Cybersecurity #MalwareAnalysis #NetworkSecurity #HomeLab #InfoSec
Build a Secure Malware Analysis Network: Step-by-Step Guide #shorts
https://www.youtube.com/watch?v=NkfRKoCCqgI
#Cybersecurity #MalwareAnalysis #NetworkSecurity #HomeLab #InfoSec
Hewlett Packard report that they are spotting AI-generated malware in the wild, not through complex analysis or watermarking, but because… it is weirdly well-commented. https://threatresearch.ext.hp.com/wp-content/uploads/2024/09/HP_Wolf_Security_Threat_Insights_Report_September_2024.pdf
December 26, 2024 at 4:01 PM
Hewlett Packard report that they are spotting AI-generated malware in the wild, not through complex analysis or watermarking, but because… it is weirdly well-commented. https://threatresearch.ext.hp.com/wp-content/uploads/2024/09/HP_Wolf_Security_Threat_Insights_Report_September_2024.pdf
An exposure analysis would say hey people having VLC is a source of vulnerability because the parsers are not exactly strong and easy to exploit.
And I would come back and tell them people are literally directly installing malware on their computers. They run the EXE. Is that good enough for you?
And I would come back and tell them people are literally directly installing malware on their computers. They run the EXE. Is that good enough for you?
November 25, 2025 at 4:03 PM
An exposure analysis would say hey people having VLC is a source of vulnerability because the parsers are not exactly strong and easy to exploit.
And I would come back and tell them people are literally directly installing malware on their computers. They run the EXE. Is that good enough for you?
And I would come back and tell them people are literally directly installing malware on their computers. They run the EXE. Is that good enough for you?
In the weeds: The ability to trigger an LLM refusal & blind a file checker is fascinating.
And it's why intention matters in how you design a malware analysis pipeline to avoid manipulation & prompt injection.
H/T to colleagues that shared this with me
And it's why intention matters in how you design a malware analysis pipeline to avoid manipulation & prompt injection.
H/T to colleagues that shared this with me
June 10, 2026 at 11:31 AM
In the weeds: The ability to trigger an LLM refusal & blind a file checker is fascinating.
And it's why intention matters in how you design a malware analysis pipeline to avoid manipulation & prompt injection.
H/T to colleagues that shared this with me
And it's why intention matters in how you design a malware analysis pipeline to avoid manipulation & prompt injection.
H/T to colleagues that shared this with me
Malware in Lisp? Now you're just being cruel
Malware in Lisp? Now you're just being cruel
Miscreants warming to Delphi, Haskell, and the like to evade detection
Malware authors looking to evade analysis are turning to less popular programming languages like Delphi or Haskell.…
dlvr.it
March 29, 2025 at 10:52 AM
Malware in Lisp? Now you're just being cruel
We are very excited to offer our very popular Hands-on Malware Analysis & Reverse Engineering Primer, taught by
@jags.bsky.social!
WHEN: 5 DAYS – Dec 1 - Dec 5, 2024 | 10 – 4PM
Non-Hopkins interested participants, contact @ellyrostoum.bsky.social.
alperovitch.sais.jhu.edu/jags-malware...
@jags.bsky.social!
WHEN: 5 DAYS – Dec 1 - Dec 5, 2024 | 10 – 4PM
Non-Hopkins interested participants, contact @ellyrostoum.bsky.social.
alperovitch.sais.jhu.edu/jags-malware...
November 24, 2024 at 7:26 PM
We are very excited to offer our very popular Hands-on Malware Analysis & Reverse Engineering Primer, taught by
@jags.bsky.social!
WHEN: 5 DAYS – Dec 1 - Dec 5, 2024 | 10 – 4PM
Non-Hopkins interested participants, contact @ellyrostoum.bsky.social.
alperovitch.sais.jhu.edu/jags-malware...
@jags.bsky.social!
WHEN: 5 DAYS – Dec 1 - Dec 5, 2024 | 10 – 4PM
Non-Hopkins interested participants, contact @ellyrostoum.bsky.social.
alperovitch.sais.jhu.edu/jags-malware...
Zscaler has discovered a new malware family named NodeLoader that's written in Node.js and works to distribute crypto-miners and information stealers to infected Windows systems
www.zscaler.com/blogs/securi...
www.zscaler.com/blogs/securi...
NodeLoader Exposed: The Node.js Malware Evading Detection
A technical analysis of how a malware campaign using a game cheat lure leverages Node.js to distribute XMRig, Lumma and Phemedrone Stealer.
www.zscaler.com
December 14, 2024 at 5:25 PM
Zscaler has discovered a new malware family named NodeLoader that's written in Node.js and works to distribute crypto-miners and information stealers to infected Windows systems
www.zscaler.com/blogs/securi...
www.zscaler.com/blogs/securi...
Updates to our Malware Analysis collection.
It's too big for a bsky post, so just read the text file.
files.catbox.moe/awfjuv.txt
It's too big for a bsky post, so just read the text file.
files.catbox.moe/awfjuv.txt
files.catbox.moe
November 13, 2024 at 6:40 PM
Updates to our Malware Analysis collection.
It's too big for a bsky post, so just read the text file.
files.catbox.moe/awfjuv.txt
It's too big for a bsky post, so just read the text file.
files.catbox.moe/awfjuv.txt
Awesome Security Operation Center Analyst
- Books
- Malware Analysis
- Practice Labs
- Phishing Analysis
- Tools for Investigation
- Network Log Sources
and more.
github.com/LetsDefend/a...
#cybersecurity
- Books
- Malware Analysis
- Practice Labs
- Phishing Analysis
- Tools for Investigation
- Network Log Sources
and more.
github.com/LetsDefend/a...
#cybersecurity
April 21, 2025 at 9:48 AM
Awesome Security Operation Center Analyst
- Books
- Malware Analysis
- Practice Labs
- Phishing Analysis
- Tools for Investigation
- Network Log Sources
and more.
github.com/LetsDefend/a...
#cybersecurity
- Books
- Malware Analysis
- Practice Labs
- Phishing Analysis
- Tools for Investigation
- Network Log Sources
and more.
github.com/LetsDefend/a...
#cybersecurity
Hello,
I have updated the website. It has cool stuff (malware samples and malware analysis papers). Please review it and download malware, or don't, whatever.
vx-underground.org/Updates
I have updated the website. It has cool stuff (malware samples and malware analysis papers). Please review it and download malware, or don't, whatever.
vx-underground.org/Updates
December 6, 2025 at 10:43 PM
Hello,
I have updated the website. It has cool stuff (malware samples and malware analysis papers). Please review it and download malware, or don't, whatever.
vx-underground.org/Updates
I have updated the website. It has cool stuff (malware samples and malware analysis papers). Please review it and download malware, or don't, whatever.
vx-underground.org/Updates
My intermediate level malware analysis course is there.
60% off for the next two weeks.
malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...
60% off for the next two weeks.
malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...
Malware Analysis - Intermediate Level
Signature writing, deobfuscation, dynamic API resolving, syscalls, hooking, shellcode analysis and more
malwareanalysis-for-hedgehogs.learnworlds.com
September 1, 2025 at 3:17 PM
My intermediate level malware analysis course is there.
60% off for the next two weeks.
malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...
60% off for the next two weeks.
malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...
HawkEye Malware: Technical Analysis
HawkEye Malware: Technical Analysis
any.run
November 14, 2024 at 8:39 AM
HawkEye Malware: Technical Analysis