Palo Alto Networks

Microsoft Word

Pythons and Unicorns and Hancitor…Oh My! Decoding Binaries Through Emulation

This blog post is a continuation of my previous post, VB Dropper and Shellcode for Hancitor Reveal New Techniques Behind Uptick, where we analyzed a new Visual Basic (VB) macro dropper and the accompanying shellcode. In the last post, we left off with having successfully identified where the shellcode carved out and decoded a binary from the Microsoft Word document.

Often when analysts are faced with an embedded payload for which they want to write a decoder, they ...

Malware

Unit 42

Aug 30, 2016

By Jeff White

Palo Alto Networks

Products and Services

Partners

Threat Prevention, Unit 42

Locky Ransomware Installed Through Nuclear EK

In February 2016, Unit 42 published detailed analysis of Locky ransomware. We certainly weren’t the only ones who saw this malware, and many others have also reported on it. Since that time, Locky has been freq...

Mar 21, 2016

By Brad Duncan

Threat Prevention, Unit 42

Locky: New Ransomware Mimics Dridex-Style Distribution

Ransomware persists as one of the top crimeware threats thus far into 2016. While the use of document-based macros for ransomware distribution remains relatively uncommon, a new family calling itself "Locky" ha...

Feb 16, 2016

By Brandon Levene, Micah Yates and Rob Downs

Malware, Threat Prevention, Unit 42

NanoCoreRAT Behind an Increase in Tax-Themed Phishing E-mails

It seems every mainstream news event or holiday has an accompanying phishing campaign. Opportunistic actors hoping to capitalize on the public's atten...

Feb 09, 2016

By Anthony Kasza and Tyler Halfpop

Cybersecurity, Malware, Threat Prevention, Unit 42

Dridex Banking Trojan Distributed Through Word Documents

Dridex, the latest descendent of the Bugat/Feodo/Cridex banking Trojan lineage has been a constant source of attacks using the malware since its release in July. To date, Dridex has centered on sending executab...

Oct 24, 2014

By Ryan Olson

Load more blogs