Palo Alto Networks

Python

Pythons and Unicorns and Hancitor…Oh My! Decoding Binaries Through Emulation

This blog post is a continuation of my previous post, VB Dropper and Shellcode for Hancitor Reveal New Techniques Behind Uptick, where we analyzed a new Visual Basic (VB) macro dropper and the accompanying shellcode. In the last post, we left off with having successfully identified where the shellcode carved out and decoded a binary from the Microsoft Word document.

Often when analysts are faced with an embedded payload for which they want to write a decoder, they ...

Malware

Unit 42

Aug 30, 2016

By Jeff White

Palo Alto Networks

Products and Services

Partners

Threat Prevention, Unit 42

AutoFocus Lenz: Taking the Blue (Team) Pill

The Palo Alto Networks AutoFocus threat intelligence services accelerates analysis and response workflows for unique, targeted attacks. The services further make an immense set of threat intelligence available...

May 03, 2016

By Jeff White

Malware, Threat Prevention, Unit 42

Python-Based PWOBot Targets European Organizations

We have discovered a malware family named ‘PWOBot’ that is fairly unique because it is written entirely in Python, and compiled via PyInstaller to generate a Microsoft Windows executable. The malware has been w...

Apr 19, 2016

By Josh Grunzweig

Malware, Unit 42

Click-Fraud Ramdo Malware Family Continues to Plague Users

Be the first to receive the latest news, cyber threat intelligence and research from Unit 42. Subscribe Now.

Apr 11, 2016

By Josh Grunzweig

Announcement, Financial Services, SCADA & ICS

Now Available: Open-Sourced AutoFocus Python Client Library

Palo Alto Networks is proud to announce the public release of a Python client library for interacting with our AutoFocus API.

Mar 15, 2016

By Ben Small and Russ Holloway

Malware, Threat Prevention, Unit 42

NanoCoreRAT Behind an Increase in Tax-Themed Phishing E-mails

It seems every mainstream news event or holiday has an accompanying phishing campaign. Opportunistic actors hoping to capitalize on the public's atten...

Feb 09, 2016

By Anthony Kasza and Tyler Halfpop

Load more blogs