Malicious eFax Attachments Can Potentially Steal Your Microsoft O365 Password
Phishing attack observed by Polito, Inc., which uses an obfuscated JavaScript attachment to show how to analyze the malicious attack.
top of page
Search
peterpolito
Mar 3, 20209 min
Automated Obfuscation of Windows Malware and Exploits Using O-LLVM
Today’s malware authors and exploit developers have automated methods of obfuscating their software, When these techniques are combined with
peterpolito
Feb 3, 20209 min
Ransomware Attacks Are on the Rise, Should You Pay the Ransom?
However, sometimes the answer to this question cannot be so clear-cut. Much depends on how valuable the information being held for ransom is
Fred Mastrippolito
Jun 18, 20192 min
The CISO asked me to run Ransomware on his laptop
The executive’s laptop had the very latest version of a cloud-based, next-generation antivirus endpoint detection and response software, whi
peterpolito
Feb 21, 20194 min
Using Intezer Analyze to Reveal Malware Ancestry and Assist IR and Forensic Investigations
Today, much of the malware still operates via the same concept of infecting machines and spreading throughout networks. Due to this, it only
peterpolito
Nov 14, 20174 min
Unpacking script2exe Malware
Script2exe functions by packaging the original VBScript as an encrypted resource within a PE stub. The original script is retained in the EX
peterpolito
Oct 3, 20173 min
AppLocker and Software Restriction Policies
*This blog entry was originally published on July 5, 2017 on the original Polito Blog by Ian Duffy. It was re-posted on October 3, 2017...
peterpolito
Oct 3, 20178 min
Prepare for Ransomware: Delivery and Defense (Part 3 in a Series on Ransomware)
*This blog entry was originally published on January 13, 2017 on the original Polito Blog by Roman Romanenco. It was re-posted on October...
peterpolito
Oct 3, 20175 min
Deconstructing the Ransomware Kill Chain (Part 2 in a Series on Ransomware)
*This blog entry was originally published on August 19, 2016 on the original Polito Blog by Roman Romanenco. It was re-posted on October...
peterpolito
Oct 3, 20175 min
The Proliferation of Ransomware (Part 1 in a Series on Ransomware)
*This blog entry was originally published on July 18, 2016 on the original Polito Blog by Roman Romanenco. It was re-posted on October 3,...
peterpolito
Oct 3, 20175 min
Unwrap Your Malware
*This blog entry was originally published on June 23, 2015 on the original Polito Blog. It was re-posted on October 3, 2017 due to...
peterpolito
Oct 3, 20177 min
The Simplicity of VBA Malware (Part 2 of 2)
*This blog entry was originally published on January 28, 2016 on the original Polito Blog. It was re-posted on October 3, 2017 due to...
peterpolito
Oct 3, 20175 min
The Simplicity of VBA Malware (Part 1 of 2)
*This blog entry was originally published on January 4, 2016 on the original Polito Blog. It was re-posted on October 3, 2017 due to...
peterpolito
Jul 5, 20172 min
AppLocker and Software Restriction Policies
Over the course of several recent engagements which have involved malware analysis as part of incident response activities, a common theme h
peterpolito
Jan 13, 20178 min
Prepare for Ransomware: Delivery and Defense (Part 3 in a Series on Ransomware)
Understanding the individualized ransomware delivery tactics allows us to determine what countermeasures and defense techniques can be put i
peterpolito
Aug 19, 20165 min
Deconstructing the Ransomware Kill Chain (Part 2 in a Series on Ransomware)
Understanding each stage of the ransomware kill chain allows us to determine what countermeasures and defense techniques can be put in place
peterpolito
Jul 18, 20165 min
The Proliferation of Ransomware (Part 1 in a Series on Ransomware)
Crypto-ransomware (often referred to as simply ransomware, including here) is a type of malware that maliciously encrypts victim files (focu
peterpolito
Jun 23, 20165 min
Unwrap Your Malware
Wrapped files have a script or executable in their body, which they drop and run upon execution; e.g., an EXE file drops a batch script in t
peterpolito
Jan 28, 20167 min
The Simplicity of VBA Malware (Part 2 of 2)
Dridex can typically be detected on a compromised machine by looking for some if its hallmark artifacts. It does not set a persistence key i
peterpolito
Jan 4, 20165 min
The Simplicity of VBA Malware (Part 1 of 2)
Macro malware targets Microsoft Office applications (Word, Excel, etc.). Malicious VBA macros are used to infect anyone who opens the file,
bottom of page