The Proliferation of Ransomware (Part 1 in a Series on Ransomware)
*This blog entry was originally published on July 18, 2016 on the original Polito Blog by Roman Romanenco. It was re-posted on October 3,...
top of page
Search
peterpolito
- Oct 3, 2017
- 5 min
Unwrap Your Malware
*This blog entry was originally published on June 23, 2015 on the original Polito Blog. It was re-posted on October 3, 2017 due to...
peterpolito
- Oct 3, 2017
- 4 min
Language Interpreters and Post-Exploitation
*This blog entry was originally published on March 15, 2016 on the original Polito Blog by Ian Duffy. It was re-posted on October 3, 2017...
peterpolito
- Oct 3, 2017
- 2 min
BurpSuite Yara Plugin
*This blog entry was originally published on January 29, 2016 on the original Polito Blog by Ian Duffy. It was re-posted on October 3,...
peterpolito
- Oct 3, 2017
- 7 min
The Simplicity of VBA Malware (Part 2 of 2)
*This blog entry was originally published on January 28, 2016 on the original Polito Blog. It was re-posted on October 3, 2017 due to...
peterpolito
- Oct 3, 2017
- 5 min
The Simplicity of VBA Malware (Part 1 of 2)
*This blog entry was originally published on January 4, 2016 on the original Polito Blog. It was re-posted on October 3, 2017 due to...
peterpolito
- Oct 3, 2017
- 5 min
Analysis and Modification of Android Apps
*This blog entry was originally published on May 24, 2015 on the original Polito Blog by Ian Duffy. It was re-posted on October 3, 2017...
peterpolito
- Oct 2, 2017
- 2 min
Antivirus ... for Linux
*This blog entry was originally published on April 6, 2015 on the original Polito Blog by Fred Mastrippolito. It was re-posted on October...
peterpolito
- Oct 2, 2017
- 8 min
Analysis of a Romanian Botnet
*This blog entry was originally published on April 1, 2015 on the original Polito Blog by Ian Duffy. It was re-posted on October 3, 2017...
peterpolito
- Oct 2, 2017
- 3 min
Running Metasploit Shellcode in a Process
*This blog entry was originally published on March 23, 2015 on the original Polito Blog by Ian Duffy. It was re-posted on October 2, 2017...
Ian Duffy
- Jul 27, 2017
- 3 min
Netcat Reverse Shell Fixup
When penetration testing, sometimes we get netcat (or equivalent) shells back from Linux / Unix systems that have some pretty severe restric
Ian Duffy
- Jul 5, 2017
- 2 min
AppLocker and Software Restriction Policies
Over the course of several recent engagements which have involved malware analysis as part of incident response activities, a common theme h
Admin
- Mar 13, 2017
- 5 min
Vulnerability Assessment vs. Penetration Test: Key Differences and Objectives
On occasion we encounter questions about the differences between a vulnerability assessment and penetration test. While the end goal in both
Roman Romanenco
- Jan 13, 2017
- 8 min
Prepare for Ransomware: Delivery and Defense (Part 3 in a Series on Ransomware)
Understanding the individualized ransomware delivery tactics allows us to determine what countermeasures and defense techniques can be put i
Roman Romanenco
- Aug 18, 2016
- 5 min
Deconstructing the Ransomware Kill Chain (Part 2 in a Series on Ransomware)
Understanding each stage of the ransomware kill chain allows us to determine what countermeasures and defense techniques can be put in place
Roman Romanenco
- Jul 17, 2016
- 5 min
The Proliferation of Ransomware (Part 1 in a Series on Ransomware)
Crypto-ransomware (often referred to as simply ransomware, including here) is a type of malware that maliciously encrypts victim files (focu
peterpolito
- Jun 22, 2016
- 5 min
Unwrap Your Malware
Wrapped files have a script or executable in their body, which they drop and run upon execution; e.g., an EXE file drops a batch script in t
Ian Duffy
- Mar 15, 2016
- 4 min
Language Interpreters and Post-Exploitation
Polito is observing a trend towards disuse of bespoke / purpose-built tools by attackers for post-exploitation activities on systems. Such t
Ian Duffy
- Jan 29, 2016
- 2 min
BurpSuite Yara Plugin
Wouldn't it be cool if we could use Yara in this situation to help identify pages that contained malicious content? We set out to write
Robin Williams
- Jan 28, 2016
- 7 min
The Simplicity of VBA Malware (Part 2 of 2)
Dridex can typically be detected on a compromised machine by looking for some if its hallmark artifacts. It does not set a persistence key i
bottom of page