XWorm Attack Chain: JavaScript, PowerShell, Reflective .NET Loader
The XWorm chain, from an obfuscated JavaScript dropper through PowerShell to a reflective loader that injects into MSBuild.
[ INDEX ]
Malware Analysis Write-Ups
A malware analysis collection and learning timeline. I write about my process and thoughts while taking apart loaders, droppers, and other malware samples.
[ POSTS ]
TAGS
-
-
VBS Stager to In-Memory C# Loader
From an obfuscated VBS dropper through two PowerShell stages to a fileless C# loader that hides its strings in a DES-encrypted resource and hollows RegAsm. -
Lowlevel Windows Functions in Powershell - REMCOS Dropper
Multistage Dropper with a lot of obfuscation and evasion techniques -
Reverse Engineering WannaCry
Reverse engineering the famous WannaCry Ransomware. -
Fileless .NET DLL - RAT
A javascript file that stages Powershell and extracts a malicous .NET Dll from an image. -
Powershell Dropper - Analysis
This is my first Malware Analysis, i am trying to elaborate my thought process as well as techniques I used to get rough it.