The Malware Research Team have come across some JavaScript malware as we posted about in Fileless Malware Explained last month. In this post, we will highlight one such piece of malware and specifically, the process used in deobfuscating part of the malicious code. What is Obfuscation? Code obfuscation is a group of techniques used to […]
Deobfuscating JavaScript Malware Read More »
A few days ago, Kayla wrote about Fileless Malware, and how PC Matic protects your devices from it. Malware can be so complicated and confusing to understand, that Malware Research is a full-time job… Let alone “fileless” malware. However, when explained in the proper steps, the concept is actually very easy to understand and every
Fileless Malware Explained Read More »
Introduction Part II of the WanaCrypt0r code analysis has arrived. We’re going to be starting out where we left off last time, which is with the Microsoft Windows MS17-010 Server Message Block (SMB) exploit/”worm component” that made the ransomware so dangerous by allowing it to spread to other vulnerable (not patched) systems on the network
WanaCrypt0r Analysis Part II – SMB Exploit and Worm Component Read More »
Introduction During the past few days, as one might expect, we’ve been getting lots of news, reports, and files for the ransomware entitled WanaCrypt0r/WannaCry/WanaCrypt. First and foremost, the good news is that customers of PC Matic SuperShield were protected from WanaCrypt0r the entire time. However, this post aims to provide a technical analysis of how
WanaCrypt0r – A dive into the code Read More »
Fake tech support companies have been using popups and programs for quite some time with several different justifications to “fix” your computer. Here is a breakdown of a typical tech support scams. The Hook In order to have the victim call, there must be a method to force the user to call without looking
The Anatomy of Tech Support Scams Read More »
Worms, Trojans , and Rootkits are not the same.
The Differences Between a Virus, Trojan, and Rootkit Read More »
A recent report from TrendMicro/ZDI stated that Apple has ceased development of Apple Quicktime, and has also revealed two critical vulnerabilities under their Zero Day Initiative. These two vulnerabilities are considered “remote code execution” vulnerabilities, which means a miscreant could get the victim to click on a link or visit a website, and can remotely
The Locky ransomware is becoming more complex and far reaching…
Locky Ransomware Is Becoming More Prevalent Read More »
Recent reports have indicated that the actors behind Dridex, originally a banking Trojan distributor, have switched tactics, and are now heavily pushing out a new ransomware called Locky. The current method of distribution is via a spam email, which contains a Word document. Additional reports have stated that it is being distributed via the Neutrino
Actors behind Dridex launch another spam campaign, delivering Locky Ransomware Read More »
