Malware analysis

Understanding Windows Registry

Introduction Let’s say a user just finished installing a piece of recommended software. They weren’t really familiar with the source, but the potential benef

Windows Internals for Malware Analysis

Introduction This article defines Windows internals and illustrates tools which can be used to explore Windows internal systems. We’ll be defining malware a

Lampion malware: what it is, how it works and how to prevent it | Malware spotlight

Introduction  The Lampion malware is spread through emails containing a link that downloads a .zip file with malicious files in it. It’s a banking Trojan: cr

Malware spotlight: Sodinokibi

Introduction Ransomware is not new at this point in time and will be with us for the foreseeable future, as new types of ransomware are constantly emerging.

Networking Basics for Reverse Engineers

Introduction This article will define network reverse engineering, list tools used by reverse engineers for reverse engineering and then highlight the networ

Understanding stack instructions

This article will introduce readers to the assembly concepts in relation to the stack. We will discuss basic concepts related to stack and various registers,

Understanding single-stepping when debugging

Single-stepping is one of the most powerful features of a debugger, as it allows a reverse engineer to execute a single instruction at a time before returnin

DLL load order hijacking

DLL load order hijacking is a popular technique used to force a legitimate program to load a malicious DLL file in Windows by abusing Windows’ DLL load order

Arithmetic Instructions

Introduction This article defines arithmetic instructions as executed by x86 processors. It goes on to describe in brief, four key classifications of arithme

Malware spotlight: Nemty

Introduction If the last five years or so have proven anything, it is that ransomware is here to stay as a threat in the cybersecurity wild. This should not