CuraSec

tag: Malware-Analysis · 9 items

Learn SANS ISC: Extracting Embedded Files from OneNote (.one) Files
2026-11-01 · SANS ISC · source ↗ #forensics#onenote#malware-analysis
  • Engineer — Learn: OneNote has been abused as a malware delivery vector; knowing how to extract embedded objects from .one files is useful for analyzing suspicious attachments or artifacts in CI/build pipelines that process user-uploaded documents.
  • SOC/IR — Learn: Useful forensic technique for IR scenarios involving OneNote-based phishing lures with embedded payloads; bookmark the method for future triage of .one file artifacts.
  • Leader — Skip
Learn Setting Up a Local Ghidra Server for Malware Analysis Labs
2026-10-29 · SANS ISC · source ↗ #malware-analysis#reverse-engineering#tooling
  • Engineer — Learn: Practical tutorial on externalizing Ghidra analysis data from VM snapshots; worth reviewing if you maintain internal malware analysis or reverse-engineering infrastructure for security tooling.
  • SOC/IR — Learn: Useful methodology for IR/malware analysts who need persistent analysis artifacts across VM snapshots; no immediate detection work, but improves lab operational discipline.
  • Leader — Skip
Learn archived YARA-X 1.21.0 released with minor improvements and bugfixes
2026-10-03 · SANS ISC · source ↗ #tooling#malware-analysis#yara
  • Engineer — Skip
  • SOC/IR — Learn: If your team uses YARA-X for malware scanning, review the 1.21.0 changelog to evaluate whether the 5 improvements or 4 bugfixes affect your rule accuracy or pipeline stability before upgrading.
  • Leader — Skip
Learn archived LausivLoader: Inter-stage Data Passing in Multi-Stage Malware
2026-09-17 · SANS ISC · source ↗ #malware-analysis#malspam#loader
  • Engineer — Learn: The delivery chain was caught by SPF/DMARC failures, reinforcing that email authentication controls provide meaningful defense-in-depth even when AV misses. No patch or configuration change required, but useful for validating email security posture.
  • SOC/IR — Learn: SANS ISC analysis of LausivLoader’s inter-stage data-passing mechanics improves understanding of multi-stage loader behavior; no explicit IOCs or ATT&CK mappings surfaced in available signals, so detection development should wait for the full diary read rather than acting now.
  • Leader — Skip
Learn archived Redtail Malware Payload Analysis — SANS ISC Guest Diary
2026-09-10 · SANS ISC · source ↗ #malware-analysis#payload#threat-research
  • Engineer — Learn: A hands-on payload breakdown may surface indicators or techniques relevant to endpoint/workload defenses, but no enrichment signals (KEV/EPSS/PoC) and a very thin summary mean no immediate action is warranted.
  • SOC/IR — Learn: If the full diary contains IOCs or ATT&CK-mappable TTPs for Redtail, it could inform detection tuning, but the summary exposes no actionable content — read the full entry before queuing any hunt work.
  • Leader — Skip
Plan archived UAC-0099 embeds LLM-disrupting prompts in malware to blind AI analysis
2026-09-01 · The Hacker News · source ↗ #adversarial-ai#malware-analysis#uac-0099
  • Engineer — Learn: GuardBreaker shows that AI-assisted malware scanning can be manipulated at the artifact level; no patch or config change is needed today, but engineers building AI-augmented security pipelines should understand this evasion class.
  • SOC/IR — Plan: Review any AI/LLM-assisted triage or malware-analysis workflows and add a mandatory human-review layer for suspected APT samples — do not treat LLM output as authoritative when analyzing artifacts from sophisticated actors.
  • Leader — Learn: Adversaries are now actively engineering around AI-assisted defenses; file this as context for future AI-tool procurement and policy decisions around over-reliance on LLM-based analysis in SOC operations.
Learn archived SANS ISC: Malicious PE file compiler statistics overview
2026-08-28 · SANS ISC · source ↗ #malware-analysis#pe-format#threat-research
  • Engineer — Skip
  • SOC/IR — Learn: Compiler and PE header metadata distributions across malicious samples can inform triage heuristics; useful background for analysts who build or tune static detection rules, but yields no immediate detection action.
  • Leader — Skip
Learn archived SANS ISC: Testing Gemma4/Ollama for malware hash analysis via DShield
2026-08-13 · SANS ISC · source ↗ #ai-tooling#malware-analysis#threat-intel
  • Engineer — Learn: Practical walkthrough of using a local LLM to enrich malware hashes against VirusTotal and CyberGordon — worth evaluating if you’re building AI-assisted triage pipelines, but no patch or configuration action required.
  • SOC/IR — Learn: Demonstrates an accessible approach to AI-assisted hash triage using Ollama and Gemma4 locally; useful context for analysts evaluating LLM integration into enrichment workflows, but yields no immediate detection or hunt action.
  • Leader — Skip
Learn archived Malaika: LLM Multi-Agent Framework for Android Malware Behavior Analysis
2026-07-13 · arXiv cs.CR · source ↗ #malware-analysis#llm-security#static-analysis
  • Engineer — Learn: Academic research on grounded agentic reasoning for malware behavior reconstruction; no immediate engineering action, but the tri-grounding approach (domain, semantics, knowledge) is worth noting when evaluating LLM-assisted code-analysis tooling.
  • SOC/IR — Learn: Malaika’s behavior-reconstruction framing — connecting sparse program evidence to auditable behavioral conclusions — could inform how teams structure LLM-assisted malware triage workflows, though no detection or hunt action is available from this paper alone.
  • Leader — Skip