A Look into SUNBURST’s DGA

My attempt at a script that decodes all of SUNBURST’s DGA strings :)

Journal: FlareOn7 (Part 1)

Walk with me through my approach to the challenges in FlareOn7 :)

Do you want to bake a donut? Come on, let’s go update~ Go away, Maria.

Dad! There’s A Rat In Here!

An analysis of the DADSTACHE sample fetched by the maldoc (MD5…

Journal: FlareOn7 (Part 3)

This is the last part of the series :)

APT40 goes from Template Injections to OLE-Linkings for payload delivery

Journal: FlareOn7 (Part 2)

Continue walking with me on levels 7–9…

Shadows with a chance of BlackNix

A long post on analysis of a variant of BlackNix RATs, which are…

Shadows in the Rain

An analysis of a BBSRAT sample involving mutexes and C2 URL associated with the…

What happened between the BigBadWolf and the Tiger?