/r/Malware
A place for malware reports, analysis and information for [anti]malware professionals and enthusiasts.
A place for malware reports and information for [anti]malware professionals and enthusiasts.
This is NOT a place for help with malware removal or any type of tech support. Ask your IT support staff, your search engine of choice, another subreddit (/r/antivirus or /r/techsupport for example), or a friend or relative. In that order.
Content rules:
- This is a subreddit for readers to discuss technical malware news, malware internals and infection techniques, malware tools, and anything related to the professional world of [anti]malware. Technical Support posts are forbidden and will result in removal and a possible ban.
- Our readers are intelligent, or at the very least technically curious. Posted content must be highly technical, wel-researched, and of good quality.
- Do not sensationalize or otherwise unnecessarily change the original title of the article you are linking. Clickbait will result in an immediate and permanent ban.
You might also be interested in:
Chat with us:
/r/Malware
81,608 Subscribers
Is there a job where you can legally make malware
title
12:48 UTC
AMA Crosspost
06:22 UTC
Assistance Needed For Triage API Access
Hi all,
I’ve been waiting over 7 months for a Triage API key, but my status is still “pending.” Does anyone have advice on getting access, or possibly let me use theirs?
Feel free to add me on Discord @_h3 if you can help. Thanks!
13:00 UTC
PhoenixRat
Does anybody at all recognize a R.A.T named Phoenix in 2022? Due to my exit of the cyber community, I lost track of it and now I'm trying to figure out if its name was changed or if the owner completely abandoned the project.
17:54 UTC
Asus lan driver malware
I've tried posting this on r/asus and r/techsupport but they are too thick headed.
This asus lan driver from asus site for Z790 e Gaming wifi is malware.
If you go behavior tab you can see it dropping fake Google Updater files and doing stuff with WER.
Can someone please confirm this.
15:19 UTC
Building an EDR From Scratch Part 4 - Kernel Driver (Endpoint Detection and Response)
19:42 UTC
Yemoza Trojan
A few days ago I received a message to a friend that I haven't spoken to a while on discord. They told me that they had a game project titled "Yemoza" that they worked on with friends and they wanted me to test it. Upon installing it it crashed my discord and my firefox and he informed me that I was hacked. he sent me passwords that he stole. Of the 6 he grabbed only 2 we're right, one of them being my discord. Shortly after I was kicked out. I deleted all traces of it, cleared all cache and temporarily files, did several virus scans using several platforms, and changed all my passwords. The only thing the hacker truly compromised was my discord but after communicating with discord support I got it back the next day. I haven't been able to find much on this Trojan, so I wanted to shed some light on it and maybe find a little bit more information. If there's anything you know about this virus please let me know
03:43 UTC
Latrodectus Loader - A year in the making
Malware analysis: https://www.vmray.com/latrodectus-a-year-in-the-making/
17:10 UTC
Looking for resources on malware and vulnerabilities discussions for my master's thesis
Good day friends. Hope this complies with the rules.
I'm working on my master's thesis. The project somewhat mirrors what DISCOVER did, so an automated cybersecurity warning generator. Right now, I'm looking for new sources to pull the data from. I'd like to use anything relevant to malware/vuln discussion, so tweets, potentially relevant, subreddits, hacker blogs/forums (anything in english, russian or chinese is fair game), any other social media/blog, anything that can anticipate official reports is welcome. Ideally I'd like to find dumps/datasets, but I'm prepared to scrape.
For now, I'm looking into this dataset on tweets and this more general one, as well as the russian and english forums listed on the wiki. I'm having trouble finding more underground sources.
Any suggestion is welcome, and I thank you for your time.
09:56 UTC
Frustrated with Malware analysis and Reverse Engineering
I used to like RE a lot. It was a fascinating idea in my mind.
After trying everything, I bought 2 courses from Udemy by Paul Chin:
https://www.udemy.com/course/malware-analysis-fundamentals/
https://www.udemy.com/course/malware-analysis-intermediate/
I have only 1 complaint with this that the professor taught only about unpacking a malware dynamically. I'm shocked that nobody over the whole internet has written in any of their blogs that you had to bp a freaking WinAPI and save it as a dump. That's it. I just paid few dollars solely for this "secret". I couldn't find a single blog or article about it.
Now, next hurdle, same situation. I don't know what to do with the unpacked executable. I know x86 assembly and C language but staring on disassembled malware on Ghidra is totally different skill but the sad part is no helping material to learn this skill.
I tried searching up for many real world malwares' technical analysis to know how experts solve them but there's simply a lack of explanation on why they chose to do this action say inspecting a particular function or using this plugin or script.
Unlike in software development, here nobody shares the thought behind choosing a specific action, it's either use this tool or just straight away follow things as it is.
I couldn't get one nice blog on a latest malware or ransomware which could explain step by step disassembly.
I request you guys to help me know what's wrong with me or am I unfit for this field? It'd be great if you could also provide some good quality resources for reverse engineering malware/ransomware
18:42 UTC
I made a fake Wincor Nixdorf/Diebold Nixdorf DLL for testing ATM malware.
Not the best, but it works with most samples.
Check it out! https://github.com/dragogos-6432/Fake-CSCWCNG
15:23 UTC
Building an EDR From Scratch Part 3 - Creating The Agent (Endpoint Detection and Response)
04:05 UTC
system informer creation date
so creation date it says is 2100 what is that mean i read some forums that people saying most likely its safe but that creation date worries me
07:19 UTC
Storing suspicious files
Q: How can I safely save suspicious files from the internet?
General purpose:
Save other types of files.
Secure reading.
I often encounter suspicious files online and wish to save them without risking malware infections or damaging my other files. I am uncertain whether these files contain harmful programs. What precautions should I take to ensure they do not affect my system? What types of files am I dealing with?
pdf mp3 rar zip tar gz
These files primarily contain study materials.
I'm viewing them from a virtual machine that is based on the debian distribution, but how do I store them outside of this machine in case it breaks? (like on a flash drive or like....)
what should I advise people before I send this file how to read it?
ps I'm not very good at viruses, that's why I came here to ask you for advice.
17:41 UTC
Building an EDR From Scratch Part 2 - Hooking DLL (Endpoint Detection and Response)
15:17 UTC
Malware Analysis
Hi friends, I started to collect samples of old viruses and I need hashes of some viruses, here is the list:Morris Worm, Creeper, Any virus on Apple II or Atari ST, viruses on Commodore 64, Elk Cloner, Virus 1, 2, 3 and hashes or files of other viruses that appeared before 2000!
16:57 UTC
Video: BBTok loader - ConfuserEx 2 deobfuscation with Python and dnlib
08:20 UTC
Building an EDR From Scratch Part 1 - Intro (Endpoint Detection and Response)
02:39 UTC