This post is the first analysis in a trilogy that I will be producing over the coming weeks and months. In it, I will conduct an in-depth examination of the infection chains and the Brazilian banking malware ecosystem, specifically Eternidade Stealer, Astaroth, and Grandoreiro, that were observed in operation during the same period (the first Read More… »
My first public malware research was regarding an x32 PE stager (exe) from the IcedID family. In this research I analyzed three samples from different years, with the aim of identifying code reuse, and developing a Yara signature capable of detecting any IcedID sample, based on fixed code patterns persistent over the years. So you Read More… »
In this report I will technical analyze the new IcedID malware, go deep through reverse engineering, debugging and detection engineering. Introduction The IcedID is a banking malware design to steal financial information from your victims. The IcedID malware is also know by MITRE ATT&CK as S0483, and has been around since 2017. The IcedID has Read More… »