BhaveshL – Medium

Oct 29

Cobalt Strike & .HTA files

As per Mitre ATT&CK, ID S0154 tracks Cobalt Strike as a “commercial, full-featured, remote access tool that bills itself as “adversary simulation software” designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike has gained notoriety in the world of cyber breaches as a…

Cyber

6 min read

Cyber

6 min read

Aug 27

Bossfight #1 — Analyzing Emotet C2 Traffic

Hello there, today I’ll be analyzing Emotet C2 traffic using Wireshark. In this article we’ll go into stuff like Emotet’s infection chain, the C2 traffic and what it looks like and how Emotet drops it’s initial binary after infection. Emotet, initially identified in 2014 as a banking malware, has undergone…

Malware

5 min read

Bossfight #1 — Analyzing Emotet C2 Traffic using Wireshark

Malware

5 min read

Aug 26

“Retefe” — Analyzing a .JS malware

Malspam campaigns, short for malicious spam campaigns, represent a prevalent form of cyber threat that involves the distribution of harmful emails on a large scale. We’ve often seen malicious files in the form of .exe, .docx. .pdf and even .ISO …

Malware Analysis

5 min read

Malware Analysis

5 min read

Aug 24

Memory Forensics using Volatility3

Hello, in this blog we’ll be performing memory forensics on a memory dump that was derived from an infected system. This system was infected by RedLine malware. Today we’ll be focusing on using Volatility. Volatility is a very powerful memory forensics tool. It is used to extract information from memory…

Memory Forensics

5 min read

Memory Forensics

5 min read

Jun 2

Out of the blue…

In this writeup, I will delve into my intriguing experience of geolocating a picture. Below is the picture which I stumbled onto in one of a discord server that I’m part of. The OP posted the picture saying “Here’s a little nice osint challenge”. Hmmm….. time to roll up the…

Osint

3 min read

Osint

3 min read