Blog

DDE Ransomware in a Macro-less Word Document

Macros in Microsoft Office have been used extensively by malware authors as a mechanism to download and execute a malicious payload on a system. Defensive measures introduced by Microsoft such as disabling macros by default have not stopped malware authors as they continue to devise social engineering techniques to convince users to enable macros thereby […]

Read More "DDE Ransomware in a Macro-less Word Document"

Persistent Emotet Malware with a Crafty Social Engineering Technique

Malware Family: Emotet SHA256 Hash Vaule 455be9278594633944bfdada541725a55e5ef3b7189ae13be8b311848d473b53 View the Full VMRay Analyzer Report With security ever more tightly integrated into operating systems, malware authors often rely on the unwitting participation of an end user to enable malicious action. Social engineering techniques have evolved significantly over the years and last week the VMRay Research Team identified […]

Read More "Persistent Emotet Malware with a Crafty Social Engineering Technique"

6 Ways Intelligent Monitoring Improves Malware Analysis Accuracy & Efficiency

This is the second blog in a two-part series describing how VMRay Analyzer’s Intelligent Monitoring capabilities remove the noise from malware analysis. Read part one. VMRay Analyzer’s hypervisor-based monitoring approach provides total visibility into the behavior of a sample under analysis and enables monitoring only parts of the system related to the analysis. This makes […]

Read More "6 Ways Intelligent Monitoring Improves Malware Analysis Accuracy & Efficiency"

Intelligent Monitoring: Removing the Noise from Malware Analysis

This blog post is the first in a two-part series describing how VMRay Analyzer’s Intelligent Monitoring capabilities remove the noise from malware analysis. In dealing with potentially malicious files, incident responders and IT security teams are swamped with information in the form of log files, reports, alerts, and notifications. As a result, it is critical […]

Read More "Intelligent Monitoring: Removing the Noise from Malware Analysis"

Preventing Sandbox Evasion with Randomized Filenames

In the malware analysis community, it is common to rename a malware sample to its hash value or add the hash to the filename. This helps analysts easily identify a sample and to store it with a unique filename. This strategy saves time and empowers collaboration. A drawback, however, is malware can use this as a […]

Read More "Preventing Sandbox Evasion with Randomized Filenames"

Agentless Detection – Locard’s Exchange Principle Applied to Cybersecurity

Marketing departments of Cybersecurity vendors around the globe go into overdrive when they can shout from the rooftops that their solution is ‘agentless’. Sure, that sounds good, but why is this so important? And what is truly agentless? To appreciate the importance of an agentless approach, we’ll go old school and invoke Locard’s Exchange Principle .  […]

Read More "Agentless Detection – Locard’s Exchange Principle Applied to Cybersecurity"

Poweliks Malware – Filelessly Persistent

Malware Family: Poweliks Hash Value SHA256: 4727b7ea70d0fc00f96a28de7fa3d97fa 9d0b253bd63ae54fbbf0bd0c8b766bb View the Full Poweliks Malware Analysis Report One of the key features released in VMRay Analyzer v2.1 is the enhanced analysis of fileless malware (also referred to as “non-malware”). Fileless malware is defined by malware analysis expert Lenny Zeltser as “..malware that operates without placing malicious executables on the file system.” An important […]

Read More "Poweliks Malware – Filelessly Persistent"

Password Protected Word Document Connects to TOR Hidden Service

Hash Value SHA256: 3a813df1c8f1e835cc98dd60b799c64e61 db51a259ee30b7235004ccb3c9df64 View the Full Password Protected Word Document Analysis Report Password protected documents are an effective method for malware to bypass anti-virus (AV) and other detection solutions. Typically the AV will not be able to parse the password required from the text of the email used to send the malicious document. […]

Read More "Password Protected Word Document Connects to TOR Hidden Service"

VMRay Analyzer v2.1 Enhances Detection Efficacy & Fileless Malware Analysis

VMRay Analyzer 2.1 will be officially announced at Black Hat 2017 this week. Over the last three years, VMRay has set itself apart from the competition in the Automated Malware Analysis (AMA) industry with its unique agentless hypervisor-based approach to malware detection. This approach enables DFIR Specialists and CERTs using VMRay Analyzer to detect new […]

Read More "VMRay Analyzer v2.1 Enhances Detection Efficacy & Fileless Malware Analysis"

Built-In YARA Rulesets for Increased Efficacy and Classification

YARA is an open source tool that helps malware researchers identify and classify malware by family based on known binary patterns and strings. YARA works by ingesting rules and applying them against various elements of the analysis (such as files and registry keys) to flag potentially malicious files and processes. Signature-based detection with YARA rulesets has its […]

Read More "Built-In YARA Rulesets for Increased Efficacy and Classification"