<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Malware &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/malware/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Thu, 04 Apr 2024 10:06:38 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Malware &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>DotNET ManifestResources Format Package</title>
		<link>https://blog.cerbero.io/dotnet-manifestresources-format-package/</link>
					<comments>https://blog.cerbero.io/dotnet-manifestresources-format-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 04 Apr 2024 10:06:38 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[resources]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2975</guid>

					<description><![CDATA[We have released the DotNET ManifestResources Format package for all licenses of Cerbero Suite. .NET manifest resources are embedded elements within .NET assemblies, used to store additional data such as files, icons, and strings that an application requires for execution. These resources are directly compiled into the executable, becoming a part of the application’s core &#8230; <a href="https://blog.cerbero.io/dotnet-manifestresources-format-package/" class="more-link">Continue reading<span class="screen-reader-text"> "DotNET ManifestResources Format Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/dotnet-manifestresources-format-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2975</post-id>	</item>
		<item>
		<title>ThreatPulse Package</title>
		<link>https://blog.cerbero.io/threatpulse-package/</link>
					<comments>https://blog.cerbero.io/threatpulse-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 05 Oct 2023 10:03:21 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Malware]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2813</guid>

					<description><![CDATA[To stay ahead of the ever-evolving landscape of malware techniques, we have released the ThreatPulse package. This continuously updated package is available for all Cerbero Suite licenses through Cerbero Store. We&#8217;ve been contemplating this project for some time, and the opportunity came in the form of a Microsoft Word document disguised as a PDF. SHA256: &#8230; <a href="https://blog.cerbero.io/threatpulse-package/" class="more-link">Continue reading<span class="screen-reader-text"> "ThreatPulse Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/threatpulse-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2813</post-id>	</item>
		<item>
		<title>PowerShell Malware with x64 Shellcode</title>
		<link>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/</link>
					<comments>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Wed, 10 May 2023 08:05:21 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Silicon]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2682</guid>

					<description><![CDATA[This malware gives us a chance to see the recently introduced Silicon Shellcode Emulator in action. SHA256: 8CF1E49C74FB05DE954A6B70281F47E3CBD021108B0EE11F4A59667FF28BFEE9 The PowerShell code is not obfuscated: it decodes a base64 encoded string, decrypts the result with a xor operation, allocates memory with VirtualAlloc, copies the shellcode to the allocated memory and then executes it. If ([IntPtr]::size -eq &#8230; <a href="https://blog.cerbero.io/powershell-malware-with-x64-shellcode/" class="more-link">Continue reading<span class="screen-reader-text"> "PowerShell Malware with x64 Shellcode"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/powershell-malware-with-x64-shellcode/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2682</post-id>	</item>
		<item>
		<title>OneNote Malware With ISO File</title>
		<link>https://blog.cerbero.io/onenote-malware-with-iso-file/</link>
					<comments>https://blog.cerbero.io/onenote-malware-with-iso-file/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 09 May 2023 09:56:37 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[chm]]></category>
		<category><![CDATA[ISO]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2675</guid>

					<description><![CDATA[We recently stumbled upon this tweet by @Cryptolaemus1 about a malicious OneNote document with an embedded ISO file. Because of our recently released ISO Format package, we thought it would be interesting to analyze this malware sample with Cerbero Suite. SHA256: 2B0B2A15F00C6EED533C70E89001248A0F2BA6FAE5102E1443D7451A59023516 The unidentified embedded object in the OneNote document is an ISO file. We &#8230; <a href="https://blog.cerbero.io/onenote-malware-with-iso-file/" class="more-link">Continue reading<span class="screen-reader-text"> "OneNote Malware With ISO File"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/onenote-malware-with-iso-file/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2675</post-id>	</item>
		<item>
		<title>Reversing Complex PowerShell Malware</title>
		<link>https://blog.cerbero.io/reversing-complex-powershell-malware/</link>
					<comments>https://blog.cerbero.io/reversing-complex-powershell-malware/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 28 Mar 2023 10:21:28 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[beautifier]]></category>
		<category><![CDATA[Injection]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Powershell]]></category>
		<category><![CDATA[Reversing]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2617</guid>

					<description><![CDATA[In this post we&#8217;re going to analyze a multi-stage PowerShell malware, which gives us an opportunity to use our commercial PowerShell Beautifier package and its capability to replace variables. Sample SHA2-256: 2840D561ED4F949D7D1DADD626E594B9430DEEB399DB5FF53FC0BB1AD30552AA Interestingly, the malicious script is detected by only 6 out of 58 engines on VirusTotal. We open the script in Cerbero Suite, decode &#8230; <a href="https://blog.cerbero.io/reversing-complex-powershell-malware/" class="more-link">Continue reading<span class="screen-reader-text"> "Reversing Complex PowerShell Malware"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/reversing-complex-powershell-malware/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2617</post-id>	</item>
		<item>
		<title>RedLine Stealer Dropper</title>
		<link>https://blog.cerbero.io/redline-stealer-dropper/</link>
					<comments>https://blog.cerbero.io/redline-stealer-dropper/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 07 Mar 2023 11:53:28 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Deobfuscator]]></category>
		<category><![CDATA[Dropper]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2542</guid>

					<description><![CDATA[An interesting sample containing a number of different obfuscation techniques. In this article we analyze the dropper in detail and reach the final stage. SHA256: 0B93B5287841CEF2C6B2F2C3221C59FFD61BF772CD0D8B2BDAB9DADEB570C7A6 The first file we encounter is a OneNote document. If the &#8220;OneNote Format&#8221; package is installed, all files are automatically extracted. Among the extracted files there are two unidentified &#8230; <a href="https://blog.cerbero.io/redline-stealer-dropper/" class="more-link">Continue reading<span class="screen-reader-text"> "RedLine Stealer Dropper"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/redline-stealer-dropper/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2542</post-id>	</item>
		<item>
		<title>Simple Batch Emulator Package</title>
		<link>https://blog.cerbero.io/simple-batch-emulator-package/</link>
					<comments>https://blog.cerbero.io/simple-batch-emulator-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 09 Feb 2023 12:24:40 +0000</pubDate>
				<category><![CDATA[Engine]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2524</guid>

					<description><![CDATA[To help in the analysis of malware which uses Windows batch scripts we just released a package on Cerbero Store called &#8220;Simple Batch Emulator&#8221;. The name of the package is self-explanatory as it provides a basic emulator for batch scripts. The package is available to all commercial licenses of Cerbero Suite Advanced. The following is &#8230; <a href="https://blog.cerbero.io/simple-batch-emulator-package/" class="more-link">Continue reading<span class="screen-reader-text"> "Simple Batch Emulator Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/simple-batch-emulator-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2524</post-id>	</item>
		<item>
		<title>Video: Blitz 45 Seconds OneNote Malware Analysis</title>
		<link>https://blog.cerbero.io/video-blitz-45-seconds-onenote-malware-analysis/</link>
					<comments>https://blog.cerbero.io/video-blitz-45-seconds-onenote-malware-analysis/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Fri, 03 Feb 2023 13:29:36 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[VBS]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2522</guid>

					<description><![CDATA[The malicious OneNote sample analyzed in this video contains an executable. The executable contains a CAB archive in a resource entry. The CAB archive contains a VBS script which can directly be inspected in Cerbero Suite. SHA256: F408EF3FA89546483BA63F58BE3F27A98795655EB4B9B6217CBE302A5BA9D5F7]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-blitz-45-seconds-onenote-malware-analysis/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2522</post-id>	</item>
		<item>
		<title>OneNote Format Support</title>
		<link>https://blog.cerbero.io/onenote-format-support/</link>
					<comments>https://blog.cerbero.io/onenote-format-support/#comments</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 02 Feb 2023 11:14:42 +0000</pubDate>
				<category><![CDATA[Engine]]></category>
		<category><![CDATA[Package]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Suite Standard]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Microsoft Office]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2516</guid>

					<description><![CDATA[Microsoft OneNote is rising in popularity as a vector for malware. Therefore, all commercial licenses of Cerbero Suite can now download our &#8220;OneNote Format&#8221; package from Cerbero Store which parses the OneNote format and extracts embedded files. Installing the package from Cerbero Store takes only a few mouse clicks. Once the package is installed, you &#8230; <a href="https://blog.cerbero.io/onenote-format-support/" class="more-link">Continue reading<span class="screen-reader-text"> "OneNote Format Support"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/onenote-format-support/feed/</wfw:commentRss>
			<slash:comments>2</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2516</post-id>	</item>
		<item>
		<title>Sample Downloader Package</title>
		<link>https://blog.cerbero.io/sample-downloader-package/</link>
					<comments>https://blog.cerbero.io/sample-downloader-package/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Thu, 11 Aug 2022 15:31:30 +0000</pubDate>
				<category><![CDATA[Package]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Cloud]]></category>
		<category><![CDATA[Download]]></category>
		<category><![CDATA[Intelligence]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Online]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2462</guid>

					<description><![CDATA[We have just released our Sample Downloader package and it is available for all licenses of Cerbero Suite Advanced. While this is a simple package, we consider it extremely useful, as it allows to download malware samples by their hash. The package tries to download the requested samples from various supported intelligence services. Check out &#8230; <a href="https://blog.cerbero.io/sample-downloader-package/" class="more-link">Continue reading<span class="screen-reader-text"> "Sample Downloader Package"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/sample-downloader-package/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2462</post-id>	</item>
	</channel>
</rss>
