<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Payload &#8211; Cerbero Blog</title>
	<atom:link href="https://blog.cerbero.io/tag/payload/feed/" rel="self" type="application/rss+xml" />
	<link>https://blog.cerbero.io</link>
	<description></description>
	<lastBuildDate>Tue, 07 Mar 2023 11:58:54 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.0</generator>

<image>
	<url>https://blog.cerbero.io/wp-content/uploads/2023/09/cropped-pro_icon_512-32x32.png</url>
	<title>Payload &#8211; Cerbero Blog</title>
	<link>https://blog.cerbero.io</link>
	<width>32</width>
	<height>32</height>
</image> 
<site xmlns="com-wordpress:feed-additions:1">184292133</site>	<item>
		<title>RedLine Stealer Dropper</title>
		<link>https://blog.cerbero.io/redline-stealer-dropper/</link>
					<comments>https://blog.cerbero.io/redline-stealer-dropper/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 07 Mar 2023 11:53:28 +0000</pubDate>
				<category><![CDATA[Analysis]]></category>
		<category><![CDATA[Reversing]]></category>
		<category><![CDATA[.NET]]></category>
		<category><![CDATA[Batch]]></category>
		<category><![CDATA[Deobfuscator]]></category>
		<category><![CDATA[Dropper]]></category>
		<category><![CDATA[Emulator]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Multistage]]></category>
		<category><![CDATA[OneNote]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[Powershell]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2542</guid>

					<description><![CDATA[An interesting sample containing a number of different obfuscation techniques. In this article we analyze the dropper in detail and reach the final stage. SHA256: 0B93B5287841CEF2C6B2F2C3221C59FFD61BF772CD0D8B2BDAB9DADEB570C7A6 The first file we encounter is a OneNote document. If the &#8220;OneNote Format&#8221; package is installed, all files are automatically extracted. Among the extracted files there are two unidentified &#8230; <a href="https://blog.cerbero.io/redline-stealer-dropper/" class="more-link">Continue reading<span class="screen-reader-text"> "RedLine Stealer Dropper"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/redline-stealer-dropper/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2542</post-id>	</item>
		<item>
		<title>Video: Blitz XLS Malware Payload Extraction</title>
		<link>https://blog.cerbero.io/video-blitz-xls-malware-payload-extraction/</link>
					<comments>https://blog.cerbero.io/video-blitz-xls-malware-payload-extraction/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Tue, 02 Aug 2022 20:02:08 +0000</pubDate>
				<category><![CDATA[Video]]></category>
		<category><![CDATA[Excel]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[VBA]]></category>
		<guid isPermaLink="false">https://blog.cerbero.io/?p=2457</guid>

					<description><![CDATA[The malware sample analyzed in this video uses VBA code to extract a payload contained in Excel spreadsheet cells. SHA256: F00252AB17546CD922B9BDA75942BEBFED4F6CDA4AE3E02DC390B40599CE1740 The following is the Python code which mimics the VBA extraction code. from Pro.SiliconSpreadsheet import * from Pro.UI import proContext v = proContext().getCurrentAnalysisView() if v.isValid(): view = SiliconSpreadsheetWorkspaceView(v) ws = view.getSpreadsheetWorkspace() sheet = ws.sheetFromName(&#34;Final &#8230; <a href="https://blog.cerbero.io/video-blitz-xls-malware-payload-extraction/" class="more-link">Continue reading<span class="screen-reader-text"> "Video: Blitz XLS Malware Payload Extraction"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/video-blitz-xls-malware-payload-extraction/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">2457</post-id>	</item>
		<item>
		<title>URL Download Action (Tor)</title>
		<link>https://blog.cerbero.io/url-download-action-tor/</link>
					<comments>https://blog.cerbero.io/url-download-action-tor/#respond</comments>
		
		<dc:creator><![CDATA[Erik Pistelli]]></dc:creator>
		<pubDate>Sat, 11 Mar 2017 20:22:49 +0000</pubDate>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Suite Advanced]]></category>
		<category><![CDATA[Download]]></category>
		<category><![CDATA[Payload]]></category>
		<category><![CDATA[Tor]]></category>
		<guid isPermaLink="false">http://cerbero-blog.com/?p=1651</guid>

					<description><![CDATA[In the upcoming version of Profiler Advanced we have introduced a new useful action, namely the URL Download action. Many times in previous posts we have analyzed some malware which at the end of its shellcode ended up downloading a binary from the internet and executing it. We thought it would be nice to give &#8230; <a href="https://blog.cerbero.io/url-download-action-tor/" class="more-link">Continue reading<span class="screen-reader-text"> "URL Download Action (Tor)"</span></a>]]></description>
		
					<wfw:commentRss>https://blog.cerbero.io/url-download-action-tor/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
		<post-id xmlns="com-wordpress:feed-additions:1">1651</post-id>	</item>
	</channel>
</rss>
