Mandiant (part of Google Cloud)’s Post

When using Generative AI to create funny image or caption for your socmed has become too mainstream, why are we not trying to use it to inspect and analyze Malware files? And that is exactly what we have tested internally. Check following blog post for complete story #googlecloud #googlecloudsecurity #threatintelligence #secops

🚀 Check out our latest blog post on how Gemini 1.5 Flash is revolutionizing malware analysis! Building on our Gemini 1.5 Pro insights, we rigorously tested the Flash model with 1,000 Windows executables and DLLs from VirusTotal. 🔍 Each file was processed in just 12 seconds, delivering precise, human-readable summary reports. Discover how Gemini 1.5 Flash is enhancing malware dissection capabilities! ✨ Read more: https://bit.ly/3LJHXvp #MalwareAnalysis #Gemini #AI

Thrilled to join John Hammond in exploring how binary emulation can accelerate malware analysis. Check out the video for an in-depth discussion!

ViperSoftX: Malware detected since 2020 and primarily spread through cracked software and pirated content. Trellix researchers identified that the most recent variants use the Common Language Runtime (CLR) to dynamically load and run PowerShell commands, creating a PowerShell environment within AutoIt for operations. More details, including associated IOCs, TTPs, and news on our threat page: https://lnkd.in/eHwqyQdf

#CyberSEc, #ReverseEngineering Malware, #AssemblyLang #INC - increment, opposite of DEC instruction (value = value +1) Syntax: INC register #INT - the INT command generates a call to an interrupt handler #JUMPS - there are a variety of jumps, but the most common and important jumps are; - JE = jump if equal - JG = jump if greater - JGE = jump if greater or equal - JL = jump if lesser - JLE = jump if less than or equal - JMP = jump #ALWAYS - JNE = jump if not equal - JNZ = jump if not zero - JZ = jump if zero #LEA - Load Effective Address Syntax: LEA destination, source. #MOV - move copies the value from the source to the destination. Syntax: MOV destination, source

FAST malware analysis with binary emulation! Anuj Soni taught me a ton of sweet stuff going through a Qakbot sample, Cobalt Strike and more using emulation frameworks like Unicorn and Qiling... seriously super cool, huge thanks to Anuj for showcasing! https://buff.ly/47V8iiN

🌟 Excited to share our latest blog post on "Towards Robust Real-Time Hardware-based Mobile Malware Detection using Multiple Instance Learning Formulation" on arXiv (2404.13125v1). Our study introduces RT-HMD, a Hardware-based Malware Detector for mobile devices, refining malware representation through a Multiple Instance Learning approach. Check out the full details and empirical analysis in the arXiv link: https://bit.ly/3U9VVKO #MobileSecurity #MalwareDetection #RealTimeDetection

While testing a security solution (EDR or data-loss prevention systems or good old AV), Ethical Hackers / Red Teamers need to write malware and throw it at the security solution. First step in testing the defence capability would be to evade the static analysis. This is the one that causes a malicious file to get immediately deleted when you drop it on a computer. This is my latest video where I explain one of the many ways to evade the static analysis. #malware #redteaming #ethicalhacking #cybersecurity https://lnkd.in/dW3t_Gch

I am pleased to announce the recent publication of our research paper titled "MAGIC: Malware behaviour analysis and impact quantification through signature co-occurrence and regression" in the journal Computers & Security, Elsevier. The paper presents a novel scoring approach that accurately quantifies the impact of malware signatures on system resources. I invite you to read the full paper at the following link: https://lnkd.in/gjp2nAXk #CybersecurityResearch #MalwareAnalysis #ComputerSecurity #ResearchPublication #MalwareBehaviour #ImpactQuantification #SignatureCooccurrence #ThreatDetection #CyberDefense #ResearchPaper #SignatureAnalysis #CyberResilience #Amrita #AmritaVishwaVidyapeetham #SchoolOfComputing #Coimbatore #Elsevier #computersandsecurity

#CyberSec, #ReverseEngineering Malware, #Understand_Underlying tech before Tools #REP - repeat following string instruction. Common uses are REPE (repeat if equal), REPZ (repeat if zero), REPNE(repeat if nonequal), REPNZ (repeat if non-zero) Syntax: REP ins Where ins is a string operation RET - return Syntax: RET digit #SUB - subtraction, Is the opposite of ADD command. Subtracts the value of the source from the value of the destination and stores the result in destination. Syntax: SUB destination, source TEST - it performs a logical AND but does not store the value Syntax: TEST operand1, operand2 #SUB - subtraction. Is the opposite of ADD command. Subtracts the value of the source from the value of destination and stores the result in destination. Syntax: SUB destination, source #XOR - the XOR instruction connects two values using logical exclusive OR Syntax: XOR destination, source.