Da Samala Tech blogs on malware and stuffs
This article explores the discovery of a potential early-stage Caesar cipher skimmer during the investigation of suspicious activities linked to a Tunisian online store. The investigation uncovers hidden JavaScript masquerading…
Discover the LandUpdate808 fake update variant, a new cybersecurity threat tracked by our team. This article details its unique delivery chain, payload variations, and indicators of compromise, emphasizing the importance…
Backlinks Backlinks, or outgoing links, are links on a given page that links to another webpage. Why does it matter? When search engines crawl the internet, they record any outbound…
In this post, we take a closer look at the Gootloader malware, correcting previous assertions about its dysfunction. Through the use of tools like Process Monitor and Burp Suite, we…
Learn to automate Gootkit malware detection using urlscan.io. This guide covers the use of urlscan.io's API and Python scripting to efficiently identify and analyze malicious forum loader scripts, enhancing your…
Explore the mysterious allure of USPS templates in countries like Ghana, Cambodia, and Brazil. Discover why official government domains might host these lure articles, and the implications for global cyber…
BLUF: This document will cover research into Gootkit search term research as well as research possible verification methods. Intro: Gootkit research depends on having high quality methods to find the…
I spotted a lure masquerading as an Indeed Career Guide resource (https//666025xyz/erp-terms-of-contract). See below. I found this while working on the Gootkit Crawler project – a project that will generate…
In this concise exploration, we delve into the methodology behind tracking and analyzing SocGholish malware. Aimed at both newcomers and seasoned SOC Analysts, the article guides readers through the practical…
Discover the latest strategies in cyber warfare with our investigative piece on Gootkit malware's evolving C2 infrastructure. Uncover insights into how the removal of xmlrpc.php signals a new phase in…
Aaron Samala