Real-time captured network traffic triage via Snort and Suricata, deep-packet inspection via Wireshark, exploit kit deconstruction, and static & dynamic malware triage. Deconstructing C2 beacons, gate redirections, and multi-stage payload drops.
Deep-packet investigation of Simda botnet infection telemetry. Reconstructs infected TCP conversations, DNS fast-flux lookups, Flash-based exploit delivery, and encrypted second-stage C2 beaconing.
Dissection of Zeus banking malware network traces. Uncovers webinject configurations, fake SSL certificates, form-grabbing POST requests, and decentralized P2P command communication.
Tracing email malicious macro delivery through PowerShell stage-1 downloaders. Analysis of JA3 TLS fingerprinting, anomalous certificate signatures, and decentralized C2 communication channels.
Deconstructing Angler EK's infection chain: 32x32 gate redirects, obfuscated browser exploits, Diffie-Hellman key exchange over plain HTTP, and fileless in-memory payload execution.
Wire analysis of Neutrino Exploit Kit gate traffic via WebHop. Tracks compromised landing pages, malicious SWF payload delivery, anti-VM sandbox evasion checks, and dropped binary triage.
Forensics of Sweet Orange EK communication over unusual TCP ports 9633 and 60012. Analyzes proxy evasion attempts, direct-to-IP URI patterns, and Java vulnerability trigger sequences.
Tracing malvertising ad network injection into RIG Exploit Kit landing pages. Dissects RC4-encrypted payload extraction, Flash vulnerability exploitation, and Kronos persistence keys.
Wire capture triage of watering hole compromise delivering the CAPHAW (Shylock) banking malware family. Analyzes intermediate gate redirection hops and cookie token authentication.
Authoring custom IDS/IPS rule sets matching protocol anomalies, URI patterns, hex byte signatures, and beacon periodicity uncovered during packet analysis of active malicious infrastructure.
Post-capture binary extraction and execution in controlled sandbox environments. Inspects PE header sections, import address tables (IAT), extracted strings, API hooking, and IOC generation.
Try searching for keywords like "Angler", "Zeus", "Simda", "Emotet", or select "All Threats".