Content Paint
Embee Research

Featured Posts

Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars
Tracking APT SideWinder Domains By Combining Regex Patterns, Whois Records and Domain Registrars

Tracking APT SideWinder Domains With Regular Expressions, Whois Records and Domain Registrars

Tracking Gamaredon Infrastructure With Passive DNS Records and Subdomain Analysis
Tracking Gamaredon Infrastructure With Passive DNS Records and Subdomain Analysis

Leveraging Passive DNS to identify APT infrastructure. Building on public intelligence reports.

Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples
Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples

Advanced CyberChef techniques using Registers, Regex and Flow Control

Recent Posts

Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader
Malware Unpacking With Hardware Breakpoints - Cobalt Strike Shellcode Loader

Unpacking a simple Cobalt Strike loader using Debuggers and Hardware breakpoints.

Malware Unpacking With Memory Dumps - Intermediate Methods (Pe-Sieve, Process Hacker, Hxd and Pe-bear)
Malware Unpacking With Memory Dumps - Intermediate Methods (Pe-Sieve, Process Hacker, Hxd and Pe-bear)

Demonstrating three additional methods for obtaining unpacked malware samples. Using Process Hacker, Pe-sieve, Hxd and Pe-bear.

How to Use Process Hacker and DnSpy to Unpack .NET Malware
How to Use Process Hacker and DnSpy to Unpack .NET Malware

Unpacking an Asyncrat loader using Process Hacker and Dnspy

Remcos Downloader Analysis - Manual Deobfuscation of Visual Basic and Powershell
Remcos Downloader Analysis - Manual Deobfuscation of Visual Basic and Powershell

Decoding a Remcos Loader, leveraging regex, python and Cyberchef to identify IOCs.

Understanding and Improving The Ghidra UI for Malware Analysis
Understanding and Improving The Ghidra UI for Malware Analysis

Improving Malware Analysis Workflows by Modifying the default Ghidra UI.

Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation
Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation

Manually decoding a Cobalt Strike .vbs Loader utilising advanced CyberChef and Shellcode Emulation.

Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Your link has expired. Please request a new one.
Great! You've successfully signed up.
Great! You've successfully signed up.
Welcome back! You've successfully signed in.
Success! You now have access to additional content.