Category Archives: Techniques

Process Doppelgänging – a new way to impersonate a process

Posted on December 18, 2017 by hasherezade

Recently at Black Hat Europe conference, Tal Liberman and Eugene Kogan form enSilo lab presented a new technique called Process Doppelgänging. The video from the talk is available here. (Also, it is worth mentioning that Tal Liberman is an author … Continue reading →

Posted in Malware, Programming, Techniques | Tagged , | 9 Comments

Hijacking extensions handlers as a malware persistence method

Posted on May 25, 2017 by hasherezade

Recently I gave a presentation titled “Wicked malware persistence methods” (read more here). After releasing the slides I got questions about some of the demonstrated methods – especially about the details of extension handler hijacking – so, I decided to … Continue reading →

Posted in Malware, Techniques, Tutorial | 4 Comments

How to turn a DLL into a standalone EXE

Posted on July 21, 2016 by hasherezade

During malware analysis we can often encounter payloads in form of DLLs. Analyzing them dynamically may not be very handy, because they need some external loaders to run. Different researchers have different tricks to deal with them. In this post … Continue reading →

Posted in Malware, Techniques, Tutorial | 11 Comments

Introduction to ADS – Alternate Data Streams

Posted on March 19, 2016 by hasherezade

Sometimes during automated malware analysis in a sandbox (i.e. Cuckoo), we can get in the report the following information: “creating alternate data streams”. It is related with an interesting feature of NTFS file system,  that can be used for hidden … Continue reading →

Posted in Malware, Techniques | 3 Comments