A Crypto Lab walkthrough demonstrates Base64 and XOR decoding, AES-CBC decryption, reusable recipes, and configuration inspection, recovering a download command from a fake GlobalProtect investigation.
A static-analysis walkthrough extracts five files from a fake GlobalProtect MSI and recovers VBA from an encrypted Word document, showing configured installer actions and a staged macro chain while distinguishing source evidence from execution.
A password-protected pension-themed Word attachment concealed DellHeuristics.exe, whose lab activity used GitHub APIs. Its embedded IP matched an earlier regional phishing IOC, but a SideWinder link remains unproven.
A ransomware guide explains how data theft, credential compromise, and backup damage can outlast encryption, and covers recovery opportunities, evidence preservation, incident response, and resilient backup preparation.
Researchers traced an unsigned, GlobalProtect-themed MSI through Myanmar geofencing and Google Sheets tasking to a follow-on payload. The evidence supports malware activity but does not establish attribution to SideWinder or another actor.
A comprehensive guide explains malware types, how infections spread and cause harm, and practical steps for prevention and response, including isolating suspected devices, protecting evidence, restoring from trusted backups and reviewing exposed accounts.
A public-source review of Myanmar-linked cyber records from 2016 to 2026 finds recurring risks to trusted channels, identities, and institutional data, while stressing that selected reports cannot establish national incident prevalence or confirm every attribution.
Researchers reconstructed a QUICSILVER backdoor from VHD-contained fragments and confirmed its hash matched a published sample. Isolated testing observed Startup-folder persistence, but no successful C2 session or campaign attribution was independently established.
A practical guide to capturing live-process memory, verifying identity and evidence integrity, interpreting coverage and limitations, and protecting sensitive dumps. It describes supported formats and safe handling workflows.
The guide explains how Malware INFO’s Guided and Deep API Trace distinguish correlated telemetry from exact supported API observations, outlines a safe lab workflow, and details coverage limits and interpretation cautions.
A guide to Malware INFO Payload & Memory Analyzer explains bounded local analysis, provenance and runtime-correlation limits, sensitive memory data, and why static indicators or incomplete results do not prove execution or malicious activity.
A guide to Malware INFO’s DLL Behavior Trace workflow covers static inspection, four controlled invocation modes, evidence interpretation, and safety limits. It stresses that sparse results do not prove a DLL is benign and unknown DLLs require an isolated VM.
A deployment guide connects Malware INFO to Wazuh through a restricted HTTPS receiver, covering event filtering, privacy safeguards, firewalling, validation, and production hardening.
A Malware INFO guide walks analysts through malware investigation workflows, emphasizing isolated execution, evidence preservation, privacy safeguards and the limits of automated findings.