The ReversingLabs Titanium Platform supports configuration extraction from over 40 different RATs/Backdoors, Keyloggers, Downloaders, Ransomware and POS malware.
ReversingLabs TitaniumCore is a static analysis engine with inspection capabilities that must overcome these obfuscation attempts. To improve visibility in our products, we continuously improve unpacking by supporting new packer formats.
A step that an adversary takes during the post exploitation phase of an attack is to establish a command line interface with a computer inside the victim’s network. One recent incident demonstrates the entire intrusion set operated by FIN6, a financially motivated threat actor group.
Given today’s threat landscape, operating an enterprise Security Operations Center (SOC) presents a high-stakes challenges. With modern IT infrastructures comprised of a labyrinth of assets, endpoints, and third-party dependencies, threat actors continue to succeed in infiltrating vulnerable systems with inherently sophisticated, difficult-to-detect malware.
Authenticode is a Microsoft code signing technology software publishers use to guarantee the origin and integrity of their applications. The vast majority of modern software applications are actively using it and depend on its integrity validation system.
Portable executable is probably the most prolific application format used for code distribution. It can be found on a wide variety of hardware and software platforms. That’s why it is no wonder that many systems, other than its native Windows, end up supporting it in one way or another.
Unified Extensible Firmware Interface (UEFI) is a specification that defines the interfaces between the operating system and the platform firmware. Originally developed by Intel, and now supported by an alliance of software and hardware vendors, UEFI quickly became a standard that displaced the legacy basic input/output system (BIOS).
Authenticode is a Microsoft code signing technology designed to guarantee the origin and integrity of an application. The core principle of its integrity verification system is code immutability
Enterprise software development graduated from the “waterfall” framework of development and operations - and became less linear, more complex and, in several ways, more difficult to secure.
Get the best of RL Blog delivered to your in-box weekly to stay up to date on key trends, analysis and best practices across threat intelligence and software supply chain security.
