Author: cslab

Hello, security analysts! 🛡️ Just as a criminal’s fingerprint is a crucial clue at a crime scene, there are decisive clues in the analysis of ‘malware,’ the criminal of the digital world. These are ‘Unique Strings’ and ‘Signatures.’ Specific hacker groups or malware families tend to leave behind their own habits, unique C&C server addresses,…

Hello, security researchers! 🕵️‍♂️ When we judge a person, we don’t just judge them by their ‘appearance’, do we? We need to look at ‘what actions’ they usually take to truly understand their character. The same applies to software (files). Even if their outward appearance (icon, filename) can be disguised as something like a Calculator,…

When introducing generative AI into workflows, many people’s first concern is the prompt. They meticulously craft prompts, considering what role to assign, what format the answer should take, and what conditions must be included. There’s an expectation that a well-crafted prompt will consistently yield stable results in the future. However, in practice, using LLMs reveals…

Hello, everyone passionate about security! 🕵️‍♂️ While performing security monitoring or incident response, or when looking at open-source code found on the internet, there are moments when you think, “Hmm? This code feels a bit suspicious?” Analyzing it line by line yourself takes too long, and just running it is too risky. This is precisely…

Hello, security students! 🛡️ Today, I’ve prepared a somewhat thrilling and dangerous (?) hands-on lab. It’s time to dissect a real (but safe for educational purposes) ransomware sample right before our eyes. There are two main methods for malware analysis. Dynamic Analysis: Running the malware in a virtual environment and observing its behavior (involves risk)…

Hello, security analysts dedicated to research late into the night! 🌙 Today has been a whirlwind. We’ve chunked, cleaned, deobfuscated, and even predicted the future of obfuscated code. Thanks to the powerful weapon that is AI, it feels like we accomplished in just 3 hours what would have taken 3 days. ⚡️ However, before we…

Hello, security analysts who prove with action! 🕵️‍♂️ Until last time, we mastered ‘static analysis’, where we dissected malware without actually running it. We looked at the code and predicted, “Hmm, this guy plans to steal files.” But you can’t catch a culprit with just suspicion. Now it’s time to gather physical evidence! Today, we’ll…

Hello, persistent security researchers! 🕵️‍♂️ Last time, we identified “what tools” malware brought using metadata (IAT, strings). “Hmm, it brought encryption tools (CryptEncrypt) and communication tools (InternetOpen). Looks like ransomware!” But that’s not enough. Just because a culprit bought a knife doesn’t necessarily mean they committed a crime. We need to raid the scene to…

Hello, aspiring security professionals! 🌱 Until last time, we used static analysis tools (PE-bear, Pestudio, Strings) to extract the ‘bones and flesh (metadata)’ from unknown files. Import Address Table (IAT): The tools this file uses (API functions) Strings: Hidden texts within the file (IP addresses, messages, etc.) However, looking at hundreds of API functions and…

Hello, security analysts dreaming of becoming Sherlock Holmes! 🔎 We’ve come a long way so far. Static Analysis: We found encryption tools and blackmail messages hidden in the code. Dynamic Analysis: We executed it in a sandbox and caught it manipulating the registry. MITRE ATT&CK: We even converted these behaviors into professional terms like T1486…