This is a detailed MD5 listing of CVE-2013-0640 pdf files that were posted earlier. I got a few requests for samples that were already pos...

This is another excellent publication by Brian Mariani & Frédéric Bourla (High Tech Bridge) describing their discovery and research ...

Signature and security product testing often requires large numbers of sorted malicious and clean files to eliminate false positives and n...

If all you needed for happiness is to destroy a few virtual machines, here are the samples for today's headline maker. The malwar...

Update: May 19, 2018 APT 1 resources Threat Actor aliases: Comment Crew, Comment Panda, PLA Unit 61398, TG-8223, APT 1,           BrownF...

Someone shared a sample of the Linux rootkit affecting  servers running CloudLinux, CentOS & cPanel. Here are the links: F eb ...

In January 2013,  Iurii Khvyl and Peter Kruse from CSIS posted analysis of Shylock variant capable of spreading through Skype. You ca...

Just a few accumulated samples here found and shared by others. This one is for Linux SSHDoor malware, which can steal your SSH passwor...

I am sure you remember excellent reverse engineering presentations by High-Tech Bridge experts I posted earlier.   High-Tech Bridge presen...

FireEye posted details about the sleep function found in Kelihos/Hlux ( An encounter with Trojan  Nap ), which is interesting, and i...

Update: Jan 18, 2013 - Here is a nice analysis  BatchWiper  Analysis by Emanuele De Lucia The next time the virus will wake up is Jan 21,...

Stocking stuffers. ZeroAccess rootkit is far from new and exciting but but this is a fresh lot with still active C2 servers. Although th...

More presents to come, pa rum pum pum pum     rum pum pum pum, rum pum pum pum

Here is another notable development of 2012 - Linux malware ( see Wirenet trojan posted earlier too ) Research: ESET Malicious Apache mod...

Holiday presents. Research: Symantec. Trojan.Stabuniq Found on Financial Institution Servers More research:  Stabuniq in-Depth  by...

End of the year presents. Point of Sale (POS) infostealer, aka Dexter. I got 3 more "tester-type" samples and added them belo...

End of the year presents: This is a sample of Hikit rootkit  Aug 2012 Related News and Analysis: The “Hikit” Rootkit: Advanced and ...

End of the year presents: Malicious Java file containing W32.Crisis and OSX.Crisis Related News and Analysis: Aug 2012 Crisis for Win...

End of the year presents: This is a sample of W32.Vobfus / Worm_Vobfus Related News and Analysis: Nov 2012   Trend Micro What’s the...

End of the year presents: These is a sample of W32.Makadocs Related News and Analysis: November 2012 Malware Targeting Windows 8 Uses...

End of the year presents: Backdoor.Wirenet.1 Related News and Analysis: August 2012 The first Trojan in history to steal Linux and M...

End of the year presents: This is a sample of W32.Narilam  Related News and Analysis: Nov 2012 (malware is much older but re-surfaced ...

End of the year presents: These are 4 samples of Skype Dorkbot / W32.Phopifas Related News and Analysis: October 2012 Infection Spre...

Img.baronet4tibet. Tibetan furniture  featuring a leopard and a lion Better late than never. Here are the samples of the rec...

Update November 14, 2012 1. We forgot to mention that in the best tradition of the Antivirus industry, all posters come with one (1) year...

Here is quick post for a CVE-2012-5076 sample (from Cool pack, as described by Kafeine here Cool EK : "Hello my friend..." CVE...

Sophos posted information about a variant of iMuler OSX trojan targeting Tibet activists ( New variant of Mac Trojan discovered, targeti...

Brian Mariani and Frédéric Bourla from High-Tech Bridge SA – www.htbridge.com  sent their excellent deep analysis of  CVE-2012-1535 vuln...

 This post is an addtion to the DeepEnd Research post Blackhole & Cridex: Season 2 Episode 1: Intuit Spam & SSL traffic analysis...

The Internet Explorer 0day aka now CVE-2012-4969, have been used in a "small number of targeted attacks ". The new Internet Exp...

Here are two samples of Java  CVE-2012-4681 exploit - one from the original targeted attack described in  our post on August 30, 2012 ...

Update5:  Mediafire notified me the other day that they had confirmation from LeakID that the notices they submitted  were done in error. ...

Here is our second article about Java 7 0-day vulnerability. Read more at DeepEndResearch.org ladyilonwick.wordpress.com Consider...

img.kids.discovery.com The cat is out of the bag. There is 0-day out there currently being used in targeted attacks.  The number of t...

Image from Kaspersky lab Here are a couple of Shamoon samples. Such destructive malware is rare because it does not really make much ...

I was still writing my analysis when Alienvault posted CVE-2012-1535: Adobe Flash being exploited in the wild and mine would be pretty m...

MD5 118f208998e12561b03200178edf826b members.3322.org PRORAT c5ac14a3c80b3c6af4c943e0f3839fbe lengkusky1.3322.org Keylogger 03ac8...

Just a quick post for those who can't sleep until get to play with Gauss Here is a great paper by Kaspersky  Gauss: Abnormal Dis...

Symantec recently posted an article by Joji Hamada titled  "Password “8861” Used in Targeted Attacks" , where the attackers...