Editorial team

Stagecraft of Malicious Office Documents – A Look at Recent Campaigns Botconf 2018 Thursday | 10:20 – 10:50 Nirmal Singh 🗣 | Deepen Desai 🗣 | Tarun Dewan 🗣 Malicious office documents have become a favorite malware delivery tool for malware authors. We have observed an increase in use of malicious documents over past 4 years. 30% of the […]

Let’s Go with a Go RAT! Botconf 2018 Friday | 11:50 – 12:20 Yoshihiro Ishikawa 🗣 | Shinichi Nagano 🗣 The Go language (GoLang) is an open source programming language developed by Google Inc. in 2009, and it can be run on various platforms such as Linux, Mac, Windows, Android.Speaking of malware using Golang, Mirai is one

Judgement Day Botconf 2018 Thursday | 15:10 – 16:00 Thomas Siebert 🗣 – Suspsense 🙂 Edit

Tracking Actors through their Webinjects Botconf 2018 Friday | 12:20 – 13:00 James Wyke 🗣 Webinjects have been a feature of banking malware ever since they were popularised with great success by early families such as Zeus. In that time writing Webinjects has become a highly specialized skill with off-the-shelf Webinjects systems becoming as popular

Swimming in the Cryptonote Pools Botconf 2018 Wednesday | 10:20 – 11:00 Emilien Le Jamtel 🗣 In the world of cryptocurrency-related malware, mining currencies based on cryptonote technology like Monero (XMR) is a growing threat for organizations. We can observe that interest in such cryptocurrencies has increased dramatically for malicious actors those past months because

Code Cartographer’s Diary Botconf 2018 Wednesday | 11:30 – 12:30 Daniel Plohmann 🗣 | Steffen Enders | Elmar Padilla At last year’s Botconf, we have launched Malpedia [1], our community-driven approach to create a free and independent resource for rapid identification and actionable context when investigating malware. While only touching the surface of analysis possibilities last time (mostly surveying

In-depth Formbook Malware Analysis Botconf 2018 Wednesday | 15:00 – 15:40 Rémi Jullian 🗣 Form-grabber malware are nowadays quite common. They provide simple yet effective methods for stealing infected users’ credentials. They are named thereby since they target HTML forms’ submissions, made by web-browsers. Sometimes, they also provide classical password stealer capabilities such as key-logging,