Date Author Title
2023-06-24Guy BruneauEmail Spam with Attachment Modiloader
2023-06-22Brad DuncanQakbot (Qbot) activity, obama271 distribution tag
2023-06-05Johannes UllrichBrute Forcing Simple Archive Passwords
2023-05-18Johannes UllrichA Quick Survey of .zip Domains: Your highest risk is running into Rick Astley.
2023-02-28Brad DuncanBB17 distribution Qakbot (Qbot) activity
2022-10-16Didier StevensVideo: Analysis of a Malicious HTML File (QBot)
2022-10-13Didier StevensAnalysis of a Malicious HTML File (QBot)
2022-07-09Didier Stevens7-Zip Editing & MoW
2022-07-04Didier Stevens7-Zip & MoW: "For Office files"
2022-07-03Didier Stevens7-Zip & MoW
2022-06-04Guy BruneauSpam Email Contains a Very Large ISO file
2022-05-20Xavier MertensA 'Zip Bomb' to Bypass Security Controls & Sandboxes
2022-04-20Brad Duncan"aa" distribution Qakbot (Qbot) infection with DarkVNC traffic
2022-02-18Xavier MertensRemcos RAT Delivered Through Double Compressed Archive
2021-10-31Didier StevensVideo: Phishing ZIP With Malformed Filename
2021-10-24Didier StevensPhishing ZIP With Malformed Filename
2021-09-08Brad Duncan"Stolen Images Evidence" Campaign Continues Pushing BazarLoader Malware
2021-08-13Brad DuncanExample of Danabot distributed through malspam
2021-07-26Didier StevensFailed Malspam: Recovering The Password
2020-10-14Brad DuncanMore TA551 (Shathak) Word docs push IcedID (Bokbot)
2020-08-07Brad DuncanTA551 (Shathak) Word docs push IcedID (Bokbot)
2020-05-13Brad DuncanMalspam with links to zip archives pushes Dridex malware
2020-05-03Didier StevensZIP & AES
2020-04-26Didier StevensVideo: Malformed .docm File
2020-04-08Brad DuncanGerman malspam pushes ZLoader malware
2020-04-04Didier StevensNew Bypass Technique or Corrupt Word Document?
2020-03-25Brad DuncanRecent Dridex activity
2020-01-22Brad DuncanGerman language malspam pushes Ursnif
2019-03-14Didier StevensTip: Ghidra & ZIP Files
2018-12-17Didier StevensPassword Protected ZIP with Maldoc
2017-08-26Didier StevensMalware analysis: searching for dots
2016-11-22Didier StevensUpdate:ZIP With Comment
2016-11-21Didier StevensZIP With Comment