Techblog

There is a generic and easy way to unpack Java malware that is not well-known yet. For demonstration I use a recent JAR malware sample that jumps on the COVID-19 bandwagon.

There is a simple trick to see the bitness of a Portable Executable file immediately by looking into a hex editor. But why does it even work? And is it reliable?

G DATA discovered an email spam campaign in Germany that delivers NetWire RAT via PowerShell in Excel documents. The emails mimick the German courier, parcel and express mail service DHL.

A common approach to analyse potentially malicious software is dynamic analysis in a virtual machine. Therefore, malware authors use techniques to alter the malware's behavior when being run in a VM. But how do they actually do it?

Feature-rich remote access malware Pekraut emerges. The rodent seems to be of German origin and is ready to be released. We analyzed the malware in-depth.

A company is no longer satisfied with its current IT security solution. And yet they shy away from switching providers. But doing so is easier than they think. The Presales Consultants at G DATA CyberDefense have the right answers to the questions niggling IT managers and will develop a suitable…

Cyber criminals’ targets have not changed in the past year. They are after passwords and confidential data and try to encrypt data and systems. The current Malware Top 10 showing the ten most active malware families indicate how active the attackers have been in 2019.

End of January 2020, the Global Graph Summit took place in Austin TX, USA. The summit is the biggest conference in the world with a focus on graph computation and graph-related technologies. Stefan Hausotte from G DATA presented the work of his team for the second time at the Global Graph Summit.…

There’s a saying that you should treat passwords like your underwear - change them regularly and don't share them with others. However, opposition to this has been building for some time now. Changing passwords regularly doesn't improve security - quite the opposite.

Public source code repository at Bitbucket.org was as abused to host CryptBot, Buer loader with NuclearBot and Cryptominer.