Temasec Matthew Haigh Archives

Category Archives: Matthew Haigh

Configuring a Windows Domain to Dynamically Analyze an Obfuscated Lateral Movement Tool

July 7 2020 By Daniel Pany in analysis, FLARE, Homepage Carousel, Latest Blog Posts, Malware, Mandiant, Matthew Haigh, Reverse Engineering, Security, Threat Research, Trevor Haskell

We recently encountered a large obfuscated malware sample that offered several interesting analysis challenges. It used virtualization that prevented us from producing a fully-deobfuscated memory dump...

Configuring a Windows Domain to Dynamically Analyze an Obfuscated Lateral Movement Tool

July 7 2020 By Daniel Pany in analysis, FLARE, Homepage Carousel, Latest Blog Posts, Malware, Mandiant, Matthew Haigh, Reverse Engineering, Security, Threat Research, Trevor Haskell

FakeNet Genie: Improving Dynamic Malware Analysis with Cheat Codes for FakeNet-NG

April 2 2020 By Daniel Pany in Detection, FLARE, Homepage Carousel, Latest Blog Posts, Malware, Malware Analysis, Matthew Haigh, Nhan Huynh, open source tools, Threat Research

As developers of the network simulation tool FakeNet-NG, reverse engineers on the FireEye FLARE team, and malware analysis instructors, we get to see how different analysts use...

FakeNet Genie: Improving Dynamic Malware Analysis with Cheat Codes for FakeNet-NG

April 2 2020 By Daniel Pany in Detection, FLARE, Homepage Carousel, Latest Blog Posts, Malware, Malware Analysis, Matthew Haigh, Nhan Huynh, open source tools, Security, Threat Research

As developers of the network simulation tool FakeNet-NG, reverse engineers on the FireEye FLARE team, and malware analysis instructors, we get to see how different analysts use...

Open Sourcing StringSifter

September 7 2019 By Daniel Pany in data science, FLARE, Homepage Carousel, Jay Gibble, Latest Blog Posts, machine learning, Malware Analysis, Matthew Haigh, Michael Sikorski, Philip Tully, Threat Research, tools

Malware analysts routinely use the Strings program during static analysis in order to inspect a binary's printable characters. However, identifying relevant strings by hand is time...

Learning to Rank Strings Output for Speedier Malware Analysis

May 29 2019 By Daniel Pany in FLARE, Homepage Carousel, Jay Gibble, Latest Blog Posts, machine learning, Malware, Malware Analysis, Matthew Haigh, Michael Sikorski, Philip Tully, Security, Threat Research

Reverse engineers, forensic investigators, and incident responders have an arsenal of tools at their disposal to dissect malicious software binaries. When performing malware analysis, they successively ...

Learning to Rank Strings Output for Speedier Malware Analysis

New FakeNet-NG Feature: Content-Based Protocol Detection

October 23 2017 By Daniel Pany in Advanced Malware, Blog, Detection, FLARE, Homepage Carousel, Latest Blog Posts, Malware, Malware Analysis, Matthew Haigh, Michael Bailey, Security, Threat Research

I (Matthew Haigh) recently contributed to FLARE’s FakeNet-NG network simulator by adding content-based protocol detection and configuration. This feature is useful for analyzing malware that uses ...