Configuration data – which is historically tricky to parse – can be parsed directly from memory. We use the information-stealer IcedID as an example to cover the technique.
Techniques such as dependency emulation and analysis of encrypted network traffic can help detect malware samples that would not normally execute in a sandbox environment.
Subscribe for email updates to all Unit 42 threat research.By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.
Invalid captcha!
Security Technology
Get updates from Unit 42