Explore our blog

As seen by security researchers across the world and proven in a joint research by McAfee and Intezer, Lazarus, one of the groups operating from North Korea, has consistently reused code in their malware toolset.

Researchers at Palo Alto Networks recently published a report regarding the NOKKI malware, which has shared code with KONNI and, although not in the report by Palo Alto, KimJongRAT (discovered by Paul Rascagnères of Cisco Talos in 2013), and another report on how there is evidence of the NOKKI malware connecting...

We would like to proudly announce that Intezer Analyze™ now supports genetic malware analysis for ELF binaries! You may now upload ELF files to our system and find code reuse. We have already indexed the genes of millions of different files into our ELF genome database, classified into both malicious, trusted, and...

Foudre is a remote access tool and has the ability to remotely execute commands, steal information about the infected target (such as keystrokes, process information, etc), and auto-update itself. Most of the code and functionality from the previous versions of Foudre and Infy was reused and can be read about in the reports by Palo Alto linked above, so we are only going to focus on the new, unique, interesting features and the linkage of code reuse from previous versions.

Our technology is based on genetic analysis of files. So far, we’ve focused mainly on detection of code reuse, as part of the genetic malware analysis process.

Attacks from the online groups Lazarus, Silent Chollima, Group 123, Hidden Cobra, DarkSeoul, Blockbuster, Operation Troy, and 10 Days of Rain are believed to have come from North Korea. But how can we know with certainty? And what connection does a DDoS and disk-wiping attack from July 4, 2009, have with WannaCry?

The popular banking trojan Emotet is constantly evolving to evade detection. Stripped down to its genetic core, malware analysis reveals Emotet's code remains largely the same from generation to generation.

We’ve recently added to our product, support for Dynamic Execution and Static Extraction and we wanted our user interface to reflect these additions.

As stated in a previous blog entry, it is common for malware authors to sign malicious files with “legitimate” digital certificates in order to bypass security products.

This post is part of Intezers blog series about executable and linkable formats. In this post, we will introduce the concept of ELF relocations and their relationship with symbols. Later we will explain more advanced concepts, such as dynamic linking.

After launching Intezer community edition in November 2017, we noticed that many of our users uploaded packed samples. Yet packed files don’t reveal the true ‘DNA’ of the files.

In our previous post, we focused on understanding the relationship between sections and segments, which serve as the foundation for understanding the ELF file format.

Let's dive into Executable and Linkable Format files. Learn about ELF relocation and segments, and how cyber attacks can use this file format.