Analyze Malware & Phishing More Deeply Than Ever Before

Equip your CERT, CIRT, SOC, or IR team with deep automated and analyst-driven malware and phishing analysis in one platform.

• AI detected phishing page
• AI detected landing page (webpage, office document or email)
• AI detected suspicious elements in Email header
• Joe Sandbox AI detected malicious Email
• AI detected malicious page (phishing or scam)
• Document exploit detected (droppes PE files)
• Detected Locky Ransomware
• Detected Gozi e-Banking trojan
• Detected Trickbot e-Banking trojan (based on config)
• Detected GrandCrab Ransomware
• Found Process Doppelgänging injection technique
• Detected Kronos e-Bankin malware
• CPUID based timing evasion detected
• Detected Nanocore Rat
• Detected macOS CrescentCore
• Mounts NFS shares which might bypass GateKeeper
• Detected unpacking (overwrites its own PE header)
• Writes Mach-O files to hidden directories
• Modifies the hosts file
• Allocates memory in foreign processes
• Contains functionality to write to remote processes
• Contains functionality to read the PEB
• Writes to foreign memory regions
• Tries to detect sandboxes and other dynamic analysis tools
• Contains functionality to detect virtual machines (IN, VMware)
• Contains functionality to detect virtual machines (SGDT)
• Deletes itself after installation
• Allocates memory in foreign processes
• Found API chain indicative of sandbox detection
• Suspicious heap spray patterns found (NOP-sled)
• Document exploit detected (process start blacklist hit)
• Drops PE files to the windows directory (C:\Windows)
• May sleep (evasive loops) to hinder dynamic analysis
• Performs DNS lookups
• Contains VNC / remote desktop functionality
• Downloads files from webservers via HTTP
• May use AES for encryption and decryption
• Modifies existing windows services
• Contains functionality to create system tasks
• PE file contains sections with non-standard names
• Binary may include packed or encrypted data
• PE file contains an invalid checksum
• PE sections with suspicious entropy found
• Creates driver files
• Deletes Windows files
• Reads the hosts file
• Tries to load missing DLLs
• Enables driver privileges
• Posts data to webserver
• Spawns processes
• Uses HTTP for connecting to the internet
• Contains functionality to enumerate / list files inside a directory
• Contains functionality to enum processes or threads
• Contains functionality to load and extract PE file embedded resources
• Creates temporary files
• Contains functionality to enum processes or threads
• Accesses external storage location
• Urls found in memory or binary data
• Creates files
• Reads ini files