Sean Wilson

Sean Wilson

Sean is a co-founder of Open Analysis, and volunteers as a malware researcher. His splits his time between reverse engineering malware and building automation tools for incident response.

http://openanalysis.net

UnpacMe 8.5.0 – Lightning Fast MalwareID Mode

With the release of version 8.5.0, we introduce a new analysis mode for rapid triage of malware that doesn’t require unpacking. Using MalwareID, we provide malware identification and extracted configurations within seconds.

UnpacMe Weekly: Stealing Summer

This week, we observed an increase in Stealc and Vidar Stealer submissions, with a continued rise in .NET-based information stealers. UnpacMe’s enhanced analysis now more effectively handles corrupted PE files.

UnpacMe Support For YARA-X

We are excited to announce that UnpacMe has integrated support for YARA-X, a new project recently released by Google’s VirusTotal team. YARA-X is a complete rewrite of YARA developed in Rust. According to the announcement, future features and modules will be exclusively developed for YARA-X, rather than the existing

Zombieware: Malware That Never Dies...

Self-replicating malware, long abandoned by its operators, continues to contribute significant volume and noise to malware feeds. We investigate this trend, which we refer to as Zombieware.

UnpacMe 8.0.0 – YARA Rule Management, Shared Rules, AV Detects, .NET Analysis, Icons, and Much More

Our first big release of 2024 adds a completely redesigned YARA editor with rule versioning, rule management, AV detections, .NET metadata analysis and much more.

Malware Trends: Yearly 2023

Looking back on the past year's public UnpacMe submissions, we have compiled some interesting statistics that provide an overview of the state of malware in 2023. Instead of just counting malware families, we wanted to drill deeper into our data and extract predictive trends that can help us

Weekly Malware Trends

This week we saw AgentTesla, SmokeLoader, Redline, StealC, Formbook, and Snake Keylogger as the top submitted malware families.

UnpacMe 7.5.0 - Community Rules, Improved Hunting, Goodware Integration,

UnpacMe submissions are now scanned with open source community Yara rules, a new Hunt view can be used to quickly pivot on searchable data, and Goodware labels are automatically applied to unpacked samples.

UnpacMe 7.4.0 – SourceIntel, Go Symbols, Search Filters

Results are now enriched with SourceIntel OSINT data, Go samples are now processed with GoReSym symbol recovery, and both Search and Yara results now have customizable results filters.

UnpacMe Weekly: Hunting by Moonlight

Updated Yara Hunting to improve scan coverage and lookback, aded support for Yara 4.3, and updated support for bloated files