<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[yellow的博客]]></title><description><![CDATA[网络安全小菜鸟]]></description><link>https://blog.youkuaiyun.com/singleyellow</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; singleyellow]]></copyright><item><title><![CDATA[蔓灵花组织利用XML文件在Windows系统部署恶意代码]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/150448050</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/150448050</guid><author>singleyellow</author><pubDate>Sat, 16 Aug 2025 16:12:33 +0800</pubDate><description><![CDATA[摘要：Bitter组织利用XML文件格式在Windows系统部署恶意代码：通过伪装成微软365的域名下载并运行恶意程序Microsoft.exe。该程序创建假冒的OneDrive计划任务，每15分钟运行一次，使用curl工具下载d.php脚本并上传受害机的用户名和计算机名。分析发现其命令行参数与蔓灵花组织常用手法一致，判断属于该组织攻击活动。]]></description><category></category></item><item><title><![CDATA[msc格式样本逆向分析]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/140540816</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/140540816</guid><author>singleyellow</author><pubDate>Fri, 19 Jul 2024 10:50:17 +0800</pubDate><description><![CDATA[新型msc格式样本，以后将会替代lnk、offcie宏文档等成为攻击者最常用的钓鱼诱饵。]]></description><category></category></item><item><title><![CDATA[如何启用CobaltStrike隐藏的Sleep_mask功能]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/140525606</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/140525606</guid><author>singleyellow</author><pubDate>Thu, 18 Jul 2024 16:45:32 +0800</pubDate><description><![CDATA[CobatStrike的信标从4.5版本开始支持Sleep_mask功能；从4.5-4.8版本生成反射加载dll信标都会文明包含sleep_mask()函数，无论是否启用sleep_mask功能；而4.9版本不会文明包含sleep_mask()函数，只有在启用sleep_mask功能时，才会把sleep_mask()函数解密到一个单独的内存段中。]]></description><category></category></item><item><title><![CDATA[Kimsuky-Android-RAT-Client分析]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/137146424</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/137146424</guid><author>singleyellow</author><pubDate>Fri, 29 Mar 2024 15:42:45 +0800</pubDate><description><![CDATA[Kimsuky组织Android远控程序客户端代码分析]]></description><category></category></item><item><title><![CDATA[WinDbg调试异常(!!! second chance !!!)]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/135112847</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/135112847</guid><author>singleyellow</author><pubDate>Wed, 20 Dec 2023 17:38:08 +0800</pubDate><description><![CDATA[WinDbg调试异常，出现(!!! second chance !!!)，这次找到原因所在。]]></description><category></category></item><item><title><![CDATA[CVE-2023-38831漏洞实例]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/133947873</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/133947873</guid><author>singleyellow</author><pubDate>Fri, 20 Oct 2023 15:49:42 +0800</pubDate><description><![CDATA[CVE-2023-38831漏洞实例分析]]></description><category></category></item><item><title><![CDATA[python代码轻松下载youtube视频]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/133888391</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/133888391</guid><author>singleyellow</author><pubDate>Tue, 17 Oct 2023 17:13:11 +0800</pubDate><description><![CDATA[python代码轻松下载YouTube视频]]></description><category></category></item><item><title><![CDATA[HW样本《关于“XXXX”微信视频号发布短视频的信息说明.exe》的逆向分析]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/132269519</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/132269519</guid><author>singleyellow</author><pubDate>Mon, 14 Aug 2023 10:03:48 +0800</pubDate><description><![CDATA[HW期间遇到疑似红队二次开发的CobatStrike木马逆向分析]]></description><category></category></item><item><title><![CDATA[Brute Ratel C4 1.2.2版本载荷对应的yara检测规则]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/129749890</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/129749890</guid><author>singleyellow</author><pubDate>Fri, 24 Mar 2023 15:54:45 +0800</pubDate><description><![CDATA[针对泄露版Brute Ratel C4 1.2.2编写对应防护规则。]]></description><category></category></item><item><title><![CDATA[bindiff+ida判定样本所属类型]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/125912594</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/125912594</guid><author>singleyellow</author><pubDate>Thu, 21 Jul 2022 15:20:52 +0800</pubDate><description><![CDATA[使用bindiff7+ida7.6判定恶意样本归属]]></description><category></category></item><item><title><![CDATA[感染型宏病毒原理]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/125727009</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/125727009</guid><author>singleyellow</author><pubDate>Mon, 11 Jul 2022 18:22:30 +0800</pubDate><description><![CDATA[宏病毒感染原理]]></description><category></category></item><item><title><![CDATA[DNS缓存]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/125346096</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/125346096</guid><author>singleyellow</author><pubDate>Sat, 18 Jun 2022 13:47:51 +0800</pubDate><description><![CDATA[恶意程序通过查询是否存在DNS记录，决定是否执行下一步恶意行为。]]></description><category></category></item><item><title><![CDATA[父进程欺骗]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/122753899</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/122753899</guid><author>singleyellow</author><pubDate>Sun, 30 Jan 2022 16:59:03 +0800</pubDate><description><![CDATA[如何实现父进程欺骗以及对应的检测方法。]]></description><category></category></item><item><title><![CDATA[如何优雅的在C#的DLL文件中下断点]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/121351596</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/121351596</guid><author>singleyellow</author><pubDate>Tue, 16 Nov 2021 11:25:11 +0800</pubDate><description><![CDATA[优雅的在C#的DLL文件中下断点。]]></description><category></category></item><item><title><![CDATA[如何优雅的为C#样本解混淆]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/121335523</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/121335523</guid><author>singleyellow</author><pubDate>Mon, 15 Nov 2021 18:46:25 +0800</pubDate><description><![CDATA[使用de4dot.exe优雅为C#样本解混淆。]]></description><category></category></item><item><title><![CDATA[yara规则分享:Rekoobe病毒]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/121264585</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/121264585</guid><author>singleyellow</author><pubDate>Thu, 11 Nov 2021 11:34:30 +0800</pubDate><description><![CDATA[Rekoobe病毒对应yara规则。]]></description><category></category></item><item><title><![CDATA[Sidecopy样本分析]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/121244539</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/121244539</guid><author>singleyellow</author><pubDate>Wed, 10 Nov 2021 11:28:37 +0800</pubDate><description><![CDATA[样本来源时间：2021年11月09日。]]></description><category></category></item><item><title><![CDATA[Konni样本分析]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/121221839</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/121221839</guid><author>singleyellow</author><pubDate>Tue, 09 Nov 2021 10:13:16 +0800</pubDate><description><![CDATA[消息来源时间：2021年11月02日。]]></description><category></category></item><item><title><![CDATA[yara规则分享:decaf勒索病毒]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/121096878</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/121096878</guid><author>singleyellow</author><pubDate>Tue, 02 Nov 2021 11:27:55 +0800</pubDate><description><![CDATA[decaf勒索病毒对应yara规则。]]></description><category></category></item><item><title><![CDATA[第12章 Ret2Libc 实战之利用 ZwSetInformationProcess]]></title><link>https://blog.youkuaiyun.com/singleyellow/article/details/121081622</link><guid>https://blog.youkuaiyun.com/singleyellow/article/details/121081622</guid><author>singleyellow</author><pubDate>Mon, 01 Nov 2021 15:56:33 +0800</pubDate><description><![CDATA[Ret2Libc 实战之利用 ZwSetInformationProcess]]></description><category></category></item></channel></rss>