About InfoProcess

InfoProcess is an Australian company and specialises in Windows Internals and Security Research. With main focus on kernel mode and user mode hooking, we solve two critical real-life problems:

Traditional Anti-Virus solutions fail to detect the ever growing number of sophisticated zero-day attacks. Our product AntiHook SDK provides an easy way to detect and stop all advanced malware, zero-day and APT attacks that bypass the existing signature based Anti-Virus solutions.
There are thousands of applications that need to be customised and instrumented, but their source code is not available or hopelessly unmaintainable. Well, the good news is - no source code - no problems! Modernise and customise existing Windows applications and extend them to meet the new needs.

Application Customisation Framework SDK
(formerly known as HookTool SDK)

Application Customisation Framework addresses a challenging problem that many companies face. The problem: Large number of many solutions are still using legacy code whose code base sometimes goes back over 15 years. So how do you customise these applications?

The solution: Leveraging Application Customisation Framework allows new custom code written in modern languages (like C++ or C# or even VB.NET) to be injected into existing applications to influence extend and instrument the application's behaviour.

AntiHook SDK

Kernel mode solution for 32-bit and 64-bit Windows platforms. The product integrates with Windows kernel and provides an easy way to monitor system behaviour by intercepting process/thread and activity, registry modifications, file I/O operations and network activity.

AntiHook SDK is now part of Vinsula Execution Engine.

Malware Analysis

Ivo's blog: Analysis of real-world zero-day attacks and malware - http://vinsula.com/security-blog

Scripting Bot Malware: No Need to Learn C to Launch a Cyber Attack
November 27, 2013
http://vinsula.com/2013/11/27/scripting-bot-malwar/
I truly enjoy capturing sophisticated malware, but when it comes to scripting malware, it gets scary. Two weeks ago we came across a piece of malware that turned out to be a full-blown bot - one that is capable of taking full control over a user's machine, and all encapsulated within less than 3K lines of source code! No special skills required. You just need to have the motivation for writing malicious code, and that will allow you earn some easy money. Simple, isn't it?
Vinsula Execution Engine Analysis of Venomous Snake Zero-Day Malware - CopyHook.131019.A
October 19, 2013
http://vinsula.com/2013/10/19/vee-uncovers-venomous-snake-zero-day-malware-131019
Malware authors frequently seek code-execution methods that not only evade detection by AV software but also cover tracks and remove evidence that could reveal the origins of the malicious code. Different methods exist for achieving these objectives, and the high degree of extensibility in Windows provides plenty of options for the bad guys to exploit.
Catching a Headless Horseman (or analysis of Trojan.Downloader.1301007.C-Jottix)
October 15, 2013
http://vinsula.com/2013/10/15/trojan-downloader-1301007c-jottix
The highlights of the analysis:
- The executable image is digitally signed with a proper certificate issued by Thawte.
- As a part of the execution, a special file with extension ".exe" but no name is being created and launched (this is why I dubbed it "Headless Horseman").
- Amazon EC2 services are used for hosting the additional code that is being downloaded.
Hunting Down FTP Password Stealer Malware with Vinsula Execution Engine
September 1, 2013
http://vinsula.com/2013/09/01/hunting-down-ftp-password-stealer-malware-with-vinsula-execution-engine
We use Vinsula Execution Engine to hunt down and analyze a piece of password stealer malware designed to steal FTP credentials and other sensitive info.
Trojan.Plague.13604.B - Behavioral Signature Analysis of Mutopy Malware using Vinsula
June 5, 2013
http://vinsula.com/2013/06/05/trojan-plague-13074-behavioral-signature-analysis-malware-vinsula
We ran Mutopy through the Vinsula Execution Engine and confirmed prior findings while providing additional details on the behavior of this malware.
... For more malware analysis visit http://vinsula.com/security-blog/