Writeups and field notes

Anatomy of an infected site: from the fingerprint gate to the CheckBot malware

A legitimate company website was distributing malware to its visitors. I followed the chain from the injection on the site down to the Rust payload, with sandbox detonation, memory dumping and differential analysis. Here is how it worked and how you take it apart.