Muhammad Irshad - Cisco Talos Blog

<!doctype html> <html lang="en"> <head> <title>Muhammad Irshad - Cisco Talos Blog</title>  <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">  <link rel="stylesheet" href="https://blog.talosintelligence.com/assets/css/bootstrap.min.css?v=bd37905eab"> <link rel="stylesheet" href="https://blog.talosintelligence.com/assets/css/navigation.css?v=bd37905eab"> <link rel="stylesheet" href="https://blog.talosintelligence.com/assets/css/footer.css?v=bd37905eab"> <link rel="stylesheet" href="https://blog.talosintelligence.com/assets/css/pagination.css?v=bd37905eab"> <link rel="stylesheet" href="https://blog.talosintelligence.com/assets/css/banners.css?v=bd37905eab"> <link rel="stylesheet" href="https://blog.talosintelligence.com/assets/css/style.css?v=bd37905eab"> <link rel="stylesheet" href="https://blog.talosintelligence.com/assets/css/prism.css?v=bd37905eab"> <link rel="stylesheet" href="https://blog.talosintelligence.com/assets/css/prism-vsc-dark-plus.css?v=bd37905eab"> <link rel="stylesheet" href="https://blog.talosintelligence.com/assets/css/prism-talos.css?v=bd37905eab"> <link rel="stylesheet" href="https://blog.talosintelligence.com/assets/css/landing-page.css?v=bd37905eab"> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;1,100;1,300;1,400&display=swap" rel="stylesheet"> <link href="https://fonts.googleapis.com/css2?family=Fira+Mono:wght@400;500&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;1,100;1,300;1,400&display=swap" rel="stylesheet"> <link href="https://cdn.jsdelivr.net/npm/ghost-theme-utils@latest/dist/css/style.min.css" rel="stylesheet"> <link rel="icon" href="https://blog.talosintelligence.com/content/images/size/w256h256/2022/07/talos_o_square.png" type="image/png"> <link rel="canonical" href="https://blog.talosintelligence.com/author/muhammad/"> <meta name="referrer" content="no-referrer-when-downgrade"> <meta property="og:site_name" content="Cisco Talos Blog"> <meta property="og:type" content="profile"> <meta property="og:title" content="Muhammad Irshad - Cisco Talos Blog"> <meta property="og:url" content="https://blog.talosintelligence.com/author/muhammad/"> <meta name="twitter:card" content="summary"> <meta name="twitter:title" content="Muhammad Irshad - Cisco Talos Blog"> <meta name="twitter:url" content="https://blog.talosintelligence.com/author/muhammad/"> <meta name="twitter:site" content="@TalosSecurity"> <script type="application/ld+json"> { "@context": "https://schema.org", "@type": "Person", "sameAs": [], "name": "Muhammad Irshad", "url": "https://blog.talosintelligence.com/author/muhammad/", "mainEntityOfPage": "https://blog.talosintelligence.com/author/muhammad/" } </script> <meta name="generator" content="Ghost 5.101"> <link rel="alternate" type="application/rss+xml" title="Cisco Talos Blog" href="https://blog.talosintelligence.com/rss/"> <script defer src="https://cdn.jsdelivr.net/ghost/sodo-search@~1.5/umd/sodo-search.min.js" data-key="4ffb0139d74ada998f4b141e4d" data-styles="https://cdn.jsdelivr.net/ghost/sodo-search@~1.5/umd/main.css" data-sodo-search="https://cisco-talos-blog.ghost.io/" data-locale="en" crossorigin="anonymous"></script> <link href="https://blog.talosintelligence.com/webmentions/receive/" rel="webmention"> <script defer src="/public/cards.min.js?v=bd37905eab"></script><style>:root {--ghost-accent-color: #006db6;}</style> <link rel="stylesheet" type="text/css" href="/public/cards.min.css?v=bd37905eab"> <style type='text/css'> img[src*="icon_check_white.svg"] { width: 20px; margin-left: 0px; margin-right: auto; } #ghost-portal-root { display: none; } </style>  <script async src="https://www.googletagmanager.com/gtag/js?id=G-F45RVJG3BK"></script> <script> window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-F45RVJG3BK'); </script> </head> <body class="author-template author-muhammad"> <div id="mobile-page-header" class="desktop-hide"> <h1>Cisco Talos Blog</h1> </div> <nav id="nav"> <input id="nav-trigger" class="nav-trigger" type="checkbox"/> <label for="nav-trigger"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="22px" height="16px" viewBox="0 0 22 16"> <g id="menu-icon"> <path fill="#FFFFFF" d="M20.5,3h-19C0.672,3,0,2.329,0,1.5S0.672,0,1.5,0h19C21.328,0,22,0.671,22,1.5S21.328,3,20.5,3z"></path> <path fill="#FFFFFF" d="M20.5,9.5h-19C0.672,9.5,0,8.828,0,8c0-0.829,0.672-1.5,1.5-1.5h19C21.328,6.5,22,7.171,22,8 C22,8.828,21.328,9.5,20.5,9.5z"></path> <path fill="#FFFFFF" d="M20.5,16h-19C0.672,16,0,15.328,0,14.5S0.672,13,1.5,13h19c0.828,0,1.5,0.672,1.5,1.5S21.328,16,20.5,16z"></path> </g> </svg> </label> <div id="top-nav-bar"> </div> <div id="navigation"> <div class="navigation-logos-wrapper"> <div id="talos-logo-wrapper"> <a class="navbar-brand" href="https://talosintelligence.com"> </a> </div> </div> <div class="navigation-links-wrapper"> <ul class="main-nav-list"> <li class="nav-item"> <div class="primary-link-wrapper"> <a class="primary_nav_link" href="https://talosintelligence.com/reputation"> <div class="mobile-nav-icon"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Layer_1" x="0px" y="0px" viewBox="0 0 20 20" height="20px" width="20px" style="enable-background:new 0 0 20 20;" xml:space="preserve"> <style type="text/css"> .white{fill:#FFFFFF;} </style> <g> <path class="white" d="M19.5,9.5h-1.1c-0.3-4.2-3.6-7.6-7.8-7.8V0.5C10.5,0.2,10.3,0,10,0l0,0C9.7,0,9.5,0.2,9.5,0.5l0,0v1.1 C5.3,1.9,1.9,5.3,1.6,9.5H0.5C0.2,9.5,0,9.7,0,10s0.2,0.5,0.5,0.5l0,0h1.1c0.3,4.2,3.6,7.6,7.8,7.8v1.1c0,0.3,0.2,0.5,0.5,0.5l0,0 c0.3,0,0.5-0.2,0.5-0.5l0,0v-1.1c4.2-0.3,7.6-3.6,7.8-7.8h1.1c0.3,0,0.5-0.2,0.5-0.5C20,9.7,19.8,9.5,19.5,9.5 M16.6,10.5h0.7 c-0.3,3.6-3.2,6.5-6.8,6.8v-0.8c0-0.3-0.2-0.5-0.5-0.5l0,0c-0.3,0-0.5,0.2-0.5,0.5v0.8C5.8,17,3,14.2,2.7,10.5h0.8 C3.8,10.5,4,10.3,4,10S3.8,9.5,3.5,9.5l0,0H2.7C3,5.8,5.8,3,9.5,2.7v0.8C9.5,3.7,9.7,4,10,4l0,0c0.3,0,0.5-0.2,0.5-0.5V2.7 C14.2,3,17,5.8,17.3,9.5h-0.7c-0.3,0-0.5,0.2-0.5,0.5C16.1,10.3,16.3,10.5,16.6,10.5L16.6,10.5"></path> <circle class="white" cx="10" cy="10" r="3.2"></circle> </g> </svg> </div> <span class="top-nav-link-text"> Intelligence Center </span> </a> </div> <input class="sub-nav-trigger" id="intelligence-sub-trigger" type="checkbox"> <label class="sub-nav-trigger-label" for="intelligence-sub-trigger"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="48.167px" height="47.75px" viewBox="0 0 48.167 47.75"> <circle opacity="0.4" fill="none" stroke="#FFFFFF" stroke-miterlimit="10" cx="24.083" cy="23.875" r="22"></circle> <g> <circle fill="#FFFFFF" cx="24.083" cy="16.068" r="2.496"></circle> <circle fill="#FFFFFF" cx="24.083" cy="23.875" r="2.496"></circle> <circle fill="#FFFFFF" cx="24.083" cy="31.682" r="2.496"></circle> </g> </svg> </label> <ul class="sub-nav sub-nav-single-list"> <li class="desktop-hide"> <a class="mobile_nav_link" href="https://talosintelligence.com/reputation"><h1>Intelligence Center</h1> </a></li> <li class="desktop-hide"> <label class="subnav-back-button" for="intelligence-sub-trigger">BACK</label> </li> <li><a class="secondary_nav_link" href="https://talosintelligence.com/reputation_center">Intelligence Search</a></li> <li><a class="secondary_nav_link" href="https://talosintelligence.com/reputation_center/email_rep">Email & Spam Trends</a></li> </ul> <div class="desktop-hide subnav-overlay"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Layer_1" x="0px" y="0px" viewBox="0 0 20 20" height="20px" width="20px" style="enable-background:new 0 0 20 20;" xml:space="preserve"> <style type="text/css"> .white{fill:#FFFFFF;} </style> <g> <path class="white" d="M19.5,9.5h-1.1c-0.3-4.2-3.6-7.6-7.8-7.8V0.5C10.5,0.2,10.3,0,10,0l0,0C9.7,0,9.5,0.2,9.5,0.5l0,0v1.1 C5.3,1.9,1.9,5.3,1.6,9.5H0.5C0.2,9.5,0,9.7,0,10s0.2,0.5,0.5,0.5l0,0h1.1c0.3,4.2,3.6,7.6,7.8,7.8v1.1c0,0.3,0.2,0.5,0.5,0.5l0,0 c0.3,0,0.5-0.2,0.5-0.5l0,0v-1.1c4.2-0.3,7.6-3.6,7.8-7.8h1.1c0.3,0,0.5-0.2,0.5-0.5C20,9.7,19.8,9.5,19.5,9.5 M16.6,10.5h0.7 c-0.3,3.6-3.2,6.5-6.8,6.8v-0.8c0-0.3-0.2-0.5-0.5-0.5l0,0c-0.3,0-0.5,0.2-0.5,0.5v0.8C5.8,17,3,14.2,2.7,10.5h0.8 C3.8,10.5,4,10.3,4,10S3.8,9.5,3.5,9.5l0,0H2.7C3,5.8,5.8,3,9.5,2.7v0.8C9.5,3.7,9.7,4,10,4l0,0c0.3,0,0.5-0.2,0.5-0.5V2.7 C14.2,3,17,5.8,17.3,9.5h-0.7c-0.3,0-0.5,0.2-0.5,0.5C16.1,10.3,16.3,10.5,16.6,10.5L16.6,10.5"></path> <circle class="white" cx="10" cy="10" r="3.2"></circle> </g> </svg> </div> </li> <li class="nav-item"> <div class="primary-link-wrapper"> <a class="primary_nav_link" href="https://talosintelligence.com/vulnerability_info"><div class="mobile-nav-icon"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="26px" height="20px" viewBox="0 0 26 20"> <g id="vuln-icon" class="nav-icon"> <path fill="#FFFFFF" d="M24.256,18.49L13.872,0.503C13.692,0.192,13.36,0,13,0c-0.359,0-0.692,0.192-0.872,0.503L1.744,18.49 c-0.18,0.312-0.18,0.695,0,1.006C1.924,19.809,2.257,20,2.616,20h20.769c0.359,0,0.691-0.191,0.871-0.504 C24.436,19.186,24.436,18.803,24.256,18.49 M14.268,18.215h-2.533v-1.85h2.533V18.215z M14.268,15.441h-2.533L10.89,6.515h4.222 L14.268,15.441z"></path> </g> </svg> </div> <span class="top-nav-link-text"> Vulnerability Research </span> </a></div> <input class="sub-nav-trigger" id="vuln-sub-trigger" type="checkbox"> <label class="sub-nav-trigger-label" for="vuln-sub-trigger"> <div class="mobile-nav-icon"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="48.167px" height="47.75px" viewBox="0 0 48.167 47.75"> <circle opacity="0.4" fill="none" stroke="#FFFFFF" stroke-miterlimit="10" cx="24.083" cy="23.875" r="22"></circle> <g> <circle fill="#FFFFFF" cx="24.083" cy="16.068" r="2.496"></circle> <circle fill="#FFFFFF" cx="24.083" cy="23.875" r="2.496"></circle> <circle fill="#FFFFFF" cx="24.083" cy="31.682" r="2.496"></circle> </g> </svg> </div> </label> <ul class="sub-nav sub-nav-single-list"> <li class="desktop-hide"> <a href="https://talosintelligence.com/vulnerability_info"><h1>Vulnerability Information</h1> </a></li> <li class="desktop-hide"> <label class="subnav-back-button" for="vuln-sub-trigger">BACK</label> </li> <li><a class="vulnerabilty-info-nav-link" href="https://talosintelligence.com/vulnerability_reports">Vulnerability Reports</a></li> <li><a class="vulnerabilty-info-nav-link" href="https://talosintelligence.com/ms_advisories">Microsoft Advisories</a></li> </ul> <div class="desktop-hide subnav-overlay"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="26px" height="20px" viewBox="0 0 26 20"> <g id="vuln-icon" class="nav-icon"> <path fill="#FFFFFF" d="M24.256,18.49L13.872,0.503C13.692,0.192,13.36,0,13,0c-0.359,0-0.692,0.192-0.872,0.503L1.744,18.49 c-0.18,0.312-0.18,0.695,0,1.006C1.924,19.809,2.257,20,2.616,20h20.769c0.359,0,0.691-0.191,0.871-0.504 C24.436,19.186,24.436,18.803,24.256,18.49 M14.268,18.215h-2.533v-1.85h2.533V18.215z M14.268,15.441h-2.533L10.89,6.515h4.222 L14.268,15.441z"></path> </g> </svg> </div> </li> <li class="nav-item"> <a class="primary_nav_link" href="https://talosintelligence.com/incident_response"> <div class="mobile-nav-icon"> <svg xmlns="http://www.w3.org/2000/svg" width="111.588" height="148.311" viewBox="0 0 111.588 148.311"> <path d="M1.181,128.446v15.7a4.167,4.167,0,0,0,4.167,4.167h100.9a4.167,4.167,0,0,0,4.167-4.167v-15.7a4.167,4.167,0,0,0-4.167-4.167H5.348a4.167,4.167,0,0,0-4.167,4.166M55.8,63.109a3.277,3.277,0,1,1,0,6.553c-10.344,0-20.755,8.578-20.755,18.57a3.277,3.277,0,1,1-6.554,0C28.489,73.947,41.93,63.109,55.8,63.109Zm0-12.016c-21.787,0-39.325,17.81-39.325,39.937v26.7H95.122V91.03c0-22.128-17.537-39.937-39.324-39.937m52.365-38.3a3.291,3.291,0,0,0-2.254,1.024L88.432,31.294a3.283,3.283,0,0,0,4.642,4.644l17.478-17.479a3.278,3.278,0,0,0-2.389-5.666m-105.138,0a3.276,3.276,0,0,0-1.98,5.666L18.522,35.938a3.283,3.283,0,0,0,4.643-4.644L5.687,13.817A3.255,3.255,0,0,0,3.025,12.793ZM55.389.026a3.276,3.276,0,0,0-2.867,3.345V19.642a3.277,3.277,0,1,0,6.554,0V3.371A3.283,3.283,0,0,0,55.389.026Z" fill="#fff"></path> </svg> </div> <span class="top-nav-link-text"> Incident Response </span> </a> </li> <li class="nav-item"> <a class="primary_nav_link" href="https://blog.talosintelligence.com"> <div class="mobile-nav-icon"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Layer_1" x="0px" y="0px" width="260px" height="296.5px" viewBox="0 0 260 296.5" enable-background="new 0 0 260 296.5" xml:space="preserve"> <path fill="#FFFFFF" d="M243.586,42.404h-14.448c-0.943-4.513-3.143-8.813-6.616-12.33L201.793,9.098 c-4.7-4.757-10.972-7.377-17.66-7.377c-6.578,0-12.777,2.547-17.457,7.173l-33.875,33.511H17.586c-6.6,0-12,5.399-12,12V226.28 c0,6.6,5.4,12,12,12H153.83l84.21,56.278l-27.448-56.278h32.994c6.6,0,12-5.4,12-12V54.404 C255.586,47.804,250.186,42.404,243.586,42.404z M214.662,48.045c-0.01,0.2-0.021,0.399-0.044,0.599 c-0.008,0.069-0.021,0.139-0.031,0.207c-0.046,0.345-0.113,0.688-0.196,1.026c-0.034,0.137-0.063,0.273-0.103,0.408 c-0.039,0.135-0.087,0.267-0.133,0.399c-0.051,0.151-0.102,0.302-0.16,0.45c-0.049,0.126-0.105,0.249-0.16,0.373 c-0.068,0.153-0.139,0.307-0.216,0.457c-0.059,0.116-0.12,0.23-0.184,0.345c-0.088,0.157-0.181,0.312-0.278,0.465 c-0.065,0.104-0.13,0.206-0.2,0.308c-0.115,0.168-0.239,0.33-0.366,0.492c-0.064,0.081-0.124,0.165-0.19,0.244 c-0.199,0.238-0.409,0.472-0.635,0.694L82.458,182.308l-47.932,12.871l13.427-47.74L177.223,19.561 c1.917-1.895,4.414-2.84,6.911-2.84c2.534,0,5.068,0.975,6.99,2.92l20.726,20.974c0.545,0.552,1.002,1.156,1.39,1.79 c0.574,0.938,0.975,1.951,1.206,2.993c0.004,0.021,0.01,0.04,0.014,0.06c0.049,0.226,0.086,0.453,0.119,0.682 c0.008,0.06,0.017,0.118,0.024,0.178c0.026,0.211,0.045,0.424,0.058,0.636c0.004,0.077,0.007,0.153,0.009,0.23 c0.007,0.203,0.011,0.407,0.005,0.61C214.673,47.877,214.666,47.961,214.662,48.045z"></path> </svg> </div> <span class="top-nav-link-text">Blog</span> </a> </li> <li class="nav-item"> <a class="primary_nav_link" href="https://support.talosintelligence.com"> <div class="mobile-nav-icon"> <svg xmlns="http://www.w3.org/2000/svg" width="26px" height="20px" viewBox="0 0 123.17 159.292"> <path d="M61.59,0,0,17.069v85.32c0,23.472,61.59,56.9,61.59,56.9s61.58-36.288,61.58-56.9V17.069Zm-.433,149.746C38.314,136.662,8.128,114.3,8.128,102.389V23.239l53.029-14.7Z" fill="#fff"></path> </svg> </div> <span class="top-nav-link-text">Support</span> </a> </li> </ul>    <ul class="secondary-nav-list"> <div class="more-desktop-link"> <div class="more-link-wrapper"> <span class="more-nav-link"> <div class="desktop-nav-icon more-menu-icon"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="22px" height="16px" viewBox="0 0 22 16"> <g id="menu-icon"> <path fill="#FFFFFF" d="M20.5,3h-19C0.672,3,0,2.329,0,1.5S0.672,0,1.5,0h19C21.328,0,22,0.671,22,1.5S21.328,3,20.5,3z"></path> <path fill="#FFFFFF" d="M20.5,9.5h-19C0.672,9.5,0,8.828,0,8c0-0.829,0.672-1.5,1.5-1.5h19C21.328,6.5,22,7.171,22,8 C22,8.828,21.328,9.5,20.5,9.5z"></path> <path fill="#FFFFFF" d="M20.5,16h-19C0.672,16,0,15.328,0,14.5S0.672,13,1.5,13h19c0.828,0,1.5,0.672,1.5,1.5S21.328,16,20.5,16z"></path> </g> </svg> </div> <span class="top-nav-link-text top-nav-more-text"> More </span> </span> </div> </div> <li class="nav-item more-text-link"> <div class="more-link-wrapper more-link-wrapper-mobile"> <span class="more-nav-link"> <div class="mobile-nav-icon"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Layer_1" x="0px" y="0px" viewBox="0 0 20 20" style="enable-background:new 0 0 20 20;" width="25px" height="25px" xml:space="preserve"> <style type="text/css"> .white{fill:#FFFFFF;} </style> <path class="white" d="M19.4,17.1c0,0.1-0.1,0-0.2,0c0,0-1.3-0.9-2-1.4c-0.2-0.1-0.5-0.1-0.6,0.1c-0.3,0.3-0.6,0.8-0.9,1.3 c-0.1,0.2-0.1,0.5,0.1,0.6l2,1.5c0.1,0,0,0.1,0.1,0.2c0,0.1,0,0.1-0.1,0.2c-1.2,0.5-2.6,0.2-3.5-0.7c-0.8-0.9-1-2-0.7-3.1L4.5,6.5 c-1,0.3-2.3,0-3-0.9c-0.8-0.9-1.1-1.7-1-2.7c0-0.1,0-0.1,0.1-0.2c0.1,0,0.2,0.1,0.2,0.1l2,1.5C3,4.4,3.3,4.5,3.4,4.2 c0,0,0.5-0.8,0.9-1.3c0.1-0.2,0.1-0.5-0.1-0.6L2.3,0.9c-0.1,0,0-0.1-0.1-0.3c0-0.1,0-0.1,0.1-0.2C3.5-0.1,5,0.2,5.8,1.1 c0.8,0.9,1,2,0.7,3.1l9.1,9.3c1-0.3,2.3,0,3,0.9c0.7,0.7,0.9,1.5,0.9,2.5C19.5,16.9,19.5,17,19.4,17.1z"></path> </svg> </div> <span class="top-nav-link-text top-nav-more-text"> Security Resources </span> </span> </div> <input class="sub-nav-trigger" id="security-resources-sub-trigger" type="checkbox"> <label class="sub-nav-trigger-label" for="security-resources-sub-trigger"> <div class="mobile-nav-icon"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="48.167px" height="47.75px" viewBox="0 0 48.167 47.75"> <circle opacity="0.4" fill="none" stroke="#FFFFFF" stroke-miterlimit="10" cx="24.083" cy="23.875" r="22"></circle> <g> <circle fill="#FFFFFF" cx="24.083" cy="16.068" r="2.496"></circle> <circle fill="#FFFFFF" cx="24.083" cy="23.875" r="2.496"></circle> <circle fill="#FFFFFF" cx="24.083" cy="31.682" r="2.496"></circle> </g> </svg> </div> </label> <div class="sub-nav sub-nav-multiple-list sub-nav-multiple-list-left"> <div class="sub-nav-multiple-wrapper"> <div class="sub-nav-list-top-of-mobile-wrapper"> <h1 class="sub-nav-list-header sub-nav-list-top-of-mobile">Security Resources</h1> <ul class="sub-nav-list"> <li class="desktop-hide"> <label class="subnav-back-button" for="security-resources-sub-trigger">BACK</label> </li> </ul> </div> <div class="sub-nav-list-item-wrapper"> <span class="sub-nav-desktop-header uppercase">Security Resources</span> <ul class="sub-nav-list"> <li> <a href="https://talosintelligence.com/software"><span>Open Source Security Tools</span> </a></li> <li> <a href="https://talosintelligence.com/categories"><span>Intelligence Categories Reference</span> </a></li> <li> <a href="https://talosintelligence.com/secure-endpoint-naming"><span>Secure Endpoint Naming Reference</span> </a></li> </ul> </div> </div> </div> <div class="desktop-hide subnav-overlay"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Layer_1" x="0px" y="0px" viewBox="0 0 20 20" style="enable-background:new 0 0 20 20;" width="25px" height="25px" xml:space="preserve"> <style type="text/css"> .white{fill:#FFFFFF;} </style> <path class="white" d="M19.4,17.1c0,0.1-0.1,0-0.2,0c0,0-1.3-0.9-2-1.4c-0.2-0.1-0.5-0.1-0.6,0.1c-0.3,0.3-0.6,0.8-0.9,1.3 c-0.1,0.2-0.1,0.5,0.1,0.6l2,1.5c0.1,0,0,0.1,0.1,0.2c0,0.1,0,0.1-0.1,0.2c-1.2,0.5-2.6,0.2-3.5-0.7c-0.8-0.9-1-2-0.7-3.1L4.5,6.5 c-1,0.3-2.3,0-3-0.9c-0.8-0.9-1.1-1.7-1-2.7c0-0.1,0-0.1,0.1-0.2c0.1,0,0.2,0.1,0.2,0.1l2,1.5C3,4.4,3.3,4.5,3.4,4.2 c0,0,0.5-0.8,0.9-1.3c0.1-0.2,0.1-0.5-0.1-0.6L2.3,0.9c-0.1,0,0-0.1-0.1-0.3c0-0.1,0-0.1,0.1-0.2C3.5-0.1,5,0.2,5.8,1.1 c0.8,0.9,1,2,0.7,3.1l9.1,9.3c1-0.3,2.3,0,3,0.9c0.7,0.7,0.9,1.5,0.9,2.5C19.5,16.9,19.5,17,19.4,17.1z"></path> </svg> </div> </li> <li class="nav-item"> <div class="more-link-wrapper more-link-wrapper-mobile"> <span class="more-nav-link"> <div class="mobile-nav-icon"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Layer_1" x="0px" y="0px" viewBox="0 0 20 20" width="25px" height="25px" style="enable-background:new 0 0 20 20;" xml:space="preserve"> <style type="text/css"> .sticoncomment{fill-rule:evenodd;clip-rule:evenodd;fill:#FFFFFF;} </style> <path class="sticoncomment" d="M13.6,7.1H6.4c-0.3,0-0.6-0.3-0.6-0.6c0-0.3,0.3-0.6,0.6-0.6l7.2,0c0.3,0,0.6,0.3,0.6,0.6 C14.2,6.8,13.9,7.1,13.6,7.1L13.6,7.1z M13.6,9.4H6.4c-0.3,0-0.6-0.3-0.6-0.6s0.3-0.6,0.6-0.6l7.2,0c0.3,0,0.6,0.3,0.6,0.6 C14.2,9.2,13.9,9.4,13.6,9.4L13.6,9.4z M11.5,11.7H6.4c-0.3,0-0.6-0.3-0.6-0.6c0-0.3,0.3-0.6,0.6-0.6h5.1c0.3,0,0.6,0.3,0.6,0.6 C12.1,11.5,11.8,11.7,11.5,11.7z M15.8,3H4.2C3.5,3,3,3.5,3,4.2V17l2.8-2.3h10c0.6,0,1.2-0.5,1.2-1.2V4.2C17,3.5,16.5,3,15.8,3 L15.8,3z"></path> </svg> </div> <span class="top-nav-link-text top-nav-more-text"> Media </span> </span> </div> <input class="sub-nav-trigger" id="media-sub-trigger" type="checkbox"> <label class="sub-nav-trigger-label" for="media-sub-trigger"> <div class="mobile-nav-icon"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="48.167px" height="47.75px" viewBox="0 0 48.167 47.75"> <circle opacity="0.4" fill="none" stroke="#FFFFFF" stroke-miterlimit="10" cx="24.083" cy="23.875" r="22"></circle> <g> <circle fill="#FFFFFF" cx="24.083" cy="16.068" r="2.496"></circle> <circle fill="#FFFFFF" cx="24.083" cy="23.875" r="2.496"></circle> <circle fill="#FFFFFF" cx="24.083" cy="31.682" r="2.496"></circle> </g> </svg> </div> </label> <div class="sub-nav sub-nav-multiple-list sub-nav-multiple-list-middle"> <div class="sub-nav-multiple-wrapper"> <div class="sub-nav-list-top-of-mobile-wrapper"> <h1 class="sub-nav-list-header sub-nav-list-top-of-mobile">Media</h1> <ul class="sub-nav-list"> <li class="desktop-hide"> <label class="subnav-back-button" for="media-sub-trigger">BACK</label> </li> </ul> </div> <div class="sub-nav-list-item-wrapper"> <span class="sub-nav-desktop-header uppercase">Media</span> <ul class="sub-nav-list"> <li> <a href="https://blog.talosintelligence.com"><span>Talos Intelligence Blog</span> </a></li> <li> <a href="https://blog.talosintelligence.com/category/threat-source-newsletter/"><span>Threat Source Newsletter</span> </a></li> <li> <a href="https://talosintelligence.com/podcasts/shows/beers_with_talos"><span>Beers with Talos Podcast</span> </a></li> <li> <a href="https://talosintelligence.com/podcasts/shows/talos_takes"><span>Talos Takes Podcast</span> </a></li> <li> <a target="_blank" href="https://www.youtube.com/channel/UCPZ1DtzQkStYBSG3GTNoyfg/featured"><span>Talos Videos</span> </a></li> </ul> </div> </div> </div> <div class="desktop-hide subnav-overlay"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="Layer_1" x="0px" y="0px" viewBox="0 0 20 20" width="25px" height="25px" style="enable-background:new 0 0 20 20;" xml:space="preserve"> <style type="text/css"> .sticoncomment{fill-rule:evenodd;clip-rule:evenodd;fill:#FFFFFF;} </style> <path class="sticoncomment" d="M13.6,7.1H6.4c-0.3,0-0.6-0.3-0.6-0.6c0-0.3,0.3-0.6,0.6-0.6l7.2,0c0.3,0,0.6,0.3,0.6,0.6 C14.2,6.8,13.9,7.1,13.6,7.1L13.6,7.1z M13.6,9.4H6.4c-0.3,0-0.6-0.3-0.6-0.6s0.3-0.6,0.6-0.6l7.2,0c0.3,0,0.6,0.3,0.6,0.6 C14.2,9.2,13.9,9.4,13.6,9.4L13.6,9.4z M11.5,11.7H6.4c-0.3,0-0.6-0.3-0.6-0.6c0-0.3,0.3-0.6,0.6-0.6h5.1c0.3,0,0.6,0.3,0.6,0.6 C12.1,11.5,11.8,11.7,11.5,11.7z M15.8,3H4.2C3.5,3,3,3.5,3,4.2V17l2.8-2.3h10c0.6,0,1.2-0.5,1.2-1.2V4.2C17,3.5,16.5,3,15.8,3 L15.8,3z"></path> </svg> </div> </li> <li class="nav-item"> <div class="more-link-wrapper more-link-wrapper-mobile"> <span class="more-nav-link"> <div class="mobile-nav-icon"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="25px" height="25px" viewBox="0 0 55 55"> <g> <g class="mobile-nav-home"> <path fill-rule="evenodd" clip-rule="evenodd" fill="#FFFFFF" d="M45.201,12.343c0.378,0.48,0.758,0.925,1.096,1.401 c2.975,4.207,4.543,8.876,4.494,14.044c-0.05,5.452-1.643,10.386-5.186,14.593c-3.484,4.133-7.929,6.73-13.182,7.895 c-6.313,1.398-12.216,0.275-17.695-3.131c-0.441-0.273-0.847-0.6-1.266-0.904c-0.11-0.078-0.208-0.174-0.337-0.287 c0.127-0.141,0.246-0.27,0.366-0.398c0.887-0.949,1.765-1.904,2.663-2.844c0.114-0.119,0.321-0.217,0.485-0.217 c3.658-0.006,7.318,0,10.975,0.008c3.458,0.006,6.913,0.02,10.369,0.02c0.957,0,1.871-0.193,2.62-0.844 c0.797-0.693,1.157-1.596,1.157-2.643c0.001-7.533,0.003-15.067-0.005-22.601c-0.002-0.309,0.088-0.524,0.3-0.743 C43.098,14.598,44.127,13.49,45.201,12.343"></path> <path fill-rule="evenodd" clip-rule="evenodd" fill="#FFFFFF" d="M41.402,8.822c-0.99,1.027-1.994,2.021-2.935,3.072 c-0.312,0.35-0.616,0.416-1.036,0.415c-6.98-0.009-13.957-0.007-20.938-0.007c-2.039,0-3.561,1.514-3.561,3.557 c0,6.504,0.002,13.008,0.006,19.512c0.002,0.973,0.011,1.943,0.004,2.914c0,0.133-0.04,0.301-0.127,0.393 c-1.069,1.162-2.15,2.314-3.229,3.469c-0.021,0.023-0.052,0.039-0.109,0.08c-0.159-0.188-0.323-0.369-0.471-0.562 c-2.535-3.348-4.119-7.102-4.605-11.268c-0.61-5.229,0.194-10.229,2.835-14.839c2.669-4.664,6.655-7.805,11.618-9.75 c3.205-1.257,6.533-1.852,9.977-1.621c4.478,0.298,8.553,1.754,12.227,4.325c0.101,0.072,0.197,0.151,0.291,0.229 C41.364,8.755,41.374,8.778,41.402,8.822"></path> <path fill-rule="evenodd" clip-rule="evenodd" fill="#FFFFFF" d="M39.799,12.47c0.873-0.911,1.749-1.829,2.676-2.797 c0.605,0.564,1.195,1.112,1.816,1.691c-0.941,0.985-1.817,1.903-2.703,2.83c-0.276-0.339-0.511-0.688-0.807-0.975 C40.492,12.941,40.145,12.728,39.799,12.47"></path> <path fill-rule="evenodd" clip-rule="evenodd" fill="#FFFFFF" d="M10.35,43.279c0.969-1.016,1.885-1.977,2.76-2.893 c0.213,0.369,0.376,0.762,0.639,1.072c0.265,0.312,0.627,0.539,0.98,0.832c-0.853,0.891-1.713,1.791-2.624,2.746 C11.513,44.445,10.939,43.869,10.35,43.279"></path> </g> </g> </svg> </div> <span class="top-nav-link-text top-nav-more-text"> Company </span> </span> </div> <input class="sub-nav-trigger" id="company-sub-trigger" type="checkbox"> <label class="sub-nav-trigger-label" for="company-sub-trigger"> <div class="mobile-nav-icon"> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="48.167px" height="47.75px" viewBox="0 0 48.167 47.75"> <circle opacity="0.4" fill="none" stroke="#FFFFFF" stroke-miterlimit="10" cx="24.083" cy="23.875" r="22"></circle> <g> <circle fill="#FFFFFF" cx="24.083" cy="16.068" r="2.496"></circle> <circle fill="#FFFFFF" cx="24.083" cy="23.875" r="2.496"></circle> <circle fill="#FFFFFF" cx="24.083" cy="31.682" r="2.496"></circle> </g> </svg> </div> </label> <div class="sub-nav sub-nav-multiple-list sub-nav-multiple-list-right"> <div class="sub-nav-multiple-wrapper"> <div class="sub-nav-list-top-of-mobile-wrapper"> <h1 class="sub-nav-list-header sub-nav-list-top-of-mobile">Company</h1> <ul class="sub-nav-list"> <li class="desktop-hide"> <label class="subnav-back-button" for="company-sub-trigger">BACK</label> </li> </ul> </div> <div class="sub-nav-list-item-wrapper"> <span class="sub-nav-desktop-header uppercase">Company</span> <ul class="sub-nav-list"> <li> <a href="https://talosintelligence.com/about"><span>About Talos</span> </a></li> <li> <a href="https://talosintelligence.com/careers"><span>Careers</span> </a></li> </ul> </div> </div> </div> <div class="desktop-hide subnav-overlay"><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="25px" height="25px" viewBox="0 0 55 55"> <g> <g class="mobile-nav-home"> <path fill-rule="evenodd" clip-rule="evenodd" fill="#FFFFFF" d="M45.201,12.343c0.378,0.48,0.758,0.925,1.096,1.401 c2.975,4.207,4.543,8.876,4.494,14.044c-0.05,5.452-1.643,10.386-5.186,14.593c-3.484,4.133-7.929,6.73-13.182,7.895 c-6.313,1.398-12.216,0.275-17.695-3.131c-0.441-0.273-0.847-0.6-1.266-0.904c-0.11-0.078-0.208-0.174-0.337-0.287 c0.127-0.141,0.246-0.27,0.366-0.398c0.887-0.949,1.765-1.904,2.663-2.844c0.114-0.119,0.321-0.217,0.485-0.217 c3.658-0.006,7.318,0,10.975,0.008c3.458,0.006,6.913,0.02,10.369,0.02c0.957,0,1.871-0.193,2.62-0.844 c0.797-0.693,1.157-1.596,1.157-2.643c0.001-7.533,0.003-15.067-0.005-22.601c-0.002-0.309,0.088-0.524,0.3-0.743 C43.098,14.598,44.127,13.49,45.201,12.343"></path> <path fill-rule="evenodd" clip-rule="evenodd" fill="#FFFFFF" d="M41.402,8.822c-0.99,1.027-1.994,2.021-2.935,3.072 c-0.312,0.35-0.616,0.416-1.036,0.415c-6.98-0.009-13.957-0.007-20.938-0.007c-2.039,0-3.561,1.514-3.561,3.557 c0,6.504,0.002,13.008,0.006,19.512c0.002,0.973,0.011,1.943,0.004,2.914c0,0.133-0.04,0.301-0.127,0.393 c-1.069,1.162-2.15,2.314-3.229,3.469c-0.021,0.023-0.052,0.039-0.109,0.08c-0.159-0.188-0.323-0.369-0.471-0.562 c-2.535-3.348-4.119-7.102-4.605-11.268c-0.61-5.229,0.194-10.229,2.835-14.839c2.669-4.664,6.655-7.805,11.618-9.75 c3.205-1.257,6.533-1.852,9.977-1.621c4.478,0.298,8.553,1.754,12.227,4.325c0.101,0.072,0.197,0.151,0.291,0.229 C41.364,8.755,41.374,8.778,41.402,8.822"></path> <path fill-rule="evenodd" clip-rule="evenodd" fill="#FFFFFF" d="M39.799,12.47c0.873-0.911,1.749-1.829,2.676-2.797 c0.605,0.564,1.195,1.112,1.816,1.691c-0.941,0.985-1.817,1.903-2.703,2.83c-0.276-0.339-0.511-0.688-0.807-0.975 C40.492,12.941,40.145,12.728,39.799,12.47"></path> <path fill-rule="evenodd" clip-rule="evenodd" fill="#FFFFFF" d="M10.35,43.279c0.969-1.016,1.885-1.977,2.76-2.893 c0.213,0.369,0.376,0.762,0.639,1.072c0.265,0.312,0.627,0.539,0.98,0.832c-0.853,0.891-1.713,1.791-2.624,2.746 C11.513,44.445,10.939,43.869,10.35,43.279"></path> </g> </g> </svg> </div> </li> </ul> <div class="nav-search-wrapper"> <button class="search-button" data-ghost-search> <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2"><path stroke-linecap="round" stroke-linejoin="round" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"></path></svg> </button> </div> </div> </div> </nav> <main id="site-main"> <div class="banner-content-wrapper"> <div class="container"> <div class="row"> <div class="col mt-3"> <h1 class="vertical-center">Muhammad Irshad</h1> </div> </div> </div> </div> <div class="container-fluid banner-bg-container banner-bg-2"> <div class="row"> <div class="col left-bg-2"></div> <div class="col right-bg-2"></div> </div> </div> <div class="container-fluid alt-layout-row px-3 py-5 px-lg-5"> <div class="container"> <div class="row"> <div class="col-12 col-xl-4"> <div class="post-wrapper mb-4"> <div class="row"> <div class="col-12"> <a class="post-card-image-link" href="/a-deep-dive-into-lokibot-infection-chain/" > <img class="post-card-image" alt="" src="/content/images/2023/10/threat-spotlight-1.jpg"/> </a> </div> </div> <div class="row"> <div class="col-12"> <div class="container p-4 pb-5"> <span class="preview-attributes">January 6, 2021 09:00</span> <h2><a href="/a-deep-dive-into-lokibot-infection-chain/" title="A Deep Dive into Lokibot Infection Chain">A Deep Dive into Lokibot Infection Chain</a></h2> <p>Lokibot is one of the most well-known information stealers on the malware landscape. In this post, we'll provide a technical breakdown of one of the latest Lokibot campaigns. Talos also has a new script to unpack the dropper's third stage. The actors behind Lokibot usu</p> <div class="authors-block preview-attributes"> <span> By </span> <a href="https://blog.talosintelligence.com/author/muhammad/">Muhammad Irshad</a>, <a href="https://blog.talosintelligence.com/author/holger-unterbrink/">Holger Unterbrink</a> </div> <div class="tags-block"> </div> </div> </div> </div> </div> </div> </div> <div class="row mb-5"> <div class="col"> <hr/> <nav class="pagination" role="navigation"> <div class="page-nums"> </div> </nav> <script> var pageTotal = parseInt("1"), pageCurrent = parseInt("1"), limitPage = 5, page = 1, pageNums = document.querySelector('.pagination .page-nums'); if(pageCurrent >= limitPage) { page = pageCurrent - 1; pageNums.innerHTML += '<a class="first page-link" href="/author/muhammad/page/' + 1 + '">First</a>'; } for(i = 0; i < limitPage; i++) { if(page === pageCurrent) { pageNums.innerHTML += '<a class="current page-link" href="/author/muhammad/page/1">1</a>'; } else if(page <= pageTotal){ pageNums.innerHTML += '<a class="page-link" href="/author/muhammad/page/' + page + '">' + page + '</a>' } page++; } </script> </div> </div> </div> </div> </main> <footer id="footer"> <div class="row footer_nav_wrapper"> <div class="col-xl-10 col-12"> <div class="multi-col-list-wrapper"> <ul class="footer-parent-list"> <li class="footer-links-group"> <ul> <li> <h6>Intelligence Center</h6> </li> <li><a href="https://talosintelligence.com/reputation_center">Intelligence Search</a></li> <li><a href="https://talosintelligence.com/reputation_center/email_rep">Email & Spam Trends</a></li> </ul> </li> <li class="footer-links-group"> <ul> <li> <h6>Vulnerability Research</h6> </li> <li><a href="https://talosintelligence.com/vulnerability_info">Vulnerability Reports</a></li> <li><a href="https://talosintelligence.com/ms_advisories">Microsoft Advisories</a></li> </ul> </li> <li class="footer-links-group"> <ul> <li> <h6>Incident Response</h6> </li> <li> <a href="https://talosintelligence.com/incident_response">Talos IR Capabilities</a></li> <li> <a href="https://talosintelligence.com/incident_response">Emergency Support</a> </li> </ul> </li> <li class="footer-links-group"> <ul> <li> <h6>Security Resources</h6> </li> <li><a href="https://talosintelligence.com/software">Open Source Security Tools</a></li> <li><a href="https://talosintelligence.com/categories">Intelligence Categories Reference</a></li> <li><a href="https://talosintelligence.com/secure-endpoint-naming">Secure Endpoint Naming Reference</a></li> </ul> </li> <li class="footer-links-group"> <ul> <li> <h6>Media</h6> </li> <li><a href="https://blog.talosintelligence.com">Talos Intelligence Blog</a></li> <li><a href="https://blog.talosintelligence.com/category/threat-source-newsletter/">Threat Source Newsletter</a></li> <li><a href="https://talosintelligence.com/podcasts/shows/beers_with_talos">Beers with Talos Podcast</a></li> <li><a href="https://talosintelligence.com/podcasts/shows/talos_takes">Talos Takes Podcast</a></li> <li><a target="_blank" href="https://www.youtube.com/channel/UCPZ1DtzQkStYBSG3GTNoyfg/featured">Talos Videos</a></li> </ul> </li> <li class="footer-links-group"> <ul> <li> <h6>Support</h6> </li> <li><a href="https://support.talosintelligence.com">Support Documentation</a></li> </ul> </li> <li class="footer-links-group"> <ul> <li> <h6>Company</h6> </li> <li><a href="https://talosintelligence.com/about">About Talos</a></li> <li><a href="https://talosintelligence.com/careers">Careers</a></li> <li><a target="_blank" href="https://www.cisco.com/c/en/us/products/security/product-listing.html">Cisco Security</a></li> </ul> </li> </ul> </div> </div> <div class="col-xl-2 col-12 connect_social"> <div class="connect-footer-section-wrapper"> <h6>Follow us</h6> <ul> <li> <a target="_blank" href="https://x.com/talossecurity"><div class="footer-media-icon" id="footer-media-icon-x"></div> </a></li> <li> <a target="_blank" href="https://www.youtube.com/channel/UCPZ1DtzQkStYBSG3GTNoyfg/featured"><div class="footer-media-icon" id="footer-media-icon-youtube"></div> </a></li> <li> <a target="_blank" href="https://www.linkedin.com/company/cisco-talos-intelligence-group/"><div class="footer-media-icon" id="footer-media-icon-linkedin"></div> </a></li> </ul> </div> </div> </div> <div class="row"> <div class="col-12 footer_corporate"> <a target="_blank" href="http://tools.cisco.com/security/center/home.x"><img alt="Cisco" src="../assets/images/logo_cisco_white.svg"> </a><p class="copyright"> 漏 2024 Cisco Systems, Inc. and/or its affiliates. All rights reserved. View our <a target="_blank" class="underline" href="http://www.cisco.com/web/siteassets/legal/privacy_full.html">Privacy Policy.</a> </p> </div> </div> </footer>  <script src="https://blog.talosintelligence.com/assets/js/jquery-3.6.0.min.js?v=bd37905eab"></script> <script src="https://blog.talosintelligence.com/assets/js/popper.min.js?v=bd37905eab"></script> <script src="https://blog.talosintelligence.com/assets/js/bootstrap.bundle.min.js?v=bd37905eab"></script> <script src="https://blog.talosintelligence.com/assets/js/date.js?v=bd37905eab"></script> <script src="https://blog.talosintelligence.com/assets/js/prism.js?v=bd37905eab"></script> <script src="https://cdn.jsdelivr.net/npm/ghost-theme-utils@latest/dist/js/ghost-theme-utils.min.js" async defer></script> </body> </html>

CINXE.COM

Muhammad Irshad - Cisco Talos Blog