> For the complete documentation index, see [llms.txt](https://blog.securehat.co.uk/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.securehat.co.uk/malware-analysis.md).

# Malware Analysis

- [Tool-Less Extraction of IOCs from an Emotet Maldoc](https://blog.securehat.co.uk/malware-analysis/tool-less-extraction-of-iocs-from-an-emotet-maldoc.md): This blog post covers how to examine and extract the underlying payload from a recent Emotet delivery campaign. We will cover how to use basic dynamic analysis to quickly step over VBA obfuscation.
- [Extracting the Cobalt Strike Config from a TEARDROP Loader](https://blog.securehat.co.uk/malware-analysis/extracting-the-cobalt-strike-config-from-a-teardrop-loader.md): This blog post will cover how to use dynamic analysis to extract the underlying Cobalt Strike config from a recent TEARDROP sample