Malware Analysis Space

  Summary   The PowerShell for writing malicious code is a normal way, and in the past, usually PowerShell itself was played as a supporting role, like executing cmdlets or loaders, but the trend is now to be changed. To make a ransomware, totally with pure PowerShell, is never seen before, and recently many samples were discovered, which attracted me to learn from what happened.   Technique analysis   The PowerShell ransomware samples have the same abilities, such as deleting shadows, stopping interfering processes, disabling the defender, spreading to the network, and adding registry persistence, and so on; the whole thing is done by the only PowerShell.   Third party software encryption scheme One of the PowerShell ransomware is to utilize third-party encrypt free software called VeraCrypt to help encrypt the data of the drive; it will download from the remote address https[:]//Launchpad[.]net/veracrypt/trunk/1.25.9/+download/VeraCrypt_Setup...

Summary   First thanks for Szabolcs Schmidt was calling global malware analysts to analysis the samples on X, I’m really appreciate his work and he is helping to make cybersecurity more safer and stronger. In this report, I do plan to dive deep into more details of the advanced Trojan dropper; it looks like obfuscation mechanisms, but until now, their true intentions have been unknown. The Trojan dropper is very intriguing and different from other APT groups. If you are keen to learn from the latest and related report, please click here .   Technical analysis   Basic info The sample hashs: md5 A699AFD908E0DEC5C96FF7188450B89F Sha256 f18631344d6f7fc57fd248edce37baeb11976e315b72b68d48311c406ace3f8c   Operation system: Operation system: Windows(95)[I386, 32-bit, GUI] (Heur)Packer: Packer detected[High entropy + Section 1 (".data") compressed]     Advanced string obfuscation Mechanisms? The strings in the malware Trojan d...

  Summary   First thanks for  Szabolcs Schmidt  was calling global malware analysts to analysis the samples on X, I’m really appreciate his work and he is helping to make cybersecurity more safer and stronger, I have no other words, you are doing an amazing work. Abuse.ch's Malware Bazaar  is an excellent platform for sharing and analyzing malware samples. By contributing to the community, I’m helping to improve global cybersecurity defenses and I’ve uploaded the sample to share.   In this report, I do not plan to dive deep into all the details of the technique, but it is possible to make it up when having enough time to analyze; I would like to do that. In fact, it will learn more when diving deeper into the malware itself.     Technical analysis   Basic info   The sample hashs: md5 A699AFD908E0DEC5C96FF7188450B89F Sha256 f18631344d6f7fc57fd248edce37baeb11976e315b72b68d48311c406ace3f8c   Operation s...

  Summary UAC-0173 is a threat actor group known for targeting Ukrainian organizations with sophisticated malware campaigns. One of their preferred tools is  AsyncRAT . This report explores the antivirus detection and evasion techniques used by UAC-0173 in their AsyncRAT campaigns, providing insights into how defenders can detect. Abuse.ch's Malware Bazaar  is an excellent platform for sharing and analyzing malware samples. By contributing to the community, I’m helping to improve global cybersecurity defenses and I’ve uploaded the sample to share.     Technical analysis   Basic info The sample hashs: md5 e9cedc98677b6b5146b14009ced7d624 Sha1 1b6e14e578c613932496bfd49c616760bdceb2c1   Operation system: Windows (I386, 32-bit, EXEC] Packer: no     Deploy main abilities This client program, like other RATs, has its main abilities: checking VMs or sandboxes, killing processes, privilege escalation, and so on. The...