Malware Analysis Space

  Summary   As we know, using obfuscated VBScript to execute obfuscated PowerShell  is a common technique in malware to evade detection and complicate analysis. This approach leverages the strengths of both scripting languages while making it harder for security tools and analysts to understand the malicious intent.   Recently I came across a malware that is very well-designed for these obfuscation techniques to use, which is so interesting and attracted my curiosity to learn more about what’s happened inside the malware, and it was also low detection rate until first discovered.   Below, I would like to share how the attackers use VBScript and PowerShell to evade detection, maybe it can help other malware researchers or analysts, and the common technique but new doing uncommon which being talked on both VBScript obfuscation and PowerShell obfuscation.     Technical analysis   Basic info The sample hashs: md5 0e513e80fc18...

Summary   First thanks for Szabolcs Schmidt was calling global malware analysts to analysis the samples on X, I’m really appreciate his work and he is helping to make cybersecurity more safer and stronger. In this report, I do plan to dive deep into more details of the advanced Trojan dropper; it looks like obfuscation mechanisms, but until now, their true intentions have been unknown. The Trojan dropper is very intriguing and different from other APT groups. If you are keen to learn from the latest and related report, please click here .   Technical analysis   Basic info The sample hashs: md5 A699AFD908E0DEC5C96FF7188450B89F Sha256 f18631344d6f7fc57fd248edce37baeb11976e315b72b68d48311c406ace3f8c   Operation system: Operation system: Windows(95)[I386, 32-bit, GUI] (Heur)Packer: Packer detected[High entropy + Section 1 (".data") compressed]     Advanced string obfuscation Mechanisms? The strings in the malware Trojan d...

  Summary   First thanks for  Szabolcs Schmidt  was calling global malware analysts to analysis the samples on X, I’m really appreciate his work and he is helping to make cybersecurity more safer and stronger, I have no other words, you are doing an amazing work. Abuse.ch's Malware Bazaar  is an excellent platform for sharing and analyzing malware samples. By contributing to the community, I’m helping to improve global cybersecurity defenses and I’ve uploaded the sample to share.   In this report, I do not plan to dive deep into all the details of the technique, but it is possible to make it up when having enough time to analyze; I would like to do that. In fact, it will learn more when diving deeper into the malware itself.     Technical analysis   Basic info   The sample hashs: md5 A699AFD908E0DEC5C96FF7188450B89F Sha256 f18631344d6f7fc57fd248edce37baeb11976e315b72b68d48311c406ace3f8c   Operation s...