Malware Analysis Space

  Summary   The PowerShell for writing malicious code is a normal way, and in the past, usually PowerShell itself was played as a supporting role, like executing cmdlets or loaders, but the trend is now to be changed. To make a ransomware, totally with pure PowerShell, is never seen before, and recently many samples were discovered, which attracted me to learn from what happened.   Technique analysis   The PowerShell ransomware samples have the same abilities, such as deleting shadows, stopping interfering processes, disabling the defender, spreading to the network, and adding registry persistence, and so on; the whole thing is done by the only PowerShell.   Third party software encryption scheme One of the PowerShell ransomware is to utilize third-party encrypt free software called VeraCrypt to help encrypt the data of the drive; it will download from the remote address https[:]//Launchpad[.]net/veracrypt/trunk/1.25.9/+download/VeraCrypt_Setup...

  Summary   As we know, using obfuscated VBScript to execute obfuscated PowerShell  is a common technique in malware to evade detection and complicate analysis. This approach leverages the strengths of both scripting languages while making it harder for security tools and analysts to understand the malicious intent.   Recently I came across a malware that is very well-designed for these obfuscation techniques to use, which is so interesting and attracted my curiosity to learn more about what’s happened inside the malware, and it was also low detection rate until first discovered.   Below, I would like to share how the attackers use VBScript and PowerShell to evade detection, maybe it can help other malware researchers or analysts, and the common technique but new doing uncommon which being talked on both VBScript obfuscation and PowerShell obfuscation.     Technical analysis   Basic info The sample hashs: md5 0e513e80fc18...

  Summary From the AhnLab SEcurity intelligence Center (ASEC) I noted that Theft of Web Browser Information (forceCopy) which malware are PowerShell scripts, and I have collected three malwares, they have similar design, I choose one of them to analysis. The design of the PowerShell script used by obfuscation technology from Kimsuky is worthy of more attention, especially nowadays as AI is developing fast; it makes malware makers and analysts more easily able to do their jobs.   Technical analysis This forceCopy is the PowerShell (executable). The hash MD5: 1e9d94d88fdac3c4a0a47a3a1d07e329   The source code is difficult to read, so I did it manually and made it easy to read. These codes are a small part of them. 1.  It  defines a function (stored in the variable  $mqtz60 ) that takes an array of strings ( $vvv32 ) as input; 2. For each string in the array, it decodes the string from Base64,  converts the resulting  byte array to a string and ...