Malware Analysis Space

  Summary   The PowerShell for writing malicious code is a normal way, and in the past, usually PowerShell itself was played as a supporting role, like executing cmdlets or loaders, but the trend is now to be changed. To make a ransomware, totally with pure PowerShell, is never seen before, and recently many samples were discovered, which attracted me to learn from what happened.   Technique analysis   The PowerShell ransomware samples have the same abilities, such as deleting shadows, stopping interfering processes, disabling the defender, spreading to the network, and adding registry persistence, and so on; the whole thing is done by the only PowerShell.   Third party software encryption scheme One of the PowerShell ransomware is to utilize third-party encrypt free software called VeraCrypt to help encrypt the data of the drive; it will download from the remote address https[:]//Launchpad[.]net/veracrypt/trunk/1.25.9/+download/VeraCrypt_Setup...

Summary This is the head part of the Akira ransom note, and it claims: Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.   Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources.   As you know, recently ransomware has become so popular, and threat actors further expanded the attack surface to Linux. In 2023, I had collected many ransomwares that run on Linux and posted them to X (formerly Twitter), and last week I noted Akira ransom gang. I am very curious about what happened one year later.     Technical analysis   Basic info The samp...

  Summary The below ransomware d0glun was first submitted on 2025-01-16; it is worth paying more attention to because his motivation is low confidence.   Analysis   The details of the D0glun ransomware are as follows: it displays the private information “QQ424714982 TG@CXL13131,” the product name is 8180VPN, and the product version is 1.0.0.0. Figure1-Details of file   A text file for warning displays on the desktop, which tells the victim what date and time they were infected by ransomware. Figure2-a warn text on the desktop   On the screen, a text ransom note tells the victim what types of files will be encrypted; this is different from the other ransom group and how to recover and contact the attacker and leave the address of the dark site but without requiring any bitcoin. Figure3-ransom notes   Different types of files use different suffixes, which are not very common. Figure4-different suffix The other windows are used for decryp...