Malware Analysis Space

Summary From the checkpoint research, the FunkSec ransomware group first emerged publicly in late 2024 and rapidly gained prominence by publishing over 85 claimed victims—more than any other ransomware group in the month of December. I did research with a shared sample.   Technical Analysis   FunkSec Ransomware is named by the binary inside strings “funksec.pdb,” its extension “.funksec,” and ransom note, written in the Rust computer language and run on Windows and compiled in the environment of “C:\\Users\\Abdellah\\.cargo\\...,” with the time date stamp “2024-12-31 20:26:29,” AMD64 Architecture, without a packer. And "This program requires administrator privileges." Figure1-Binary Information Figure2-Ransomware Note Snippet  Like the other ransom group, it generated a special readme file as a ransom note to tell the victim about “stop” and “what happened,” including what the bitcoin wallet address is, how to buy bitcoin, how much bitcoin to pay, and the contac...

  Back to July 22, 2022, I noted that Hive ransomware gets upgrades in Rust by Microsoft Threat Intelligence ( Hive ransomware gets upgrades in Rust | Microsoft Security Blog ). The report mentioned that Unlike in previous variants where there was a  ‘help’  menu, in the new variant, the attacker must know the parameters beforehand. Since all strings are encrypted, it makes finding the parameters challenging for security researchers. Getting the command-line parameters is very challenging for beginners, but recently I wanted to challenge myself. I choose the sample (SHA-256: 33744c420884adf582c46a4b74cbd9c145f2e15a036bb1e557e89d6fd428e724 ) to debug. The sample won’t continue its execution , but it will also tell key information to the analyst. The first thing is the sample has to handle input from the user. the second thing it prints is an error Figure 1 – Without a username and a password, the sample won’t continue its execution The sample uses the function...