Malware Analysis Space

  Summary   Back to December 26, 2024, FortiGuard Labs noticed a new variant called "FICORA" frequently spread through documented D-Link vulnerabilities that allow remote attackers to execute malicious commands like downloading malware, brute force attacks, and DDoS flooding attacks on victim hosts.   Analysis   Why call the botnet named “FICORA”? FICORA bot named from malware inside strings Figure1- special strings   The shell script executes multiple strategies , such as wget, ftpget, tftp, and curl, to get malware FICORA. Figure2-downloader with multiple strategies for get malware     The shell script kills all processes with the same file extension. Figure3-downloader with kill -9 command   The shell script tries to find and kill any process containing the keyword “dvrHelper,” which can decode from hex to strings; below is a small part. Figure4- malware inside hexadecimal script Figure5- malware inside script wit...

  This coinMiner family is very classical, which the sample itself embedded lots of vulnerabilities to exploit, yeah, there are N-day. I just introduced one of them with static analysis; here we go. The sample (SHA256: 128452242b0ff64f746759e106ce84b998c0b7807380a1f50975ceb8eada430e) The sample packed with the packer: UPX (3.96). Figure 1 – packer:UPX(3.9.6) Try the UPX tool to unpack, and the language is Go. Yeah, the Go language is so popular with malware development. Figure 2 – the sample compiler with Go Ok, let’s move to static analysis. Good luck! Some function name strings like “shell_exploit” were very attractive. Figure 3 – shell_exploit_* strings   Here, choosing “_b42207_” randomly for analysis. Figure 4 – shell_exploit_ptr_b42207_*   In the function “shell_exploit__ptr_b42207_run,” you can find an interesting and key string: “/securityRealm/user/admin/.” Figure 5 –  CVE-2018-1000861: key strings The complete strings ...