Malware Analysis Space

  Summary Back to December 26, 2024, FortiGuard Labs noticed a new variant called " CAPSAICIN " frequently spread through documented D-Link vulnerabilities that allow remote attackers to execute malicious commands like downloading payloads, killing botnets processes, DDoS attacking, telnet scanning, and installing binaries in victim hosts. Analysis   Why call the botnet named “ CAPSAICIN ”? CAPSAICIA bot named from malware inside strings Figure1-special strings     The PRIVMSG function implies that “CAPSAICIN” includes more functions and relative commands as follows. Figure2-command for “ CAPSAICIN ” Like the other botnet, “CAPSAICIN” kills known botnets processes to ensure it is the only botnet executing on the victim host. Figure3-pkill -9 known bots   AK47SCAN: Ak47telscan for cracking telnet using open-source projects as follows. Figure4-ak47telscan execute   How to get a payload from a remote machine? Supporting multiple ways like...

  Summary   Back to November 11, 2021, AT&T Alien Labs had found new malware written in the open-source programming language Golang. Deployed with more than 30 exploits, it had the potential of targeting millions of routers and IoT devices. After that, LevelBlue Labs first published research on their discovery of new malware written in the open-source programming language Golang to GitHub. But this blog does not go to open-source analysis and still does Go reversing. Recently, you know lots of malware turned to Go field, which is the new challenge. Malware itself Key. 1. 30+ different exploit functions and different router versions 2. Support backdoor with telnet and reverse shell httpd 3. Not found DDos attack module inside 4. Plain text string in malware   Analysis   As you know, BotenaGo malware is the type of botnet, but when we face a new malware, we have to analyze what happened in the malware itself. Obviously, lots of infec...

  This coinMiner family is very classical, which the sample itself embedded lots of vulnerabilities to exploit, yeah, there are N-day. I just introduced one of them with static analysis; here we go. The sample (SHA256: 128452242b0ff64f746759e106ce84b998c0b7807380a1f50975ceb8eada430e) The sample packed with the packer: UPX (3.96). Figure 1 – packer:UPX(3.9.6) Try the UPX tool to unpack, and the language is Go. Yeah, the Go language is so popular with malware development. Figure 2 – the sample compiler with Go Ok, let’s move to static analysis. Good luck! Some function name strings like “shell_exploit” were very attractive. Figure 3 – shell_exploit_* strings   Here, choosing “_b42207_” randomly for analysis. Figure 4 – shell_exploit_ptr_b42207_*   In the function “shell_exploit__ptr_b42207_run,” you can find an interesting and key string: “/securityRealm/user/admin/.” Figure 5 –  CVE-2018-1000861: key strings The complete strings ...

  Back to July 22, 2022, I noted that Hive ransomware gets upgrades in Rust by Microsoft Threat Intelligence ( Hive ransomware gets upgrades in Rust | Microsoft Security Blog ). The report mentioned that Unlike in previous variants where there was a  ‘help’  menu, in the new variant, the attacker must know the parameters beforehand. Since all strings are encrypted, it makes finding the parameters challenging for security researchers. Getting the command-line parameters is very challenging for beginners, but recently I wanted to challenge myself. I choose the sample (SHA-256: 33744c420884adf582c46a4b74cbd9c145f2e15a036bb1e557e89d6fd428e724 ) to debug. The sample won’t continue its execution , but it will also tell key information to the analyst. The first thing is the sample has to handle input from the user. the second thing it prints is an error Figure 1 – Without a username and a password, the sample won’t continue its execution The sample uses the function...

  Back to Dec 19, 2024, I noted that ESET researchers analyzed previously unknown Linux backdoors ( Unveiling WolfsBane: Gelsemium’s Linux counterpart to Gelsevirine ). I was attracted by the part of the WolfsBane backdoor, stored in a file named udevd, which embedded libMainPlugin. so, libUdp.so and libHttps.so. I tried to extract those above three so files, and now let’s do it. We need the malware sample named udevd, the hash sha1 0AB53321BB9699D354A032259423175C08FEC1A4. Which came from the first archive, the hash sha1 f1df0c5a74c9885cb5934e3eee5e7d3cf4d291c0 udevd is an ELF file. And search. so can see the above three so file module: libMainPlugin.so, libUdp.so, and libHttps.so Let’s debug udevd with dbg, be patient, and finally jump here. Yeah, we note that the key function is memcpy and the EmbeddedResource, which did deserialize the input archive and copy them to memory. We just need to dump the three so files from memory. First: find out the start address a...

OK, let’s jump to the first part of malware and extract the TraceIndexer.exe and TTDReplay.dll. The incident summary and detail you can view from China ThreatBook: APT32 Poisoning GitHub, Targeting Chinese Cybersecurity Professionals and Specific Large Enterprises | ThreatBook CTI , Here I’m focused on diving deep into the process of malware analysis, the malicious file .uso, which is from the project of GitHub and recently removed by APT32, the structure as the following: Let’s go to the malicious file .suo, it is the archive document, so you can use 7-zip to unpack it. Here is the file list: Note that a big size file, VsToolboxService, which opens it with a text editor like Notepad or EmEditor The malicious code is serialized by a formatter, with very long strings encoded by base64. Copy them to CyberChef and decode. And continue to copy the highlighted ‌ yellow to decode it again! So now save and detect it, the payload encoded by base64, and the framework is .NET. Some s...