Malware Analysis Space

  Summary From the Hunt.io blog, I noted that GreenSpot APT phishing campaigns quickly traced the event and downloaded the files to do simple checking.   Technical analysis   Until 2025.2.13, the following sites are still accessible. The fake site hxxp[:]//mail.eco163[.]com/ jumps to hxxps[:]//www.kaola[.]com/ when entering a username. About both hxxps[:]//l2024163[.]com/ and hxxps[:]//chamber.icu/, Potential victims are prompted to enter the username and password twice to download the file. The first try always triggers an error message; its motivation is to let 163[.]com users confirm password accuracy, so the fake sites try to steal valid user credentials. Figure1- Download Large Attachments Figure2- Fake login   To check The attachments out, not finding “VBA Macros” embedded, is high confidence to ensure those without any malicious behavior. It seems that GreenSpot is focused on stealing user credentials, not directly doing harm to the user o...

  Summary From the AhnLab SEcurity intelligence Center (ASEC) I noted that Theft of Web Browser Information (forceCopy) which malware are PowerShell scripts, and I have collected three malwares, they have similar design, I choose one of them to analysis. The design of the PowerShell script used by obfuscation technology from Kimsuky is worthy of more attention, especially nowadays as AI is developing fast; it makes malware makers and analysts more easily able to do their jobs.   Technical analysis This forceCopy is the PowerShell (executable). The hash MD5: 1e9d94d88fdac3c4a0a47a3a1d07e329   The source code is difficult to read, so I did it manually and made it easy to read. These codes are a small part of them. 1.  It  defines a function (stored in the variable  $mqtz60 ) that takes an array of strings ( $vvv32 ) as input; 2. For each string in the array, it decodes the string from Base64,  converts the resulting  byte array to a string and ...

  Summary RapperBot is a malware family primarily targeting IoT devices. It has been observed in the wild since June 2022. Recently, the other variant of this botnet was noted by the Chinese cybersecurity team on 2025/1/28, which did a large-scale malicious attack on Chinese AI startup DeepSeek, which attracted my curiosity, so I looked for another variant, which was improved based on an early version .     Technical analysis This Rapperbot is the ELF for ARM (executable). The hash MD5: 139052977D3A5E9246A51D726DAE32BD   Improved abilities and the design such as “EF9EBF4D5A1A44D0DB92DE06D3DCE7A1” without the ability of brute forcing. I did an analysis report before; when it successfully cracked the target, it would use the wget command to download malware itself and expand its attack surface from hxxp://109.206.243.207/d. And the variant has no web vulnerabilities to exploit, which is used by the other botnet, like EnemyBot. It means that the Rapper...

  Summary RapperBot is a malware family primarily targeting IoT devices. It has been observed in the wild since June 2022. Recently, the other variant of this botnet was noted by the Chinese cybersecurity team on 2025/1/28, which did a large-scale malicious attack on Chinese AI startup DeepSeek, which attracted my curiosity, So I looked for one variant, which is an early version, to analyze that belongs to the ARM architecture.     Technical analysis This Rapperbot is the ELF for ARM (executable). The hash MD5: EF9EBF4D5A1A44D0DB92DE06D3DCE7A1 This variant focuses on the TCP DoS attack and not on doing a brute force like a telnet server and not on doing vulnerability exploits. Figure1-DoS attack   Before starting a DoS attack, the code creates a UDP socket, the port is 13568 , connects it to a remote address, retrieves the local socket details, and then closes the socket, and finally returns the value 134744072. Figure2-Retrieving socket detail t...

  Summary HailBot is the variant of the Marai botnet. This botnet is very popular in 2023 and later became faster, delivering and infecting large-scale. Recently, the other variant of this botnet was noted by the Chinese cybersecurity team on 2025/1/28, which did a large-scale malicious attack on Chinese AI startup deepseek.     Technical analysis This HailBot is the ELF for ARM (executable). The hash MD5: 74AE300E854410ABB8C71A9E5C6182FF   The HailBot kills the other botnet to ensure that it is the only one running on the victim host. Figure1-Kill other botnet   The botnet kills other processes. Figure2-Kill other processes   HailBot disguises itself to hide the process with the mount. Figure3-Hide process   Supporting TCP and UDP DDoS attacks that are imbedded inside the botnet, which has more than 10 different DDoS attack ways. Firgure4-DDoS attack mode   HailBot is the variant of the Marai botnet, which is focused...

  Summary Mirai botnet family first discovered in 2016, the botnet will look for devices of IoT with scanner which embedded a dictionary for brute force attack and vulnerabilities exploit, and can do a DDoS attack like TCP flood and UDP flood and so on, later on, the source code distributed in github and different variants came from that time, nowadays, botnet is big challenging and threat to IoT, it is worthy doing research with different instruction sets, this report come here for a new try and let’s do it.     Technical analysis   This botnet is the ELF for Intel 386 (executable). The hash MD5:  6950F28382D7F11E18BDF53F3983117B The load segment displays lots of source files that can help analysts to learn from which source code is being included and infer the main function of malware, likely with the source file “kill.c” to tell the analyst it may use the kill command to stop the process and “socket.c,” which can be used for malware to conne...