Malware Analysis Space

  Summary   First thanks for  Szabolcs Schmidt  was calling global malware analysts to analysis the samples on X, I’m really appreciate his work and he is helping to make cybersecurity more safer and stronger, I have no other words, you are doing an amazing work. Abuse.ch's Malware Bazaar  is an excellent platform for sharing and analyzing malware samples. By contributing to the community, I’m helping to improve global cybersecurity defenses and I’ve uploaded the sample to share.   In this report, I do not plan to dive deep into all the details of the technique, but it is possible to make it up when having enough time to analyze; I would like to do that. In fact, it will learn more when diving deeper into the malware itself.     Technical analysis   Basic info   The sample hashs: md5 A699AFD908E0DEC5C96FF7188450B89F Sha256 f18631344d6f7fc57fd248edce37baeb11976e315b72b68d48311c406ace3f8c   Operation s...

  Summary UAC-0173 is a threat actor group known for targeting Ukrainian organizations with sophisticated malware campaigns. One of their preferred tools is  AsyncRAT . This report explores the antivirus detection and evasion techniques used by UAC-0173 in their AsyncRAT campaigns, providing insights into how defenders can detect. Abuse.ch's Malware Bazaar  is an excellent platform for sharing and analyzing malware samples. By contributing to the community, I’m helping to improve global cybersecurity defenses and I’ve uploaded the sample to share.     Technical analysis   Basic info The sample hashs: md5 e9cedc98677b6b5146b14009ced7d624 Sha1 1b6e14e578c613932496bfd49c616760bdceb2c1   Operation system: Windows (I386, 32-bit, EXEC] Packer: no     Deploy main abilities This client program, like other RATs, has its main abilities: checking VMs or sandboxes, killing processes, privilege escalation, and so on. The...

Summary This is the head part of the Akira ransom note, and it claims: Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.   Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources.   As you know, recently ransomware has become so popular, and threat actors further expanded the attack surface to Linux. In 2023, I had collected many ransomwares that run on Linux and posted them to X (formerly Twitter), and last week I noted Akira ransom gang. I am very curious about what happened one year later.     Technical analysis   Basic info The samp...

  Summary I have recently noted that APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations, and the report from sekoia.io , the third part of the report referring to HATVIBE and CHERRYSPY infection chain, which related to another report from CERT-UA , attracted me to the extension. That sample is heavily obfuscated, so here it is, for this analysis, we will focus on doing deep dive with x32dbg debugging. Base on the last report title “ Unveiling APT28’s Advanced Obfuscated Loader and HTA Trojan: A Deep Dive with x32dbg Debugging” posted in 2025.02.25, But now on this report I will make a further process into the algorithm that decodes APT28’s HTA Trojan; it is very interesting to dive deeper inside. In brief, I am so excited to see what’s happened and what evasion technique it used.   Technical analysis The sample HASH md5 d0c3b49e788600ff3967f784eb5de973 Sha256: 332d9db35daa83c5ad226b9bf50e992713bc6a69c9ecd52a1223b81e992bc725 ...