Author: AnyRun

Summary:

HawkEye, also known as PredatorPain, is a long-standing malware primarily functioning as a keylogger but has evolved to include functionalities typical of stealers. Initially emerging in 2008, it gained notoriety through spearphishing campaigns and has been utilized by various threat actors. Its delivery methods have diversified over time, and it has shown resilience in adapting to new evasion techniques and maintaining persistence on infected systems.…
Read More

Summary:

This article analyzes two infection techniques used by AsyncRAT malware via open directories. It highlights the evolving methods attackers employ to exploit publicly accessible files, showcasing the persistent threat posed by AsyncRAT and its diverse strategies for infiltration and control.

Keypoints:

AsyncRAT is a Remote Access Trojan (RAT) used for spying and data theft.…
Read More
Short Summary

The article from ANY.RUN discusses recent cyber threats identified in October 2024, focusing on the APT-C-36 group, known as BlindEagle, which targets the LATAM region through phishing attacks. It details their tactics, including the use of Remote Access Tools (RATs) like Remcos and AsyncRAT, and highlights other phishing campaigns exploiting fake CAPTCHA prompts and encoded JavaScript files.…

Read More

Short Summary:

The article provides a comprehensive analysis of the DarkComet Remote Access Trojan (RAT), detailing its capabilities, methods of infection, and the technical mechanisms it employs to evade detection and maintain persistence on infected systems. DarkComet allows attackers to remotely control systems, steal sensitive data, and execute various malicious activities while remaining stealthy and difficult to detect.…

Read More

Short Summary:

The article provides a detailed analysis of PhantomLoader, a malware loader that disguises itself as a legitimate DLL for antivirus software. It is used to deliver a rust-based malware called SSLoad, which employs various evasion techniques. The analysis outlines the infection chain, including the use of phishing emails, malicious Office documents, and advanced obfuscation methods.…

Read More
Short Summary: The article provides a comprehensive analysis of AZORult, a sophisticated malware designed to steal credentials and payment card information. It highlights the malware’s evolution, behavior, evasion techniques, and operational tactics, emphasizing its adaptability and complexity. Key Points: AZORult is a credential and payment card information stealer that also functions as a downloader for other malware.…
Read More

Short Summary:

This article discusses recent phishing campaigns analyzed by ANY.RUN researchers, focusing on the Tycoon 2FA Phish-kit and its various evolutions. The campaigns utilize compromised Amazon SES accounts and employ sophisticated techniques to deceive victims into revealing their credentials through fake error messages and legitimate-looking links.…

Read More

“`html

Short Summary

The DeerStealer distribution campaign involves malware spread through fake Google Authenticator websites. The malware captures user information and downloads a stealer hosted on GitHub. It communicates with a Telegram bot and employs obfuscation techniques to hinder analysis. The campaign is linked to previous malware families, suggesting a common author.…

Read More
Recent posts HomeMalware Analysis Brute Ratel C4 Badger Used to Load Latrodectus

Editor’s note: The current article is authored by Mohamed Talaat, a cybersecurity researcher and malware analyst. You can find Mohamed on X and LinkedIn.

Brute Ratel C4 (BRC4) is a customized, commercial command and control (C2) framework that was first introduced in December 2020.…

Read More
Recent posts HomeMalware Analysis Find Threats Exploiting CrowdStrike Outage with TI Lookup  

A recent update by CrowdStrike on July 18, 2024, resulted in a worldwide outage, causing significant disruption for users who were left with blue screens of death (BSODs) on their devices.

Cybercriminals seized the opportunity to target affected users with phishing scams and malware disguised as updates or hotfixes. …

Read More
Recent posts HomeMalware Analysis Analysis of the Phishing Campaign: Behind the Incident

In this post we detail our comprehensive investigation into the phishing campaign encountered by our company. Our aim is to help others better understand this ongoing threat and take steps to protect themselves.

Here are some key findings: 

We found around 72 phishing domains pretending to be real or fake companies.…
Read More
Recent posts HomeMalware Analysis Analyzing Malware Protected with Themida and VMprotect: Is It Really That Hard?

Malware authors use protectors like Themida and VMProtect in the hope that they will completely prevent analysts from reversing samples.  

These protectors can use sophisticated techniques to hide malicious functionality: code virtualization, obfuscation, anti-debugging, compression, and encryption.…

Read More
Recent posts HomeMalware Analysis Windows 11 UAC Bypass in Modern Malware

In this article, we’ve prepared a brief overview of UAC bypass methods in Windows 11 that are used in modern malware and provided examples of their implementation in active threats. We’ll cover: 

Exploitation of COM interfaces with the Auto-Elevate property  Modification of the ms-settings registry branch  Infinite UAC Prompt Loop (social engineering) 

Let’s investigate these methods. …

Read More
Recent posts HomeMalware Analysis Reverse Engineering Snake Keylogger: Full .NET Malware Analysis Walkthrough Introduction

In order to understand malware comprehensively, it is essential to employ various analysis techniques and examine it from multiple perspectives. These techniques include behavioral, network, and process analysis during sandbox analysis, as well as static and dynamic analysis during reverse engineering.…

Read More
How to Set Up a Network Research Laboratory: MonikerLink (CVE-2024-21413) Case Study 

Every now and then, you come across a situation where you need to get hands-on to understand how an exploit or malware works and then create a detection rule. Plus, there are times when it’s essential for the attacking machine to be on the local network to capture network traffic or utilize its own detection tools.…

Read More
Recent posts HomeMalware Analysis CrackedCantil: A Malware Symphony Breakdown

Lena aka LambdaMamba

I am a Cybersecurity Analyst, Researcher, and ANY.RUN Ambassador. My passions include investigations, experimentations, gaming, writing, and drawing. I also like playing around with hardware, operating systems, and FPGAs. I enjoy assembling things as well as disassembling things!…

Read More
Recent posts HomeMalware Analysis A Full Analysis of the Pure Malware Family: Unique and Growing Threat

In this article, we’re analyzing one of the most unusual crypters— PureCrypter, and a multifunctional stealer — PureLogs. We’ll look at several examples and identify patterns among Pure-malware families, and also explain how to detect PureCrypter and PureLogs. …

Read More