Malware Analysis

Unpack RedLine stealer using dnSpyEx – Part 3

February 12, 2024

.NET, Config, Debugging, dnSpyEx, Infostealer, Malware Series, RedLine

In this article, we dive into process of unpacking and extracting config from RedLine Stealer using dnSpyEx. It’s a bit lengthy but a great way to learn about the unpacking process using dnSpyEx. 🔍 This is the 3rd part in our deep dive series on RedLine. If you need a…

Unpack RedLine stealer to extract config using pe-sieve -Part 2

February 6, 2024

.NET, dnSpyEx, Infostealer, Malware Series, pe-sieve, ProcMon, RedLine

RedLine Stealer config extraction using two ways: Fast & Easy Method: Use the awesome pe-sieve tool from @hasherezade, which dumps unpacked file from memory. Then, extract the config from dumped file. Using dnSpyEx for manual debugging. It’s a bit lengthy but a great way to learn about the unpacking process.…

🔍 Dive into the RedLine Stealer Infection Chain – Part 1

January 30, 2024

CyberChef, Infostealer, LNK, Malware Series, mshta, PowerShell, RedLine, VBScript

RedLine Stealer Infection Chain: Zip ➡️ LNK PS ➡️ mshta (URL1) ➡️ PS ➡️ cmd ➡️ PS ➡️ URL2 ➡️ exe What’s Inside: LNK using \W*\\2\\msh*e to dodge detection VBScript analysis using CyberChef & Wscript.Echo Utilize CyberChef recipe to decode VBScript & PowerShell How to deobfuscate PowerShell with PowerShell logging…

AsyncRAT config decryption using CyberChef – Recipe 0x2

August 7, 2023

.NET, AsyncRAT, Config, CyberChef, CyberChef Recipe, RAT, Remote Access Tool

In the realm of malware analysis, tools like CyberChef play a pivotal role. One of the challenges that malware analysts often face is decrypting configurations of Remote Access Trojans (RATs) like AsyncRAT. This article provides a step-by-step guide on how to decrypt AsyncRAT configurations using CyberChef. Decrypting AsyncRAT ConfigurationsAsyncRAT is…

AsyncRAT: Config Decryption Techniques and Salt Analysis

August 5, 2023

.NET, AsyncRAT, Config, CyberChef, CyberChef Recipe, RAT, Remote Access Tool

In this article, we dive into the inner workings of AsyncRAT. This Remote Access Trojan (RAT) has seen a staggering 20% surge in its activity during the last quarter, as reported by the Spamhaus report. We’ll explore diverse decryption methods for the AsyncRAT configuration and explore the AES Salts used in…

Interesting tactic by Ratty & Adwind for distribution of JAR appended to signed MSI – CVE-2020-1464

June 28, 2020

Adwind, binwalk, Bytecode Viewer, CVE-2020-1464, file, Glueball, IoCs, JAR, Java, MSI, RAT, Ratty, xxd, Yara, ZIP

This article discusses an interesting tactic actively used by different Java RAT malware authors like Ratty & Adwind to distribute malicious JAR appended to signed MSI files. This technique was discovered by VT Team in Aug 2018[9] but that time it was not used by malware authors to distribute malicious…

Similarity between Qealler/Pyrogenic variants -Part 0x3

February 4, 2020

Bytecode Viewer, Infostealer, Java, Pyrogenic, Qealler

In this last part, we will compare Old Qealler with the new Qealler/Pyrogenic variant. The previous posts Pyrogenic Infostealer static analysis – Part 0x1 & Unpacking Pyrogenic/Qealler using Java agent -Part 0x2 went through the latest Pyrogenic/Qealler [6] statically and dumping the unpacked code using Java agent. CONTENTS Brief Timeline…

Unpacking Pyrogenic/Qealler using Java agent -Part 0x2

January 17, 2020

Bytecode Viewer, Infostealer, Java, Java agent, Pyrogenic, Qealler

We will learn how and when we can use Java agent to quickly unpack the Pyrogenic Infostealer. In the earlier post Pyrogenic Infostealer static analysis – Part 0x1 we statically analysed the Pyrogenic/Qealler Infostealer but this requires more time and effort. We will be using the same sample PaymAdviceVend_LLCRep.jar from…

Qealler Infostealer static analysis – Part 0x1

January 6, 2020

Bytecode Viewer, Infostealer, Java, Pyrogenic, Qealler, T1043, T1503

Qealler is heavily obfuscated Java based Infostealer which is quite active based on ANY.RUN submission. This will be a three part blog series, this post will focus on Qealler/Pyrogenic static analysis, next part 0x2 we learn unpacking using Java agent and in the last part 0x3 we find similarity between…

Parent PID Spoofing (Stage 2) Ataware Ransomware – Part 0x3

May 14, 2019

Ataware, Ghidra, PE, Ransomware, Strings, Sysmon

Ataware Ransomware Stage 2 uses Parent PID Spoofing technique to change its parent PID to lsass.exe and this article is also referred to in Mitre Attack website [4]. You may download the ATAPIConfiguration.exe file from ANY.RUN (MD5: 04a2e6400b22a3a5e5e277eceaf2ce0c) Please check previous posts, if you are interested in the complete infection…