RAT

AsyncRAT config decryption using CyberChef – Recipe 0x2

August 7, 2023

.NET, AsyncRAT, Config, CyberChef, CyberChef Recipe, RAT, Remote Access Tool

In the realm of malware analysis, tools like CyberChef play a pivotal role. One of the challenges that malware analysts often face is decrypting configurations of Remote Access Trojans (RATs) like AsyncRAT. This article provides a step-by-step guide on how to decrypt AsyncRAT configurations using CyberChef. Decrypting AsyncRAT ConfigurationsAsyncRAT is…

AsyncRAT: Config Decryption Techniques and Salt Analysis

August 5, 2023

.NET, AsyncRAT, Config, CyberChef, CyberChef Recipe, RAT, Remote Access Tool

In this article, we dive into the inner workings of AsyncRAT. This Remote Access Trojan (RAT) has seen a staggering 20% surge in its activity during the last quarter, as reported by the Spamhaus report. We’ll explore diverse decryption methods for the AsyncRAT configuration and explore the AES Salts used in…

Converting Integers to Hex with CyberChef – Recipe 0x1

July 14, 2023

.NET, AMSI, AsyncRAT, CyberChef, CyberChef Recipe, RAT

While analyzing malware, it’s common to encounter situations where you need to disassemble code sourced from an integer array. However, when you attempt to use the ‘To Hex’ function in CyberChef, it won’t work. The solution is to employ the ‘To Base’ operation with a radix value of 16. I…

Interesting tactic by Ratty & Adwind for distribution of JAR appended to signed MSI – CVE-2020-1464

June 28, 2020

Adwind, binwalk, Bytecode Viewer, CVE-2020-1464, file, Glueball, IoCs, JAR, Java, MSI, RAT, Ratty, xxd, Yara, ZIP

This article discusses an interesting tactic actively used by different Java RAT malware authors like Ratty & Adwind to distribute malicious JAR appended to signed MSI files. This technique was discovered by VT Team in Aug 2018[9] but that time it was not used by malware authors to distribute malicious…

Gather MD5, SHA256, Name and FullName of NanoCore files

PowerShell Commands for Incident Response

May 25, 2020

Blue Team, Cheat Sheet, Commands, NanoCore, PowerShell, RAT

We will learn different PowerShell Commands can be used in Incident Response to remediate the machine. I will take a real world scenario where a machine is infected with malware e.g. NanoCore RAT to explain this PowerShell Commands. These commands can be very useful in a limited Windows environment where…