Всесторонний анализ угроз, индикаторы IOC и исследования по RAT, инфостилерам, бэкдорам и другим семействам вредоносных программ.
AsyncRAT statik analizi. SHA256: 40f84ae721a13a383e13d18ba0d4cd12... Boyut: 305KB, 1 string.
AsyncRAT statik analizi. SHA256: 1457e5a3b288fc4fc160a732472d5911... Boyut: 1407KB, 11979 string.
AsyncRAT statik analizi. SHA256: 0aac658075b7d9e81419d0beaa3db796... Boyut: 305KB, 1370 string.
AsyncRAT statik analizi. SHA256: 06798ab00b4cb050918236f0ac5c3a30... Boyut: 768KB, 1628 string.
AutoIt derlenmi Cince QQ ses araci sozyal muhendislik: VirtualAllocEx+WriteProcessMemory injection, HTTP InternetOpenW/HttpSendRequestW, FtpOpenFileW+FtpGetFileSize FTP exfil, AdjustTokenPrivileges, FPU anti-disassembly.
Android VNC RAT APK: libavnc.so LibVNCServer, rfbInitSockets+rfbCheckPasswordByList+nreversecon ters baglanti, mastermaestrosafety.appspot.com Google Cloud C2, Google Play taklidi (135 referans).
LNK phishing spear-attack: powershell.exe Base64 PS1, hedef laptop-pp7fvpth SID S-1-5-21-4018316176, TLS 1.2 SecurityProtocolType Tls12, ZIP indirme + acma, TEMP lnk_error.txt kayit.
MetaMask+Chrome stealer: webextension@metamask.io uzantisi, PK11SDR_Decrypt Firefox, SELECT host_key name encrypted_value FROM cookies, CryptUnprotectData DPAPI, CryptStringToBinaryA, CreateProcessWithTokenW.
Ring3 CRAT x64 WarzoneRAT PDB W7H64: warzoneTURBO, BCryptDecrypt Chrome AES-GCM, PK11SDR_Decrypt Firefox, select logins/wow_logins, Edge+Epic+Firefox hedef, VirtualAllocEx+CreateRemoteThread injection, URLDownloadToFileW.
TeslaCrypt fidye yazilimi: .teslaX self-modifying PE section, CryptAcquireContextW+CryptEncrypt sifreleme, AdjustTokenPrivileges ayricalik, Tor browser C2, PathFindExtensionW hedefleme, -silent_path parametre.
FlatChestWare NET ransomware PDB C:\Users\Loli: 150$ Bitcoin fidye, AES/RijndaelManaged encryptFile, endyou.xn--6frz82g emoji IDN domain C2 listen.php, SendPassword odeme dogrulama.
NightSky Ransomware PE32+ x64: xafcibeh2lvq5x7fx76ygcosad.onion Tor C2, akij@nightsky.cyou, NightSkyReadMe.hta, RSA sifreleme, 107GB kurumsal veri sizintisi tehdidi, sohbet sifresi kdjfikerjijJHDUFIGjk3289.
Cince sosyal muhendislik: 2024 Shenzhen kira destegi sablonu ZIP, __MACOSX gizli klasoru altinda Tunnel.exe (8.3MB Go binary PE32+ x86-64), macOS metadata klasoru ile Windows EXE gizleme, VPN/tunnel/proxy C2 kanali.
1.86MB JScript dropper: this.abdominals+stackstand string toplama obfuskasyon, ActiveXObject WScript.Shell, WScript.ScriptFullName+FileExists+CopyFile self-copy persistence, WScript.Sleep(2000) sandbox kacis, rastgele degisken ismi.
794KB obfuske PS1: aritmetik ASCII hesaplama (% 95)+32, loop-based sabit hesaplama, $injection126 dogrudan injection referansi, 700+ karakterlik gömülü base64 payload bloklari, [char] casting string reconstruction.
DLL hijacking: autoruns.exe adi tasiyan PE32+ DLL, export tablosunda DUI70.dll ilan eder, ?GetPasswordCharacter@Edit@DirectUI sifre hasati, RegisterBrowserControls tarayici kaydi, Chrome/Firefox hedefi garbling ile gizlenmis, entropi 7.40.
Enigma CryptoPP v2 Loader DLL: PDB D:\projects\enigma\cpp\LoaderCryptoPP.v2, CryptoPP RSA-OAEP+AES-CBC+SHA256, AES-NI hizlanmasi, NtCreateThreadEx remotePayload injection, Export WindowsDll.dll/Start ordinal1, Symantec sertifika.
SMTP botnet loader PDB Bruno: mail from ESMTP spam, loader_id bot kimlik, NtFilterToken+NtDuplicateToken UAC bypass, VirtualAllocEx+WriteProcessMemory+SetThreadContext injection, wusa.exe LOLBin.
Kompakt 64KB credential stealer: PK11SDR_Decrypt Firefox NSS sifresi cozme, select * from moz_logins SQLite, Chrome/Chromium Login Data, SeaMonkey, Thunderbird, POP3+IMAP+SMTP mail hesap hasati, FCONNECT HTTP CONNECT C2.
Emotet 32-bit DLL payload EmotetPayload32-bitDL: 333KB PE32 GUI, sifrelenmis C2 (RSA), obfuske strings, CRT locale-based kamuflaj, moduler mimari (spam+spreader+loader), ikincil yuk TrickBot/QakBot/Cobalt Strike.