K7 Labs · Published 14 Mar
Volume I: Who aM I? Confessions of an Obfuscated JS Worm
Excerpt
This is volume I of a three part series based on our (Kaarthik RM and Rajababu A) paper for AVAR 2013, discussing the prevalence of autorun malware in the Asian region, taking it further by analyzing an example of such a malware
To Brief it Out…
The Autorun Worm: an infection that uses an antiquated mechanism to make itself prevalent, especially in the Asian region. Even though the Autorun or Autoplay feature was deprecated by Microsoft quite some time ago, it is still actively exploited in the wild. For instance an autorun worm, widely known as ProsLikeFan, has been spread…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by K7 Labs on labs.k7computing.com.
Mentioned in the excerpt1
More from K7 Labs4
K7 Labs · Web page · Published 21 Mar
Volume II: Who aM I? Confessions of an Obfuscated JS Worm
This is volume II of a three part series based on our (Kaarthik RM and Rajababu A) paper for AVAR 2013, discussing the prevalence of autorun malware in the Asian region, taking it further by analyzing an example of such a malware Carrying on from where we…
K7 Labs · Web page · Published 18 Sep
From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain
We had an opportunity to analyse a system with frequent detection-alerts over powershell execution. Our analysis revealed a multi-stage infection that relied heavily on obfuscation, Registry-based payload storage, covert data delivery, persistence mechanisms,…
K7 Labs · Web page · Published 20 May
Fake Microsoft Teams Campaign Delivers ValleyRAT via NSIS Installer and DLL Sideloading
We came across fake Microsoft Teams distribution sites, shared on X platform back in mid April. The websites closely mimic the legitimate Microsoft Teams download page, using lookalike domains to trick users into downloading a trojanized installer packaged as…
K7 Labs · Web page · Published 23 Jul
Threat actors target recent Election Results
Recently, we saw a tweet about a document claiming to be reporting about the recent “Indian Election Results”. On analysis, we found that it was dropping a “Crimson RAT” payload. This RAT, mostly used by the Transparent Tribe APT, is capable of stealing…
On the same topics
papers.lisdex.sh · PDF · Added 31 Oct
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
Hermes is a commercial Windows malware platform that combines credential theft with interactive remote access. Advertisements on Russian-language cybercrime forums offer tiered subscriptions. The service has an operator web panel, worker accounts and a…
papers.lisdex.sh · PDF · Added 31 Oct
Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain
A Python repository advertised as an asynchronous scraper concealed a Windows malware loader in its import path. Following that loader led to Hermes, a subscription service combining credential collection, file access and interactive control of visible and…
Elastic Security Labs · Web page · Published 26 Mar
The Shelby Strategy
The SHELBY malware family abuses GitHub for command-and-control, stealing data and retrieving commands The attacker’s C2 design has a critical flaw: anyone with the PAT token can control infected machines, exposing a significant security vulnerability Unused…
Kaspersky · Web page · Published 21 Oct
Operation FlashHole: Lazarus breaks security, defies control
In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole. In this new operation, the group employed an updated malware chain that included both their old and new malware, which we…