Exploring the D3F@ck Malware-as-a-Service Loader

Tags

External References

• https://www.esentire.com/
• https://otx.alienvault.com/

Description

This report analyzes the D3F@ck Loader, a malware-as-a-service (MaaS) offering orchestrated by an individual going by the alias Sergei Panteleevich. The loader utilizes various evasion techniques, including the use of Extended Validation certificates, Inno Setup installers with custom Pascal scripts, and code obfuscation methods like custom Base64 alphabets and Caesar ciphers. It delivers additional malware payloads like Raccoon Stealer, MetaStealer, SectopRAT, and DanaBot. The developer operates a separate traffic team specializing in distributing stealers and markets both EV certificates and the D3F@ck Loader itself.

Date