SecuriTricks - 2024-05-04

Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four

This comprehensive analysis provides a thorough examination of the REMCOS Remote Access Trojan (RAT), a prominent malware threat that gained significant prevalence in 2024. The analysis delves into the malware's configuration structure, command and control capabilities, persistence mechanisms, and …

rat

evasion

Published: May 9, 2024

Downloadable IOCs: 34

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin

A recent surge of malicious JavaScript code has been observed targeting websites using vulnerable versions of the LiteSpeed Cache plugin for WordPress. The malware injects code into critical WordPress files or the database, creating unauthorized admin users like 'wpsupp-user.' It exploits the vulne…

Published: May 9, 2024

Downloadable IOCs: 6

Tracking the Surge in Non-PE Cyber Threats

This intelligence report details a sophisticated infection chain that culminates in the deployment of AsyncRAT, a potent malware designed to breach computer systems and steal confidential data. The meticulous analysis unravels the intricate sequence, commencing with a spam email containing a malici…

Published: May 9, 2024

Downloadable IOCs: 13

APT28 campaign against Polish government institutions

The CERT Polska team is investigating a large-scale malware campaign carried out by the Russian intelligence group APT28, which has been targeting Polish government institutions in the past year and is believed to be linked to the GRU.

Published: May 8, 2024

Downloadable IOCs: 74

Guntior - the story of an advanced bootkit that doesn't rely on Windows disk drivers

Amid the rise of bootkits at the time, a dropper was captured in-the-wild and posted on a malware tracker. The malware was called "Guntior", named after the device object its authors had chosen for it (\Device\Guntior). The name also appears in AV detections.

Published: May 8, 2024

Downloadable IOCs: 6

Code Emulation and Cybercrime Infrastructure Discovery

This report details the analysis of a malspam campaign utilizing the Matanbuchus loader, which involved decrypting strings within the malware through emulation techniques. The investigation pivoted to uncover a Russian bulletproof hosting service, Proton66 OOO, that currently hosts various maliciou…

Published: May 8, 2024

Downloadable IOCs: 76

Stealer Distributed via Crafted Minecraft Source Pack

This report details the operation of the zEus stealer malware, which is distributed through a crafted Minecraft source pack. The malware collects sensitive information from victims' systems, including login credentials, browser data, and cryptocurrency wallets. It employs anti-analysis techniques a…

Published: May 8, 2024

Downloadable IOCs: 23

Case of Malware Distribution Linking to Illegal Gambling Website Targeting Korean Web Server

This report examines a malware strain distributed to web servers in South Korea that redirects users to an illegal gambling site. The threat actor installed a Meterpreter backdoor, a port forwarding tool, and an IIS module malware on a compromised web server. The IIS module inspects HTTP headers an…

Published: May 8, 2024

Downloadable IOCs: 8

New Pakistan-based Cyber Espionage Group’s Year-Long Campaign Targeting Indian Defense Forces with Android Malware

CYFIRMA researchers identified an Android malware campaign, active for over a year, targeting Indian defense personnel by an unidentified Pakistan-based cyber espionage group. The threat actor utilized Spynote or a modified version called Craxs Rat, obfuscating the app with high complexity. Through…

Published: May 6, 2024

Downloadable IOCs: 3

Smart-sex-toy users targeted by clicker trojan

Virus analysts at Doctor Web uncovered an Android application containing a clicker trojan that silently opens advertising sites and clicks on webpages. Such trojans can be used to stealthily display ads, generate click fraud, sign up unsuspecting victims for paid subscriptions or launch DDoS attack…

Published: May 6, 2024

Downloadable IOCs: 13

Tag: 2024-05-04

Attack reports

Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four

Surge of JavaScript Malware in sites with vulnerable versions of LiteSpeed Cache Plugin

Tracking the Surge in Non-PE Cyber Threats

APT28 campaign against Polish government institutions

Guntior - the story of an advanced bootkit that doesn't rely on Windows disk drivers

Code Emulation and Cybercrime Infrastructure Discovery

Stealer Distributed via Crafted Minecraft Source Pack

Case of Malware Distribution Linking to Illegal Gambling Website Targeting Korean Web Server

RemcosRAT Distributed Using Steganography

HijackLoader Updates

LNK File Disguised as Certificate Distributing RokRAT Malware

New Pakistan-based Cyber Espionage Group’s Year-Long Campaign Targeting Indian Defense Forces with Android Malware

Smart-sex-toy users targeted by clicker trojan

Vulnerabilities

CVE-2024-3240

CVE-2024-3868

CVE-2024-3237

CVE-2023-7065

CVE-2023-27283

CVE-2024-1050

CVE-2024-34460

CVE-2024-34461

CVE-2024-34462

CVE-2024-34467

CVE-2024-34468

CVE-2024-34469

CVE-2023-52729