Reverse The Malware

  Malware developers target mobile phones, both iOS and Android, in the same way they target Linux or Windows devices. As malware analysts, we can rely on our foundational digital forensics knowledge to conduct investigations on seized or targeted devices. This includes examining SMS messages, files, images, videos, chats, and more. Fortunately, there are many freeware tools available for such cases, and of course, there are also numerous commercial toolkits that often provide more advanced capabilities than free solutions. Before diving deeper, what exactly is mobile forensics? Mobile forensics is the process of analyzing mobile devices to find clues and evidence. This evidence may relate to criminal activity or malware infections. In our case, the topic applies to both areas. Mobile forensics is a critical part of investigations, especially for law enforcement, because mobile devices are far more widely used by civilians than laptops. You can download Andriller from the followin...

  Threat actors are always finding novel ways to exploit systems and gain initial access to their targets or to random devices. One such method involves the use of steganography. So, what is steganography? It is the art of hiding secret messages inside text, images, audio files, and other media. Because of their offensive and intrusion‑focused mindset, threat actors often abuse legitimate techniques and tools for malicious purposes. In our scenario, we have samples that retrieve BMP files from the attacker’s hosting infrastructure. We will use tools such as zteg , a Ruby‑based steganography analyzer, along with the strings utility to verify whether an embedded executable has been successfully extracted. Afterwards, we will use VirusTotal to check how many antivirus engines detect the payload. Below is an example of how a PowerShell script downloads and fetches malicious BMP files. It extracts the  MZ header  from the BMP images, which indicates that the attacker used ...

  Artificial Intelligence makes human life easier for students, researchers, programmers, and so on. However, as I mentioned in my previous articles, we are not alone on this planet. There are individuals with criminal mindsets who abuse legitimate technology for malicious purposes. The ESET security research team recently discovered the first AI-based ransomware this year, which is quite interesting. Before we dive deeper into this article, let's go through the process of PromptLock  how it works and how it was revealed: The threat actor wrote C code and then compiled it into an executable file using GCC. The code snippet contained a full chain for generating a Lua script by sending a request to a local LLM (large language model) server. The ESET team found a sample and analyzed it in a controlled environment (a sandbox). They observed it attempting to connect to the local LLM server. The executable sent queries to the local LLM to generate a malicious script. The ...

  Artificial intelligences are gradually becoming our partners in daily tasks. It’s actually a great tool if people know how to use it, but we must remember we are not alone in the digital space there are criminals too. Artificial intelligence includes technologies such as deepfakes, voice cloning, etc. What is a deepfake? According to Wikipedia, deepfakes are images, videos, or audio that have been edited or generated using artificial intelligence, AI-based tools, or audio–video editing software.  However, threat actors are using this new technology and subtechnologies of artificial intelligence for many reasons, such as: Malware development Social engineering We have already seen the first AI-powered ransomware revealed by ESET Internet Security, and there have been many breaches and “shadow-IT” workers who even passed interviews using deepfake technology. In this article I will show how we can analyze and detect AI-generated images by examining metadata only, rathe...

  Sextrortion is a form of extortion where someone threatens to share sexual content (like nudes, sexual videos, or other intimate material) of a person unless the victim complies with certain demands . These demands can be: Providing more sexual content Sending money Doing favors Other forms of coercion So, in short: sextrortion = threatening someone to prevent sharing sexual content or to force them into something sexual or financial .  The game has changed. We have seen numerous examples of malicious Android applications that threat actors use for webcam phishing, weaponizing the app to exfiltrate data through a Telegram bot. This method is still common in many countries across Asia, the Middle East, and Europe. What’s particularly interesting is that now threat actors or black markets are offering commercial malware with premium features that include sextrortion modules . Stealerium is a well-known infostealer that exfiltrates data in multiple ways, parti...

  Malware revelations are unstoppable. Every day, month, and year, threat actors abuse legitimate software and utilities to deliver malware to random victims or targeted ones in many different ways. In addition, malware researchers use different terms for specific operations that happen during the infection process. The most common terms used by malware researchers are dropper and downloader . Actually, there is often some misconception regarding droppers and downloaders. Sometimes, newbie malware researchers and even security researchers mix them up. In this article, we will discuss the differences between droppers and downloaders. I hope this will be helpful for both professional and beginner researchers. First of all, what is a dropper? A dropper is not a type of malware itself; instead, it is an operation in the malware infection chain that drops another stage of malware. The dropper chain can be multi-stage or just one or two stages, depending on the environment the malwar...

  Malware is a type of malicious software “Mal” stands for malicious, and “ware” stands for software. However, what we often hear in the news, articles, or conference talks is the term “agent.” So, what is the main difference between an agent and malware? What makes an agent sound more realistic and trustworthy, while malware does not? In this article, I will answer these questions to provide valuable knowledge and insights for the malware research community. In future articles, we may also discuss implants, droppers, and other terms commonly used by malware researchers. First of all, the perception of an agent as “realistic” and malware as “disgusting” largely depends on the intent, motivation, and functionality of the software installed on a target computer, whether in an authorized or unauthorized manner. While the functionality of an agent is not very different from malware, agents monitor computers more comprehensively, from the user level to the kernel level that is, from R...