Reverse

  • Let’s play (again) with Predator the thief

    ,
    Let’s play (again) with Predator the thief

    Whenever I reverse a sample, I am mostly interested in how it was developed, even if in the end the techniques employed are generally the same, I am always curious about what was the way to achieve a task, or just simply understand the code philosophy of a piece of code. It is a very…

  • Overview of Proton Bot, another loader in the wild!

    Overview of Proton Bot, another loader in the wild!

    Loaders nowadays are part of the malware landscape and it is common to see on sandbox logs results with “loader” tagged on. Specialized loader malware like Smoke or Hancitor/Chanitor are facing more and more with new alternatives like Godzilla loader, stealers, miners and plenty other kinds of malware with this developed feature as an option.…

  • Let’s nuke Megumin Trojan

    Let’s nuke Megumin Trojan

    When you are a big fan of the Konosuba franchise, you are a bit curious when you spot a malware called “Megumin Trojan” (Written in C++) on some selling forums and into some results of sandbox submissions. Before some speculation about when this malware has appeared, this one is not recent and there are some…

  • Let’s play with Qulab, an exotic malware developed in AutoIT

    Let’s play with Qulab, an exotic malware developed in AutoIT

    After some issues that kept me far away from my researches, it’s time to put my hands again on some sympathetic stuff. This one is technically and finally my real first post of the year (The anti-VM one was a particular case). So today, we will dig into Qulab Stealer + Clipper, another password-stealer that…

  • Let’s dig into Vidar – An Arkei Copycat/Forked Stealer (In-depth analysis)

    ,
    Let’s dig into Vidar – An Arkei Copycat/Forked Stealer (In-depth analysis)

    Sometimes when you are reading tons and tons of log of malware analysis, you are not expecting that some little changes could be in fact impactful. I paid the price when I was analyzing a supposed Arkei malware. my Yara rule at that time was supposed to trigger this malware, but after some reversing, I…