0xFFSend

malware analyst

[Sudeep_Singh @SinghSoodeep]

Dropping Elephant targets East Asia using ICASSE decoy theme.

LNK MD5: a02dca4d1487f9141a90f3b11aa08d64
Malicious DLL: f8f03a6a3edbf7985469de26bdfb5e97
Base64-encoded and XOR-encrypted shellcode: fdfce91c0a9758a24ea98b48c44fdc9c
.NET assembly payload: 1ac87c87bc585605b75b269ca510fc52

Malicious DLL - msdtctm.dll sideloaded by msdtc.exe
Scheduled task name - GoogleErrorReport launches msdtc.exe to start attack chain

DLL sideloading -> Base64 + XOR decrypt shellcode -> Donut shellcode -> in-memory execution of .NET DLL

All DLL sideloading components downloaded from the staging domain: cas-edu[.]org

C2 URL: hxxps://wtechnote[.]org/c019e2b6b055-48d2/a5c5a153b6caddd7.php

#threatintel

@smica83 @malwrhunterteam @volrant136

[0xFFSend @0xFFSend]

#Patchwork #APT
chinagreenenergy[.]org
gcl-cn[.]org
gcl-power[.]org
https://t.co/ahXawpF6YF

[0xFFSend @0xFFSend]

104.36.229.213[:]59447 #Bitter #APT
962816d91ffc29da83605699c467b88d7952d3fda7217a81fce5d2aff746a920

[0xFFSend @0xFFSend]

#Patchwork #APT
5.189.151.112

[Mikhail Kasimov @500mk500]

@TLP_R3D BODY_SHA1-IP: a78dda24e41edb22c214a4d5db1caf2671b5dff7

5.255.119[.]183
5.255.119[.]195
5.255.114[.]16
5.255.99[.]169
5.255.121[.]218
5.255.122[.]118
5.255.101[.]146

[0xFFSend @0xFFSend]

Detecting & Hunting Ransomware Operator Tools: It Is Easier Than You Think! https://t.co/OfqXoP34Bc

[0xFFSend @0xFFSend]

@ginkgo_g Thanks for sharing

[0xFFSend @0xFFSend]

哈���，找到了IoC
46.249.35.180
94.198.40.19
https://t.co/89oLtpAA2V

[0xFFSend @0xFFSend]

@Des00464472 Hello，how did you find this site？

[Didier Stevens @DidierStevens]

New blog post "Quickpost: Decrypting Cobalt Strike Traffic" https://t.co/UkZt4QU57H

[cybercdh @cybercdh]

Don't approach malware analysis saying "I need to examine every line of code"

Instead, start by asking:

- What network connections does this make
- What files does it writes to disk
- Does it have persistence

You can further explore with meaningful focus, in digestible chunks.

[hasherezade @hasherezade]

[VIDEO] Unpacking #Baldr stealer: https://t.co/1ojcl7jCGR #MalwareUnpacking #malware

[Danny Quist @OpenMalware]

Ghidra training slides with notes: https://t.co/H73DdnENjH