Chaitanya 🇮🇳

Threat Researcher @sophoslabs

[Chaitanya 🇮🇳 @CbGmanit]

@Lenny_3BO While executing inside VM, I am getting error as "A dynamic link library initialization routine failed"
I can see same error for CAPE and Zenbox on VirusTotal.

[Chaitanya 🇮🇳 @CbGmanit]

@Lenny_3BO Could you elaborate on how you got the next stages?
Were you able to execute it inside VM?

[Chaitanya 🇮🇳 @CbGmanit]

@Tera0017 @_CPResearch_ Is this sample https://t.co/g0lU8OtwOy similar to Rust Loader which is discussed in the blog ?
If possible please share the sample of Rust Loader which was discussed in the blog.

[Chaitanya 🇮🇳 @CbGmanit]

@JAMESWT_WT @k3dg3 @500mk500 @skocherhan Has anyone found anything malicious in https://t.co/T8ruv2bD78
It has reference for other DLL which gives AsyncRAT payload but apart from that its not getting loaded by filezilla application when I tried to load it in debugger.

[Chaitanya 🇮🇳 @CbGmanit]

@johnk3r If you have maverick sample, please share it.

[Chaitanya 🇮🇳 @CbGmanit]

@FABO97662188 First one is there the second one is not there.

[Chaitanya 🇮🇳 @CbGmanit]

@FABO97662188 If you could please share the EXE sample ? It doesn't seem to be present on VirusTotal.

[Chaitanya 🇮🇳 @CbGmanit]

@SquiblydooBlog I guess secur32.dll is malicious here which still has 0 detections on VT: https://t.co/6xy6zburm8

[Chaitanya 🇮🇳 @CbGmanit]

@LAB52io website seems down. Could you please check ?

[Chaitanya 🇮🇳 @CbGmanit]

@dodo_sec @greglesnewich @privatescript @NetworkDefense @chrissanders88 @medic642 @Hachiman_Xienim @dodo_sec if you could write-up on how you approach analysing delphi malware specifically LATAM ones that would be helpful.

[Chaitanya 🇮🇳 @CbGmanit]

@deFr0ggy @_CPResearch_ @hasherezade #3.2 unpacked sample hash has been missed.

[Chaitanya 🇮🇳 @CbGmanit]

@c3rb3ru5d3d53c Nighthawk seems new and challenging for most of us.

[Chaitanya 🇮🇳 @CbGmanit]

@embee_research If you could share hash of the sample in screenshot ?

[Chaitanya 🇮🇳 @CbGmanit]

@vinopaljiri @_CPResearch_ @CheckPointSW Happy birthday and wishing more success. Hope you will not stop making malware analysis YouTube videos 😀

[Chaitanya 🇮🇳 @CbGmanit]

@_FirehaK @ZeroFox Thanks. Got it. By the way nice rule. Waiting for your blog and it's relation to Raccoon V2

[Chaitanya 🇮🇳 @CbGmanit]

@_FirehaK @ZeroFox https://t.co/0mvN6ucIxV

[Chaitanya 🇮🇳 @CbGmanit]

@X__Junior Everything is described in detail, very helpful for newbies. Keep writing 😀

[Chaitanya 🇮🇳 @CbGmanit]

@OleVilladsen Great analysis. Very helpful.

[Chaitanya 🇮🇳 @CbGmanit]

@ale_sp_brazil Thanks for such detailed analysis. Really helpful.