ShadowOpCode

🧠 Malware analyst & reverse engineer
🦠 Ransomware, loaders, stealers & RATs
🔬 Reverse engineering • crypto • tooling
📍 Technical research. No buzzwords.

[ShadowOpCode @ShadowOpCode]

🚨NEW RAT UNCOVERED
I didn’t stop at “this malware has a C2”
💥I rebuilt it
BotC2 RAT: native x64 reverse engineering, custom framing, command dispatcher, persistence, injection, screencast, and a working C2 emulator talking to the real sample.
Research ↓
https://t.co/B2ZaM4YHZy

[ShadowOpCode @ShadowOpCode]

@aaqeel87 @skocherhan @tobersotski @reecdeep @guelfoweb @AndreaDraghetti @struppigel @GroupIB_TI @Unit42_Intel @MsftSecIntel @CrowdStrike absolutely correct! As specified, in this specific sample the ransomware module is disabled.
I've posted it because, based on my research, the ransomware module was not documented yet. If you have a source, feel free to share :)

[ShadowOpCode @ShadowOpCode]

🚨ALERT🚨
PhantomStealer4 has a #ransomware module.

AES-256-CBC + HMAC-SHA256, .phantom files, FTP key escrow and file deletion.

Disabled in this build (RansomCheckBox = false)

Bazaar👇
https://t.co/bCQtAN8UnC

[ShadowOpCode @ShadowOpCode]

@RexorVc0 Amazing

[ShadowOpCode @ShadowOpCode]

@Cracker8oy @PandaRE__ Go back on textbooks, then practice, practice, practice

[ShadowOpCode @ShadowOpCode]

@zr4l0ck @JAMESWT_WT @skocherhan @reecdeep @tobersotski @AndreaDraghetti @marsomx_ @NguynQu14458611 @ffforward @g0njxa tested 10 of them with dnspy, no FPs in these 10. The YARA is pretty strict with the dotnet module

[ShadowOpCode @ShadowOpCode]

Just uploaded 203 #RGBLoader samples to MalwareBazaar, all discovered through hunting with my custom #YARA rule! 🔬

The samples are now available to the malware research community under the RGBLoader tag.

🔗 https://t.co/k8IZ5lJ8q0

#MalwareAnalysis #ThreatHunting

[ShadowOpCode @ShadowOpCode]

https://t.co/tvMDpWQzUF

[ShadowOpCode @ShadowOpCode]

🚨ALERT🚨
#RGBLoader is a new .NET Loader embedding bitmap pixels to conceal successive stages.
French/Viet fake program
RGBLoader > Cassandra Protector > final payload
>Deployed a YARA rule
>hunted 24 samples
>extractor script produced
>extracted malicious artifacts
Bazaar👇

[ShadowOpCode @ShadowOpCode]

#smishing #phishing against Italian tax payers.
Fake tax refund
#730

hxxps://stzaeyv[.]click/check

[ShadowOpCode @ShadowOpCode]

@malwrhunterteam @MsftSecIntel remove it

[ShadowOpCode @ShadowOpCode]

@tobersotski @reecdeep @guelfoweb @skocherhan @struppigel @MalbearLabs @g0njxa @RexorVc0 @James_inthe_box @BruteBee IMPORTANT UPDATE

https://t.co/9oeOzLr2lW

[ShadowOpCode @ShadowOpCode]

The loader I’ve been tracking as #RGBLoader is very likely a #GraftLoader variant, documented by @trendaisecurity. Both share the same pixel extraction, crop constants and payload cipher, including implementation quirks.
https://t.co/tvMDpWQzUF
https://t.co/xHnttsLePZ

[ShadowOpCode @ShadowOpCode]

🚨ALERT🚨
#RGBLoader is a new .NET Loader embedding bitmap pixels to conceal successive stages.
French/Viet fake program
RGBLoader > Cassandra Protector > final payload
>Deployed a YARA rule
>hunted 24 samples
>extractor script produced
>extracted malicious artifacts
Bazaar👇

[ShadowOpCode @ShadowOpCode]

The loader I’ve been tracking as #RGBLoader is very likely a #GraftLoader variant, documented by @trendaisecurity. Both share the same pixel extraction, crop constants and payload cipher, including implementation quirks.
https://t.co/tvMDpWQzUF
https://t.co/xHnttsLePZ

[ShadowOpCode @ShadowOpCode]

🚨ALERT🚨
#RGBLoader is a new .NET Loader embedding bitmap pixels to conceal successive stages.
French/Viet fake program
RGBLoader > Cassandra Protector > final payload
>Deployed a YARA rule
>hunted 24 samples
>extractor script produced
>extracted malicious artifacts
Bazaar👇

[ShadowOpCode @ShadowOpCode]

@PandaRE__ This is so fucking true.
It pisses me off that Microsoft Defender for Endpoint doesn't support YARA hunting at scale.
I can write rules that detect entire malware clusters, but how are defenders supposed to operationalize them?
YARAify is useful, but we need better integration.

[ShadowOpCode @ShadowOpCode]

NEW generalized #YARA rule for #RGBLoader
👇
https://t.co/MtDVA43aZW
https://t.co/tvMDpWQzUF

⚠️NOT tested against FP, consider it a beta⚠️

[ShadowOpCode @ShadowOpCode]

🚨ALERT🚨
#RGBLoader is a new .NET Loader embedding bitmap pixels to conceal successive stages.
French/Viet fake program
RGBLoader > Cassandra Protector > final payload
>Deployed a YARA rule
>hunted 24 samples
>extractor script produced
>extracted malicious artifacts
Bazaar👇

[ShadowOpCode @ShadowOpCode]

hxxps://katfiore[.]com (not personally validated as compromised at the moment, just reported)
hxxps://xenseyu[.]com/hex/dr7kggqq4y
hxxps://xenseyu[.]com/p?id=b5b1eb33425d9811d17ff3045684db5a993a9a68&k=0c1507711b004009
cc @shalkie @tobersotski

[ShadowOpCode @ShadowOpCode]

@shalkie @googlemaps Send #clickfix please

[ShadowOpCode @ShadowOpCode]

@tobersotski @reecdeep @guelfoweb @skocherhan @struppigel @MalbearLabs @g0njxa @RexorVc0 @James_inthe_box @BruteBee "french/viet fake program" refers to the language seen in the code, not the threat actor origin or affiliation

[ShadowOpCode @ShadowOpCode]

@James_inthe_box Thanks! I'll keep tracking this loader 🗿

[ShadowOpCode @ShadowOpCode]

hxxps://github[.]com/gpt-6-astra/gpt-6-astra.github.io/releases/tag/Astra
@malwrhunterteam @vxunderground @skocherhan @tobersotski