ddash

Reverse Engineer / Malware Analyst

[ddash @ddash_ct]

@RussianPanda9xx TBD - you should just run everything by me before publishing lmao

[ddash @ddash_ct]

@RussianPanda9xx Found some additional samples and wrote some quick capability to parse out information - pasted the results here: https://t.co/6QbQJnHlbb

[ddash @ddash_ct]

@RussianPanda9xx @RussianPanda9xx - do you have a name for the PowerShell loader component that uses a "256-entry lookup table mapping 3-character tokens to byte values"?

[ddash @ddash_ct]

@RussianPanda9xx Nvm - I can see that the loader component and embedded binary are part of the same package

[ddash @ddash_ct]

@virusbtn FYSA, this DcRat is not DarkCrystalRAT, it is an open source project (https://t.co/WG1K1TymZj) that happens to share the same short name, where DarkCrystal refers to itself as DCRat (note case-typing)

[ddash @ddash_ct]

@KrakenLabs_Team Looks like they're self reporting older versions than the 2.0 seen in the other samples, maybe a codebase/tactic change

[ddash @ddash_ct]

@KrakenLabs_Team These samples are very different from the original reporting - the configuration uses a username/password for login "cracked" and "bydobroslavie". Also very strange that the classes/methods/fields have all been named as though it's been deobfuscated using de4dot

[Cipher Tech @ciphertech]

Next ACCE release is available. See the updates for #CVE20258088 #AndeLoader #INCRansomware #KitsuneRat #MythicAgentsPoseidon https://t.co/nDVLkx9rWp

[ddash @ddash_ct]

@vmray FWIW the .NET Loader is called Ande Loader - good analysis by eSentire here: https://t.co/0ag2SOrZL8

[Cipher Tech @ciphertech]

August ACCE release is live: https://t.co/ercund5xsN See the updates for #ChiHouRAT #Matanbuchus #CyberStealer #NimDoor #Gunra #LoptikMod

[ddash @ddash_ct]

@tccontre18 Just FYSA, the loader/crypter is RoboSki https://t.co/1gPjku6lDh

[Cipher Tech @ciphertech]

Latest ACCE release is availble. Check the notes here: https://t.co/Drmn2qsRV0 #SquidLoader #PulsePack #BertRansomware #PathWiper #NightSpire #GlobalRansomware

[Cipher Tech @ciphertech]

July ACCE release is available with updates including those for #RondoDox #XDSpy #GrayAlpha #ShortLeash #PylangGhost https://t.co/p1RhJUn4gj

[ddash @ddash_ct]

@RussianPanda9xx This is a sample of Armillaria loader which we named earlier this month (https://t.co/uXxIMkB1Ow) - results - https://t.co/v4vMxX07sg

[ddash @ddash_ct]

@smica83 @abuse_ch RoboSki Crypter dropping a QuasarRAT variant called Phantom Stealer (no support for stealer yet) https://t.co/zioNLpFVNx

[ddash @ddash_ct]

@CRDiegol @1ZRR4H @JAMESWT_WT Download url is at https://t.co/DvEx6gwV6E

[ddash @ddash_ct]

@CRDiegol @1ZRR4H @JAMESWT_WT Following the download chain, a final Base64 encoded payload is downloaded from (a too long url), payload is DcRat, configuration can be found at https://t.co/PM1xFj02SJ

[ddash @ddash_ct]

@suyog41 Configured with api.telegram[.]org/bot7960266770:AAF1drUTBmBXc7u9bR6TcBCnXPoXgg0kIVw/sendMessage?chat_id=-4614758227

[ddash @ddash_ct]

@netresec Also found:
195.177.94.195:7712 (0c5a6a1c1807f60e4ecb9209ede0c95b)
139.180.160.173:7712 (310c935a189ca01dcee92d9c002f3330)
77.239.112.49:7712 (39eda0b2986f484abf3567f2f5e1866d)
116.202.224.89:7712 (d92e3545072656af9a744b934f0550a6)