Blog
Babble Babble Babble Babble Babble Babble BabbleLoader
Loaders, an Ever Evolving Market The pace of innovation and development in the malware detection market is relentless, the same goes for the development of malware itself. Constantly charging and adapting to create ever more evasive and capable payloads. One such sector of this market is the loader (also called crypter or packer) market. In today’s threat landscape, loaders have become a critical tool in cybercrime operations, serving as the backbone for delivering a range of malicious payloads. Loaders are often the first stage in an attack chain, designed to stealthily execute or inject malware, such as info-stealers or ransomware, into a target system. Their prevalence reflects an evolution in tactics, allowing threat actors to evade traditional antivirus defenses through techniques like in-memory execution and anti-analysis features. Widely available for purchase or lease on underground markets, loaders are now a commodity in malware distribution, making sophisticated attack methods accessible to a broader range of actors and adaptable across diverse campaigns and targets.
November 17, 2024
Technical Analysis of a Novel IMEEX Framework
The IMEEX framework is a newly discovered, custom-built malware designed to target Windows systems. Delivered as a 64-bit DLL, it offers attackers extensive control over compromised machines. This framework is notable for its robust capabilities, featuring a wide array of functionalities, including execution of additional modules, file manipulation, process management, registry modification, and remote command execution. It also performs system reconnaissance by gathering critical system information, such as hostname, operating system version, volume serial number, and system language, and relays this data to its command-and-control (C2) server.
October 10, 2024
There's Something About CryptBot: Yet Another Silly Stealer (YASS)
We analyzed an infostealer that other vendors label CryptBot, but whose code has so little overlap with it that we give it its own name: Yet Another Silly Stealer (YASS). It arrives through MustardSandwich, a multi-stage downloader that hides an HTA sandwiched inside copies of a Windows binary, then IDATLOADER. YASS steals browser, wallet and app data into an encrypted ZIP, and can drop the NetSupport client as a backdoor. Behaviour matches CryptBot; implementation does not.
September 10, 2024
Dissecting SSLoad Malware: A Comprehensive Technical Analysis
SSLoad is a stealthy malware delivered through phishing emails that gathers reconnaissance and deploys further payloads. We trace the full execution chain from an MSI installer through PhantomLoader, a previously undocumented self-modifying loader hidden inside a patched 360 Total Security DLL, to a Rust-based downloader that reads its C2 address from a Telegram channel used as a dead drop. The diverse delivery methods suggest SSLoad is offered as Malware-as-a-Service.
June 10, 2024
Operation HamsaUpdate: A Sophisticated Campaign Delivering Wipers Puts Israeli Infrastructure at Risk
A phishing campaign targeting Israeli users of F5 network devices delivered newly developed wiper malware for both Windows and Linux servers. The Hebrew-language email exploited a real BIG-IP vulnerability to pressure admins into running the payload themselves. We analyze the Hatef wiper for Windows, the Hamsa bash wiper for Linux, and a Delphi second-stage loader named Handala that injects an obfuscated AutoIt script. Both wipers report progress to the same Telegram channel.
December 20, 2023
WildCard: The APT Behind SysJoker Targets Critical Sectors in Israel
Our research team has identified a new APT group, dubbed “WildCard,” initially detected through its use of the SysJoker malware, which targeted Israel’s educational sector in 2021. WildCard has since expanded its reach, creating sophisticated malware variants disguised as legitimate software, and a recently developed malware called ‘RustDown,’ written in Rust for potential operational advantages. Connections to Operation ElectricPowder indicate WildCard’s advanced capabilities with a focus on critical sectors within Israel. While we’ve begun to understand WildCard’s tactics and methods, their precise identity is still enigmatic, demanding deeper analysis and collaboration within the infosec community.
November 27, 2023
Malware Reverse Engineering – Unraveling the Secrets of Encryption in Malware
Encryption is everywhere in our lives. You might not notice it, but you use it every single day. It is baked into even the most basic processes of our digital world. Every time you open a website, send a message, unlock your phone, or pay for your morning latte, you are using encryption as part of that process. Encryption has evolved over centuries to become the cornerstone of modern data security.
August 7, 2023
CryptoClippy is Evolving to Pilfer Even More Financial Data
A banking trojan is a malware designed to steal sensitive financial information, such as online banking login credentials, credit card numbers, and other financial data. Recently Unit42 released a detailed report about a new malware called CryptoClippy that targets Portuguese speakers. The pesky malware uses the information from the clipboard to redirect money to crypto-wallets controlled by the threat actors. In our research, we have uncovered evidence indicating that the CryptoClippy threat is undergoing rapid evolution and exceeding its initial scope of crypto wallet theft. Our findings indicate that the threat actors behind CryptoClippy are actively expanding its capabilities, now targeting a broader range of payment services commonly used in Brazil. This discovery highlights the alarming nature of this evolving malware, as it signifies a significant shift in the tactics employed by the malicious actors. As they continue to refine and enhance their methods, the potential risks increase for financial data security in Brazil. Our investigation delves deep into these emerging patterns, shedding light on the evolving landscape of CryptoClippy and the imminent risks it poses to the payment ecosystem in Brazil.
May 24, 2023
How Hackers Use Binary Padding to Outsmart Sandboxes and Infiltrate Your Systems
Binary padding is the process of adding extra or junk data to a portable executable (PE) file that, while not changing the behavior of the binary, changes certain characteristics that can help with either obfuscating relevant code or defeating sandboxing solutions and detections. This technique is not novel. It has been employed in various forms for several years to achieve different effects, all of which are related to evading defense mechanisms. So why are we talking about it now? We have noticed recently a lot of phishing campaigns using binary padding while targeting victims, for example Emotet and QBot. (Skip down to read more about this “PufferPhishing” technique.)
May 18, 2023
Phishing Campaign Targets Chinese Nuclear Energy Industry
Intezer has been tracking activity targeting the energy sector and noted a campaign with techniques that align with those of Bitter APT, operating in the Asia-Pacific region. We have made the connection to Bitter APT through tactics, techniques, and procedures (TTPs) that have been observed in other publications, such as the use of Microsoft Office exploits through Excel files, and the use of CHM and Windows Installer (MSI) files. Bitter APT is a South Asian threat group that commonly targets energy and government sectors; they have been known to target Pakistan, China, Bangladesh, and Saudi Arabia.
March 24, 2023