RAT, 인포스틸러, 백도어 및 기타 악성코드 패밀리에 대한 포괄적인 위협 분석, IOC 및 연구 보고서.
BEC saldirisi AWPO-REG1529_052026.js: JS uzantili ancak gercekte MZ baslikli PE32+ x86-64 EXE (3MB, 8 section), Air Waybill Purchase Order taklidi, batch28 QUOTATIONREQUEST + batch29 OrderInquiry ile ayni BEC kampanyasi.
Cince dil paketi taklidi trojan: Swift PE32, Microsoft Detours .detourc/.detourd API hook sections, SSL Corp EV kod imzalama sertifikasi, __swift_1/__swift_2 runtime, Bc0OmSbjSozsJ hardcoded config (268x), SetThreadContext injection.
29KB NET ransomware encry.exe: YOUR FILES ARE ENCRYPTED, Bitcoin odeme new_pings@tutanota.com, AesEncryptFile+RSACryptoServiceProvider, vssadmin delete shadows, DeleteAllRestorePoints, DECRYPT-FILES.html + FILE RECOVERY.txt fidye notu.
NET RAT Hackus Mail Checker Reforged.exe: HVNC REPLY_BMP/CMP/MESSAGE, AmsiScanBuffer patch x86+x64 AMSI bypass, EtwEventWrite patch ETW bypass, DataLogs_keylog_online/offline.txt keylogger, NtProtectVirtualMemory, Camera webcam, Paste_bin exfil.
Akira Ransomware Swift PE32+ x64: .akira uzantisi akira_readme.txt fidye notu, akiralkzxzq...onion Tor C2 + akiral2iz6a...onion veri sizdirma blogu, PowerShell WMI Win32_Shadowcopy VSS silme, double extortion kurumsal hedef.
BEC saldirisi OrderInquiry070126.js: 1.37MB tek satirli minify JS, JavaScript Obfuscator string-array lookup (function q/Z), sayisal indeks hesaplamali string erişimi, siparis sorgulama taklidi - batch28 QUOTATIONREQUEST ile ayni kampanya.
BabyLockerKZ fidye yazilimi Swift ile derlenmiş PE32+ x64: .crypt dosya uzantisi, bytesForEncrypt/bytesCryptAndSkip yapilandirmali kismi sifreleme, RSA CryptGenKey/CryptExportKey, api.ipify.org IP tespiti, niggerProject edu PDB.
Ginzo.exe Trik botnet dropper: VBA makro, RTF gömülü nesne (49x object), HTA bcaou.cn/a.hta, JS GetObject, iex $env: PowerShell, bitsadmin LOLBin - 8 C2 IP + 185.185.25.175/ref45.php - PasswordRecoveryChrome + wallet.dat + XMR miner.
310KB obfüske BAT: null variable nhiOvXUvZJiCxXCZWchh ile karakter bölme, gecikmiş genisletme !var! ile net file admin kontrolü, batch 26 9619a5ea ile ayni kit - farkli null variable ismi.
BlackMatter Ransomware Swift ile derlenmiş Windows PE32: oG5IasxF4 kurban uzantisi, README.txt fidye notu, Tor C2 supp24yy...onion, paymenthacks.com + mojobiden.com odeme portali, DuplicateToken yetki yukseltme.
BEC saldirisi QUOTATIONREQUEST-DTC-9-P: 4.4MB UTF-8 JScript, Unicode CJK+Taylandca+Etiyopya karakterleri ile cok katmanli obfuskasyon, VQFRAZPGFWKYWYRY rastgele degisken, kurumsal satin alma teklifi taklidi.
869 bayt HTA dropper: VBScript bitsadmin LOLBin ile GitHub om1cr0n-team/Lizardium/raw/main/tr.exe indirir, %Temp%\tr.exe olarak kaydeder ve calistirir, Bonjour HTA app taklidi, window gizleme (-4000,-4000).
Steanings.exe NET Chrome stealer, XHP Booster kamuflaji: ChromeGetRoamingName/LocalName, DecryptBlob AES-256-GCM Chrome sifresi, Extension Cookies, C2 217.65.2.14:3333 + 46.205.202.219:1912, api.ip.sb IP check.
WannaCry (WannaCrypt) kill switch domain iceren PE32+ DLL: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com, entropi 7.49 packed, RSA-2048+AES-128-CBC, InternetOpenUrl kill switch kontrolu, 2017 Mayis kuresel salgin.
BEC saldirisi SWIFT_Payment_Receipt_300 JScript dropper: 354KB, Danimarkaca degisken ismi obfuskasyonu, ActiveXObject Scripting.FileSystemObject, gömülü XOR sifre [132,126,104,81], kurumsal finans calisanlari hedef.
Snake Keylogger Celesty Binder ile paketlenmiş: DarkCoderSc PDB, Ring3 CRAT x64, Telegram bot API C2 (sendMessage + sendDocument), checkip.dyndns.org IP tespiti, BCrypt AES+RSA sifreleme, YFGGCVy... drop dosyasi.
Swift ile derlenmiş nadir Windows PE32+ downloader: 176.46.152.62:5858 C2, crypted_build.exe + dadaasads_new.ps1 URLDownloadToFileA ile indiriyor, nbgtpasrg.exe drop, PowerShell Bypass Hidden ile calistirma.
.NET Stub.exe: AES (GenerateIV, CryptoStream), TLS X509 sertifika pinleme (MITM bypass), hardcoded RSA-boyutlu Base64 sifreli config, DeleteSubKeyTree registry temizleme, kullanici adi sorgulama.
paint.net taklidi MSI dropper: WixSharp DownloadAndExecute custom action, UAC_REVEALER_ENABLED bypass, SSL Corp EV kod imzalama ile guven kazanma, gizli hash tabanli ProductName.
1.7MB obfüske BAT loader: CMD boş değişken genişletme (%NULL%) + gecikmiş genişletme (!var!) çift katman, karakterleri tek tek değişkenlere atarak gerçek komutu gizleme, gömülü kodlanmış payload.