RAT, 인포스틸러, 백도어 및 기타 악성코드 패밀리에 대한 포괄적인 위협 분석, IOC 및 연구 보고서.
NanoCore5 1MB Scan#250226HPJetstar.exe HP yazici tarama lurü. C Users Administrator Desktop Client FqStwIZtCP rasgele temp pdb. GetConfig SetConfig plugin.
DarkComet2 775KB Facebook.exe sosyal medya taklidi. IAMStreamConfig4 DirectShow webcam ses video akisi. SOFTWARE MSConfig startup kalicilik.
RedLine4 1.2MB QUOTATION#006565.exe sahte teklif belgesi luru. C2rj$ C2v]/ ?c2VIz c2+sel dort c2 substring. GetTickCount64 IsDebuggerPresent anti-debug.
BazarLoader2 728KB 1_3-8765.dll. force_avxTeddyconfig Rust TeddyBear konfigürasyon. struct Config with 21 el. ALPHV onion zincirleme. decimal.rs Rust kaynak.
MassLogger 1.9MB PT2600000043.js Portekiz PT fatura lurü. dispatch configuration data yorumu. aggregate normalize retry logic. CommonJS v2469 module export.
Phorpiex 113KB. 178.16.54.109 C2 IP. lb10.exe lb11.exe lb12.exe ardışık cok asamali payload indirme. MyAgent mutex kimlik.
Amadey 1.3MB. rundll32.exe InstallHinfSection DefaultInstall LOLBIN INF yurutme. Command.com /c eski kabuk. Control Panel Desktop ResourceLocale yerel tespit.
NetSupportRAT2 2.2MB NS2H.zip PCICL32.DLL. geo.netsupportsoftware.com loca.asp konum servisi. EV_CONFIGSET olay protokol. Ses akisi ses izleme.
Dridex2 1MB. DeletePrinterConnectionW yazdirma bileseni yan hareket. DirectUI@@QEAAAEAV ie browser enjeksiyon. GetModuleFileNameExW prosec numaralama.
NetWire2 1.4MB x00f01750.exe hash isimli. CoSetProxyBlanket COM EOAC NONE WMI kimlik dogrulama bypass. GetTickCount64 IsDebuggerPresent GetTickCount uclu.
PikaBot 1.4MB. JSON U+D800..U+DBFF must be followed by U+DC00 surrogate pair hatasi C2 JSON protokol. NtQueryObject NtQuerySystemInformation GetTickCount64 uclu.
AgentTesla3 1.8MB output_g7ss7xmq.js JavaScript yükleyici. v6034 v3933 v967 sayisal degisken obfuscation. @version 8.16.22. lock and resolve response payload.
PoisonIvy2 1.6MB Helpstore.exe Windows yardim merkezi taklidi. VBOX VirtualBox tespiti. ^z3c2 2ac2 Xelc2 9 sC2A b*c2gv bes c2 substring. kEy!9 anahtar.
SystemBC 1.7MB. BEGIN PRIVATE KEY END PRIVATE KEY gömülü RSA özel anahtarı. Ex$c2 d!C2$ c25a& Xx|C2 eJXc2 bes c2 substring. SOCKS5 proxy malware.
ALPHV BlackCat 3MB. 2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid.onion Tor. wmic csproduct get UUID VM tespiti. Node.js gömülü. Config alanlari.
Medusa2 757KB. encryptedFileExtension skipExtensions masterPublicKey JSON konfigürasyon alan adlari tespit edildi. RegCreateKeyExW başarisiz log.
Maze2 920KB. EncryptionDisable dosya sistemi sifrelemesini devre disi. CryptGenKey CryptExportKey CryptEncrypt CryptDecrypt WinCrypt tam paketi. NtQueryEaFile.
Conti2 515KB run-as-admin.exe UAC lur. mojobiden.com paymenthacks.com doğrudan C2 URL. supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion Tor adresi.
Dharma2 1MB. wmic shadowcopy delete gölge kopya yedek imhası. firemail.cc fidye teması iletisim email. Crypto++ RSA prime selector.
Qakbot3 1.5MB Notesvb.msi MSI teslimi. CorBindToRuntimeEx CLR hijacking ile NET enjeksiyonu. C++ RTTI vbase destructor vector deleting destructor.