Derrière ce titre un peu provocateur, c’est pour annoncer que je ne publierai plus d’article de CTI et ce pour plusieurs raisons. La première est d’un point vue honnêteté intellectuelle. On ne peut pas faire de bonne threat intelligence si on n’a pas de bonne télémétrie. Ce n’est pas en…

In Chinese APT, Russia was the playground of IceFog with other country like Kazaghstan, Tadjikistan or Mongolia. Into the Fog — The Return of ICEFOG APT — Speaker Deck Now many report of APT, many campaigns target those countries by TA428 with many TTPs similare: DNS dynamic Sideloading Using same…

A new document royal road v7 installs a backdoor in .NET. a first executable is dropped \os03C2.tmp. This exe has many similarities with older campaigns using by Operation LagTime or Tonto Team. Document The decoy document is a document about infection of covid19 in Russia send to the Mongolia Authorities…

a new babuk ransomware was uploaded on Virustotal. bc4066c3b8d2bb4af593ced9905d1c9c78fff5b10ab8dbed7f45da913fb2d748 This version is packed with the same technics of GandGrab described here. Threat Profile: GandCrab Ransomware (morphisec.com) Packer The first stage is a first shellcode loaded with GloballAlloc and VirtualProtect in function 0042df00

the file f5a78a155a219582db8959c3a96a1d91ed891801663b1cce0c599779773bc3f5 uses the version 7 of royal road document. This file drops in memory a new backdoor rewriting the process EQNEDT32.EXE. This document refers to the ceasefire between Armenia and Azerbaijan and seems to be send by the Mongolian authorities. Analysis of the backdoor in memory This backdoor is a state machine launching different…

the decoy document 74aa6fff407dee851f224329489232a8e7f2d6046aaff3c9cebfff81b7d5db22 uses a version of royal road to drop a new bakdoor developped on MFC C++. b19d64d6ef5329b388d688157ebb9f4fa8cae2ccd18ec1fe7bb75b0fcc2350f9 The dectection rate on virustotal is very low: The backdoor is packed with a home made packer. The real entrypoint is call by a thread with the function AfxWinMain at…

In my last article on Chinoxy backdoor, this version has its configuration in a resource called NNKK and it is deciphered. The purpose of this article is to explain the unpacking and deciphering of the configuration of this backdoor. The backdoor is loading with the program confax.exe, a utility…

This article is a bit different of the others. The goal is to show how to follow your virustotal hunting with Yeti and Pandas. With Virustotal Hunting, you can follow samples submitted by the users with yara rules. If a sample matches with a rule, you receive a notification and…