Tag: CyberSecurity

Arechclient2 Malware Analysis (sectopRAT)

Anurag8 Comments

Overview

Arechclient2, also known as sectopRAT, is a Remote Access Trojan (RAT) written in .NET. This malware is highly obfuscated using the calli obfuscator, making its analysis challenging. Despite attempting deobfuscation using calliFixer, the code remained obfuscated but was still somewhat readable using dnSpy.

The sample analyzed has the following characteristics:

File Hash: EED3542190002FFB5AE2764B3BA7393B
File Size: 768KB
Original File Name: Bluefin.exe
File Type: .Net
Obfuscation Technique: calli obfuscator
Mutex Name: 49c5e6d7577e447ba2f4d6747f56c473
VT Detection: 61/72
File Download: any.run

Static Analysis

Obfuscation Technique

The malware is obfuscated using the calli obfuscator, as identified using Detect It Easy (DIE).

Attempts to deobfuscate the code using CalliFixer were unsuccessful, as shown below:

Extracted Strings

Extracting strings from the executable revealed significant indicators of the malware’s capabilities. Some of the key strings found include:

  • Browser Data Extraction: URL, User, Password0, AccountT, BrowserExtension, AutofillT, Logins, Cookies7, os_crypt, LocalState, encrypted_key
  • System and Hardware Information: HardwareType, OSVersion, Machine, ReleaseID, Language, ScreenSize, TimeZone, IPv4, Monitor
  • Installed Software and Processes: AvailableLanguages, Softwares, Processes, SystemHardwares
  • Targeted Applications and Services: Nord, Open, Proton (VPNs), Steam, Discord, Telegram, FTP, ScanBrowsers, ScanFiles, ScanFTP, ScanWallets, ScanScreen
  • Data Exfiltration and Storage: FileLocation, SeenBefore3, FileScannerArgT, OfApplication, Directory, Pattern, Recoursive7

Observed Functionalities

Upon analyzing the decompiled code, several key functionalities were observed:

  • Scanning and gathering information about installed web browsers, including browser extensions and stored credentials.
  • Extracting cookies, usernames, passwords, and autofill data.
  • Scanning the system for installed VPN services such as NordVPN and ProtonVPN.
  • Collecting system information, including hardware details and OS specifications.
  • Looking for installed game launchers, Telegram, and Discord configurations.
  • Scanning for FTP connections and stored credentials.
  • Searching for wallet configurations, indicating potential interest in cryptocurrency theft.

Dynamic Analysis

Upon execution in a controlled environment, the malware exhibited network-based behaviors, connecting to a remote Command and Control (C2) server:

  • C2 Server IP: 91.202.233.18
  • Port: 9000
  • Port:15647

  • Downloaded Files:
    • manifest.json (Defines the extension’s name, permissions, and scripts)
    • content.js (Core malicious script for keylogging and data theft)
    • background.js (Bypasses security restrictions and transmits stolen data)

Malicious Chrome Extension Disguised as “Google Docs”

The downloaded files are part of a Google Chrome extension masquerading as “Google Docs.” This extension is a stealthy data-stealing tool designed to exfiltrate user input across all websites. The files were retrieved from the following URL:

  • Download URL: http://91.202.233[.]18:9000/wbinjget?q=9A7A4DFA51C1DFA51C1DFC689A43860F0BECA70

Its functionality is split across three key files:

  • manifest.json
    • Declares the extension’s name and description (misleading claim of Google Docs offline editing)
    • Grants broad permissions, including , allowing script injection across all web pages
  • content.js
    • Injects event listeners into every webpage
    • Monitors and captures all user input fields (textboxes, checkboxes, dropdowns, buttons, text areas)
    • Sends recorded data, including usernames, passwords, credit card details, and form data, along with the URL to the attacker’s server
  • background.js
    • Acts as a middleman to bypass browser security policies
    • Uses browser permissions to make unauthorized HTTP requests to an external attacker-controlled server
    • Relays stolen data from content.js to the remote server
Installed Google Chrome Extension
Dropped JavaScript code and Json file.

Additionally, during debugging, it was observed that the malware connects to an external URL:

  • URL: https://pastebin.com/raw/wikwTRQc
  • Sandbox Analysis: The webpage at this URL contains the same IP (91.202.233.18)

Further Payload Analysis

During analysis, no additional payloads were observed being dropped or executed. However, given the RAT’s capabilities and network behavior, it is possible that further payloads may be delivered dynamically by the C2 server depending on the victim’s environment.

Indicators of Compromise (IoCs)

File Hashes

  • EED3542190002FFB5AE2764B3BA7393B

C2 Servers

  • 91.202.233.18:9000
  • 91.202.233.18:15647

Malicious URLs

Mutex

  • 49c5e6d7577e447ba2f4d6747f56c473

Security Implications

This malicious extension operates as a coordinated data-harvesting tool, capturing nearly all user input and exfiltrating it to a remote C2 server. The misleading name, broad web access, and ability to evade browser security make it a severe threat.

Recommendations:

  • Block network traffic to 91.202.233.18:9000 and 91.202.233.18:15647.
  • Monitor %AppData%/Local/llg for suspicious file creations.
  • Remove any unknown Chrome extensions, particularly those masquerading as Google Docs.
  • Use behavioral-based threat detection to identify suspicious activities.
  • Restrict execution of untrusted .NET applications.

This analysis highlights the evolving threats posed by obfuscated RATs and malicious browser extensions, emphasizing the need for enhanced security monitoring and strict browser extension controls.

If you found this analysis helpful, consider following my blog for more in-depth malware research and cybersecurity insights!

NanoCore RAT Malware Analysis

Anurag1 Comment

NanoCore is a well-known Remote Access Trojan (RAT) used by threat actors for espionage, data theft, and system control. In this post, I will analyze a NanoCore RAT sample with the hash 18B476D37244CB0B435D7B06912E9193 and explore its behavior, obfuscation techniques, and deobfuscation process.

File Hash MD5: 18B476D37244CB0B435D7B06912E9193
Filename: Sigmanly_0bbff62a45fc9776575ed143af2d7db332e2781d7e3de56eb3ff48c25d0c7b46
File size: 203.00 KB
NanoCore Client Version: 1.2.2.0
VirusTotal Detection Score: 64/72
File download: any.run

Static Analysis

Initial Inspection

Using Detect It Easy (DIE), I identified that the sample is a .NET executable and employs Eazfuscator obfuscation to hinder analysis.

Deobfuscation

To analyze the code effectively, I used de4dot to deobfuscate the executable. de4dot successfully restored readable class and method names, making it easier to understand the malware’s logic.

Below is how the deobfuscated code appears now.

Strings Analysis

Using SysInternals Strings, I extracted various strings from the binary and found the following indicators:

  • “Connecting to {0}:{1}..”
  • “/create /f /tn “{0}” /xml “{1}””
  • “schtasks.exe”
  • “CreateScheduledTask”
  • “/run /tn “{0}””
  • “RunScheduledTask”
  • “Host: {0}”

These strings indicate that the malware uses Windows Task Scheduler for persistence and C2 communication.

Dynamic Analysis

To gain deeper insights, I used dnSpy to debug the code and analyze its behavior in a controlled environment.

Execution Flow Analysis

Startup Routine: NanoCore attempts to achieve persistence by copying itself to a hidden directory and creating a registry entry.

  • During dynamic analysis, I found that it adds saasmon.exe under the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key.
  • It also creates a folder at C:\Program Files (x86)\SAAS Monitor to store its components.
  • Another folder is created at C:\Users\User\AppData\Roaming\81E42A3A-6BA0-4784-B7EC-E653E9E1A8ED, where the SAAS Monitor folder is placed, and saasmon.exe is dropped.

C2 Communication: The RAT connects to a remote Command-and-Control (C2) server, enabling an attacker to issue commands.

  • Wireshark Analysis: The malware attempts to establish connections to:
    • simpletest.ddns.net (Potential C2 domain)
    • 8.8.8.8 (Google DNS, likely used for connectivity checks)
    • Uses port 9632 to communicate with the given IP.
  • Plugin System: NanoCore features a modular plugin system, allowing attackers to load additional capabilities dynamically.
  • Installed Plugins: During dynamic analysis, I found that NanoCore installed the SurveillanceEx plugin, which enhances its spying capabilities.

  • Data Exfiltration: Captures keystrokes, screenshots, and clipboard data, sending them to the attacker.
  • It stores keylogs and clipboard data in C:\Users\User\AppData\Roaming\81E42A3A-6BA0-4784-B7EC-E653E9E1A8ED\logs\users\kbxxxxx.dat.

In the image above, you can see that it is storing clipboard data along with the commands and text I was entering in applications.

Task Scheduler Analysis: The code contains functions to create a scheduled task using schtasks.exe, but during dynamic analysis, no scheduled task was actually created. Below is an image of the relevant code snippet that shows its intent to use Task Scheduler for persistence.

Indicators of Compromise (IOCs)

  • File Hash: 18B476D37244CB0B435D7B06912E9193
  • Network Indicators: (Extracted from dynamic analysis)
    • C2 Domain: simpletest.ddns.net
    • IP Contacted: 8.8.8.8 (Google DNS, may be used for connectivity checks)
    • Port: 9632
  • Registry Changes:
    • HKCU\Software\Microsoft\Windows\CurrentVersion\Run\saasmon.exe
  • File System Changes:
    • C:\Program Files (x86)\SAAS Monitor\saasmon.exe
    • C:\Users\User\AppData\Roaming\81E42A3A-6BA0-4784-B7EC-E653E9E1A8ED\SAAS Monitor\saasmon.exe
    • C:\Users\User\AppData\Roaming\81E42A3A-6BA0-4784-B7EC-E653E9E1A8ED\logs\users\kbxxxxx.dat (Stores keylogs and clipboard data)

Conclusion

NanoCore RAT remains a persistent threat due to its modularity and extensive feature set. Through deobfuscation with de4dot and debugging with dnSpy, I was able to uncover its core functionalities. Defenders should stay vigilant by leveraging threat intelligence, monitoring network traffic, and applying proactive security controls.

If you found this analysis helpful, feel free to share and stay tuned for more in-depth malware research!

Beware of “Your Account Has Been Hacked. You need to unlock” Scam Emails: Stay Safe Online

Anurag2 Comments

Scam emails claiming that your account has been hacked are alarmingly common. These emails exploit fear, embarrassment, and urgency to pressure victims into transferring money, often in the form of cryptocurrency. A common scam starts with the subject line: “Your account has been hacked. You need to unlock.”

What Does the Scam Look Like?

Subject: Your account has been hacked. You need to unlock

Sender: Billy Harrington <info@azurepavillion>

Hello!

I have to share bad news with you. Approximately a few months ago, I gained access to your devices, which you use for internet browsing. After that, I have started tracking your internet activities.

Here is the sequence of events:

Some time ago, I purchased access to email accounts from hackers (nowadays, it is quite simple to buy it online).

I have easily managed to log in to your email account. One week later, I have already installed the Cobalt Strike "Malware" on the Operating Systems of all the devices you use to access your email.

It was not hard at all (since you were following the links from your inbox emails). All ingenious is simple.

This software provides me with access to all your devices controllers (e.g., your microphone, video camera, and all on it).

I have downloaded all your information, data, photos, videos, documents, files, web browsing history to my servers.

I have access to all your messengers, social networks, emails, chat history, and contacts list.

My virus continuously refreshes the signatures (it is driver-based) and hence remains invisible for antivirus software.

Likewise, I guess by now you understand why I have stayed undetected until this letter.

While gathering information about you, I have discovered that you are a big fan of adult websites.

You love visiting porn websites and watching exciting videos while enduring an enormous amount of pleasure.

Well, I have managed to record a number of your dirty scenes and montaged a few videos, which show how you masturbate and reach orgasms.

If you have doubts, I can make a few clicks of my mouse, and all your videos will be shared with your friends, family, and relatives.

Considering the specificity of the videos you like to watch (you perfectly know what I mean), it will cause a real catastrophe for you. I also have no issue at all with making them available for public access (leaked and exposed all data).

General Data Protection Regulation (GDPR): Under the rules of the law, you face a heavy fine or arrest. I guess you do not want that to happen.

Here is what you need to do - transfer the Bitcoin equivalent of 12000 USD to my Bitcoin account (that is rather a simple process, which you can check out online in case if you do not know how to do that).

Below is the Bitcoin account information (Bitcoin wallet):
1HLn1GNBvENxZH5r2mNAgEVwjySyRTZGKQ

Once the required amount is transferred to my account, I will proceed with deleting all those videos and disappear from your life once and for all.

Kindly ensure you complete the abovementioned transfer within 50 hours (2 days +).

I will receive a notification right after you open this email, hence the countdown will start.

Trust me, I am very careful, calculative and never make mistakes. If I discover that you shared this message with others, I will straight away proceed with making your private videos public.

Good luck!

  1. Fake Claims of Hacking
    The scammer alleges that they have gained access to your email account and devices through malware or by purchasing access from other hackers.
  2. Threats to Expose Sensitive Information
    They claim to have recorded compromising activities (often fabricated) using your webcam or other devices and threaten to share this material with your contacts.
  3. Demand for Payment
    The email demands a payment, typically in Bitcoin, to prevent the supposed release of your private information. A countdown is often given to create urgency.
  4. Technical Details to Appear Credible
    The email may mention malware like “Cobalt Strike” or other tools to intimidate recipients and make the threat seem legitimate.
  5. Warnings Against Reporting
    Scammers caution victims against sharing the email with anyone, claiming they will release the sensitive information if the email is reported.

What is Cobalt Strike?

Cobalt Strike is a cybersecurity tool designed for penetration testing. It helps security professionals simulate real-world cyberattacks to test the resilience of networks. The software provides features like payload generation, command and control (C2) communication, and post-exploitation tools to mimic the actions of hackers.

However, cybercriminals often misuse it for malicious purposes. They use Cobalt Strike to deliver malware, maintain access to compromised systems, and exfiltrate data. Its stealth features, such as evading detection by antivirus software, make it a popular choice among attackers. Originally meant for ethical hacking, it highlights the fine line between testing defenses and exploiting vulnerabilities.

Email Header Analysis

Understanding email headers is crucial for identifying the source of scam emails. Here’s an analysis of the header details from the scam email:

Source Server: The email originated from static-185-95-84-74.sunucuhub.com with the IP address 185.95.84.74. This server appears to belong to a suspicious or unverified host.

Helo Address: The sender’s system introduced itself as static-84-74.corelux.net, which may be a fake or compromised server.

Relaying Server: The email was relayed through vps2.webfruit.space using secure email transmission (esmtpsa) with TLS encryption (TLS1.2).

Envelope Sender: The email claims to be from <info@azurpavillon.com>, but this could easily be spoofed.

Sender IP address VirusTotal Score: 8/94

The sender’s IP address, 185.95.84.74, has a VirusTotal score of 8/94, indicating that 8 out of 94 security vendors flagged it as malicious or suspicious. A score of 8 is a strong indication that this IP is associated with potentially harmful activities, such as phishing or malware distribution. This reinforces the likelihood that the email is part of a scam. Always verify suspicious IP addresses using tools like VirusTotal to assess their reputation and avoid engaging with emails originating from flagged sources.

Why You Shouldn’t Fall for It

  1. No Evidence of Actual Hacking
    The email lacks concrete proof, such as a specific password or verifiable detail about you. The threats are generic and designed to instill fear.
  2. Claims Are Technically Improbable
    • Modern operating systems and antivirus software make it difficult for malware to remain undetected for months as described.
    • Webcam access typically requires explicit permission, making the claims of recorded activities suspect.
  3. Bitcoin Transactions Are Irrecoverable
    Scammers use cryptocurrency because it is hard to trace and impossible to reverse once sent.

What to Do If You Receive Such an Email

Step 1: Do Not Panic
Remember, this email is likely a phishing attempt and not evidence of an actual security breach.

Step 2: Do Not Reply or Pay
Responding or paying only validates your email address as active, making you a target for future scams.

Step 3: Verify Your Account Security

  • Change your email password and enable two-factor authentication (2FA).
  • Scan your devices with updated antivirus software to ensure no malware is present.

Step 4: Blog the Sender
Mark the email as spam and block the sender’s address.

Bitcoin Wallet Address

The Bitcoin address provided in the scam email has been verified and shows no transactions to date. This suggests that the scammer’s attempt to extort money may not have been successful yet. It is also possible that the scammer is using this address as part of a broader campaign, hoping to intimidate multiple victims into making payments. The absence of transactions does not diminish the threat, as such tactics are designed to exploit fear and urgency. Verifying cryptocurrency addresses can provide insights into scam campaigns, and reporting them helps prevent potential victims from falling into the trap.

Final Thoughts

Scam emails like “Your account has been hacked. You need to unlock” prey on fear and lack of technical knowledge. Staying calm, taking practical steps, and understanding how these scams operate can protect you from falling victim. Always prioritise account security, and never hesitate to report scams to the authorities. Stay safe online!

Understanding and Identifying a Common Phishing Scam: “Your Device is Hacked”

Anurag2 Comments

Phishing emails continue to be a common and sophisticated way for cybercriminals to extort money and sensitive information from unsuspecting individuals. A recent example is an alarming email with the subject line “Your device is hacked,” which tries to create panic, demanding a Bitcoin payment to avoid further consequences.

Subject: Your device is hacked
 
Good day!

I have to bring something urgent to your notice - you are facing a major challenge. However do not worry just yet; I want you to hear me out, because there's invariably a way to resolution.

Right at this moment, you are subject to the examination of an global web of intruders, and that is a condition that infrequently ends favorably for anyone participating. You may have been informed of groups like Anonymous, nevertheless I guarantee you, we're working on an completely different scale - far beyond what they can offer. Our vast global community comprises countless of proficient experts, each playing a critical role.

Some of our team concentrate on breaching corporate and state systems, while others work stealthily with security agencies on classified missions. My role involves addressing issues tied to clients like you, which is why I am reaching out now.

You might be pondering, "Who are these individuals?" The response is clear: we're concentrated on those with a penchant for alternative and contentious mature content - material that many would deem unsuitable. Nevertheless evidently, you don't fit that type, right?

Allow me to elucidate how I found out this circumstance. A few of weeks ago, we installed stealthy spyware on your device, allowing us access to each your gadgets, including your cellular device. It was straightforward; one of those seemingly harmless pop-ups on private sites served as our entry point.

The good news is you still have a chance to take command of this issue. Let's discuss how you can guard yourself and regain your mental tranquility. Your next moves matter - act intelligently.

We both understand that many people engage in common or even more severe adult content - nothing uniquely unique about that. Nevertheless, the content you've decided to watch transcends a threshold into troubling area.

We've accessed your mobile device and laptop cameras and captured footage of you engaging in acts that are quite debatable. This includes intimate images of you along with the explicit material you were observing.

But remember, there's invariably a path to redemption, including for those who've wandered far. Today, you are blessed because my purpose isn't to inflict pain; I'm simply concentrated on a financial resolution.

This is an opportunity for you to assert control of the situation. Let's talk about how we can resolve this issue cordially.

Here is your rescue: you need to convey $1300 USD in Bitcoin to this digital currency address:
1JxQSshVKAqB9JxuUjmdEDrPN6TM7PzK9D

Let's confront it, that's a fairly insignificant sum in today's society.

I'm reaching out you with an urgent communication that demands your swift attention. You have just 12 hours to complete the payment. Do not delay - act now to safeguard yourself.

As soon as I receive of your transaction, I'll without delay remove all compromising content and fully turn off our computer system. I guarantee you, I honor my promises, even with those who may not fully earn confidence; this is strictly professional.

Nevertheless, if compensation is not received, I will be forced with no choice however to share the damaging videos with everyone in your network - companions, kin, coworkers, associates - everybody. Imagine the unrecoverable damage to your image. This is a blemish that can not ever be fully removed.

The outcomes of doing nothing will not only blemish your identity but could bring you to a point of hopelessness. It is essential to act swiftly.

If you're unfamiliar with digital currency, don't fret - it is easy. A quick search for "cryptocurrency marketplace" will show you how to complete a payment using your credit card. Given your virtual presence, you seem able of handling this with simplicity. Keep in mind, if you've competently traversed the depths of the online world before, this will be no hurdle for you.

Some key reminiscents to reflect on:

- Don't reply to this e-mail. This address is disposable, and any feedback will serve no function.

- Forget about law enforcement. The moment I detect any communication to the police, I will release the data without hesitation.

- Do not attempt to restore or dispose of your gadgets. Such steps are ineffective. My monitoring capabilities mean that I can track your all step.

- It's unfortunate that conditions have brought us here; you could have prevented this situation with more caution online. Be mindful in the future - what seems trivial today can have disastrous consequences tomorrow.

This message is intended as a last notification. Your response in the next 12 hours will determine the consequence of this situation.

Remember, the countdown is running, and the decision is in your control.


Postscript:

If your friends and colleagues were to discover the unethical things you engage in, it could severely harm your relationships and standing. Faith, once damaged, is hard to rebuild, and you might be viewed through a filter of criticism and confusion. This exposure could lead to social isolation, as people may distance themselves from you, being concerned about connection with your behaviors. The taint associated with atypical actions may cause isolation, misinterpretations, or even a damaged image that could hinder your profession possibilities. It is essential to think about the long-term effect this could have on your existence and the connections you value.

In this blog, let’s break down this email and highlight key indicators that mark it as a phishing scam. Recognizing these elements can help you identify similar threats and protect your digital safety.

1. Emotional Manipulation and Psychological Triggers

The first tactic cybercriminals employ is fear. By threatening exposure or embarrassment, they manipulate emotions to push victims into hurried actions. This email opens with an intimidating statement: “you are facing a major challenge.” It follows up with false claims about an elaborate network of hackers monitoring your devices, pushing the recipient into a state of urgency and vulnerability.

2. Specific, Yet General Accusations

The email insinuates that it has incriminating content recorded from the victim’s devices, which could be used for public exposure. However, no specific details or personal information are provided, a common tactic in phishing schemes to keep the accusation vague but ominous. The email accuses the recipient of accessing “controversial mature content” without citing any actual details, casting a wide net to increase its chances of striking fear in potential victims.

3. Unverifiable Technical Claims

Phishing scams often include technical jargon or exaggerated claims to make the message sound more credible. This email alleges that “spyware” was installed through “harmless pop-ups” and implies constant monitoring of all devices. In reality, no malicious software can be this all-encompassing or omniscient. Malware usually requires direct or indirect user permission, such as through a fake download or link, to infiltrate systems.

4. Demand for Payment in Bitcoin

Most phishing emails demand payment in Bitcoin, as cryptocurrency transactions are anonymous and difficult to trace. Here, the email demands $1,300 in Bitcoin within 12 hours, setting a time frame that plays on urgency and limits a recipient’s chances to think critically or consult others.

The specified BTC address has not shown any transactions to date, which thankfully indicates no victims so far.

5. Warnings Against Law Enforcement and No Replies

The sender advises against contacting the police or even responding to the email. By isolating the victim from potential help, the scammer creates a psychological barrier, further increasing the chances of compliance. Additionally, they specify that the email is from a “disposable address,” which reinforces that any reply will be futile.

6. Technical Red Flags in the Email Header and Sender Information

A quick analysis of the email header and sender address reveals additional signs of phishing. Although the sender appears as “Lewis Ray info[@]pdparis.com,” the header details a different server (hostglobal.plus) and an untrustworthy IP address with a VirusTotal score of 10/94. This indicates that the IP has previously been associated with malicious activity, solidifying suspicions that this email is not legitimate.

The email header above indicates that the message was received from IP address 78[.]153[.]140[.]175, which has a VirusTotal score of 10/94.

Protective Steps to Take

  • Do Not Reply or Pay: Responding or paying emboldens attackers and makes you a potential target for future scams.
  • Check Your Security: Ensure that your antivirus and software updates are current. Run scans to ensure no malware or spyware is on your devices.
  • Educate and Stay Vigilant: Familiarize yourself with common phishing tactics and educate family or colleagues who may be less aware of cybersecurity risks.

Final Thoughts

Emails like this serve as a reminder of the importance of staying informed about phishing tactics and practicing good cyber hygiene. By recognizing the tactics outlined in this scam email, you can better protect yourself and avoid falling victim to extortion attempts. Remember, if something feels suspicious, it probably is—take a moment to verify, breathe, and never rush to respond to threats like these.