Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This tutorial provides an in-depth analysis of a malware infection chain using shellcode generated by the Donut tool. It covers various stages of the attack, including initial download, trace concealment, and final payload delivery. The tutorial aims to familiarize readers with common analysis tools like dnSpy, IDA Pro, x64dbg, and ProcessHacker, while demonstrating both static and dynamic analysis techniques. It highlights malware behaviors such as dynamic API resolution, process injection, and AMSI bypassing. The excerpt focuses on analyzing an unknown function in the shellcode, explaining PC-relative addressing and position-independent code techniques used by malware to access resources.

The provided information describes a detailed malware analysis tutorial focusing on a malware infection chain that utilizes shellcode generated by the Donut tool. Donut is a known tool for converting executables or DLLs into position-independent shellcode, which can be injected into processes to evade detection. The tutorial covers multiple stages of the attack lifecycle, including the initial download of the malware, techniques for concealing traces of the infection, and the delivery of the final malicious payload. It highlights advanced malware behaviors such as dynamic API resolution, which allows malware to locate and invoke Windows API functions at runtime without static imports, process injection techniques (T1055) to execute code within other processes stealthily, and AMSI (Antimalware Scan Interface) bypassing (T1140) to evade detection by security products. The analysis also explains the use of PC-relative addressing and position-independent code, which are techniques that enable the shellcode to access resources and execute reliably regardless of its memory location, complicating static analysis and detection. The tutorial employs both static and dynamic analysis tools, including dnSpy for .NET assemblies, IDA Pro for disassembly, x64dbg for debugging, and ProcessHacker for process inspection. The hash indicator provided corresponds to a sample associated with this malware chain but no known exploits in the wild or specific affected software versions are mentioned. The threat is classified as medium severity and does not have an associated CVE or known threat actors. The tutorial is educational in nature, aiming to familiarize analysts with common malware techniques and analysis methodologies rather than describing a new zero-day or widespread active campaign.

Detailed information about A Mega Malware Analysis Tutorial Featuring Donut-Generated Shellcode. Get real-time updates, technical details, and mitigation strate

A Mega Malware Analysis Tutorial Featuring Donut-Generated Shellcode - Live Threat Intelligence - Threat Radar | OffSeq.com

A Mega Malware Analysis Tutorial Featuring Donut-Generated Shellcode

AsyncRAT, a remote access trojan known since 2019, has been rewritten in Rust, marking a shift from its original C# implementation. This change aims to complicate reverse engineering efforts due to limited analysis tool support for Rust. The malware retains its core functionality, including plugin installation, code execution, and persistence. It installs via scheduled tasks or temporary directory copying, stores plugins in the registry, and communicates with command and control servers over TLS. The Rust variant supports fewer commands compared to its .NET counterpart, suggesting ongoing development. The malware collects system information, including hardware ID, OS details, and antivirus software presence. Debug strings in the samples indicate active development of this Rust version.

AsyncRAT is a remote access trojan (RAT) that has been active since 2019, originally implemented in C#. The recent development involves a significant rewrite of AsyncRAT in the Rust programming language. This transition aims to complicate reverse engineering and malware analysis efforts because Rust currently lacks the mature and widely adopted reverse engineering tools available for C# and .NET binaries. Despite the language shift, the Rust variant retains core functionalities such as plugin installation, arbitrary code execution, and persistence mechanisms. Persistence is achieved by creating scheduled tasks or copying itself into temporary directories. Plugins are stored in the Windows registry, allowing modular expansion of capabilities. Communication with command and control (C2) servers is conducted over TLS-encrypted channels, enhancing stealth and evasion of network detection mechanisms. The Rust variant currently supports fewer commands than its predecessor, indicating it is under active development and may expand capabilities over time. The malware collects detailed system information, including hardware identifiers, operating system details, and the presence of antivirus software, which can be used for environment reconnaissance and tailoring attacks. Debug strings found in samples confirm ongoing development efforts. Indicators of compromise (IOCs) include specific file hashes and domains used for C2 communication, such as backup-tlscom.sytes.net, magic-telecom.ddns.net, and mohsar.ddns.net. No known exploits leveraging this Rust variant are reported in the wild yet, and the threat is assessed at a medium severity level due to its evolving nature and potential for stealthy persistence and control.

Detailed information about Reborn in Rust: Attempt to thwart malware analysis. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'reverse engineering'

Filter Threats

Threats Tagged 'reverse engineering'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility