Hi everyone, I started learning malware recently, sorry for my lack of knowledge in malware. My teacher assigned me a project called "Methods for creating variants of malware embedded in pdf files". I'm having trouble classifying PDF malware variants and finding methods for creating them. I've read some research about PDF malware. They are classified into JavaScript-based and non-JavaScript-based. In another document, they are classified into OpenAction feature, Launch action, Embedded files, GotoEmbedded action, and URI action. Can I ask your opinion about how you classify variants of PDF malware?

https://unit42.paloaltonetworks.com/frostygoop-malware-analysis/

PUCF - Potentially Unwanted Chromium Fork

This article provides a structured guide for individuals aiming to develop expertise in malware analysis and reverse engineering.

It outlines essential skills, recommended tools, and practical steps to build proficiency in this specialized cybersecurity domain.

Mastering malware analysis and reverse engineering is a progressive journey that demands a solid foundation in computer science, programming, and operating systems.

The roadmap emphasizes the importance of understanding assembly language, familiarizing oneself with various tools, and engaging in continuous practice through real-world scenarios.

By following this structured approach, individuals can develop the necessary skills to effectively analyze and counteract malicious software threats.

Video

Writeup

I am doing some research and I am interested in looking at some Chinese databases, basically the Chinese equivalent of „Mitre ATT&CK Groups“. Ideally, it would be an official release from the government, but from a Chinese cybersecurity company is also okay.

Can anyone point me in the right direction or share a link?

It does not matter if it’s in Chinese language.

Thanks in advance!

I am trying to create a User-mode rootkit detection program(as it seems suitable right now for my level, as kernel-level rootkit detection seems daunting, although I want to try that later when I have done this one), which uses signatures based detection and integrity checks for detection . I will be using python for this project.

However, I have been facing dilemma regarding should I create the signatures myself by analyzing the samples or would you suggest using some other tools like virus total, and malware bazaar ( I don't know must about these tools, I was suggested these by other people in the internet, however I have been doing some malware analysis and have some knowledge in it).

Some of the resources I have goon through:

1. Application level rootkit detection program for debian 9.8 by Batsal Nepal
2. The Rootkit arsenal
3. Fast User-Mode Rootkit Scanner for the Enterprise Yi-Min Wang and Doug Beck– Microsoft Research, Redmond

If anyone has done something like this before and provide me with more resources related to rootkits I would be grateful.

I have read about detection process as well but not able to find much resources about it. So if you know any resources please share so that I could understand the process for detection even better.

If anyone was created some similar projects are knows about some project share your project so I could learn more.

Hey all I have a proxmox instance running in a laptop on a separate VLan with 2 boxes (flare VM and remnux), Within my edge router I have a firewall rule setup to deny any packets from the malware Vlan to my other vlans, but allows connecting into the malware vlan from my other vlan so that I can rdp in to the machines.

Does this sound secure?, would you recommend any other changes?

Last thing I need to do is create another Vlan within proxmos so that I can get Inetsim working.

Hi. I'm looking to further my knowledge in malware development. for now all I can do is teach myself from what's freely provided. Do you guys know of any good books/resources I can learn malware development from in depth, especially as a beginner. I just started familiarizing myself with all this computer stuff, and recently learnt to use python and its basics. Any help will be appreciated.

For almost 5+ years, there was a stealer called Redline/Meta. While the second one is pretty much new, they both operated on the same servers. But their time's over:

"On the 28th of October 2024 the Dutch National Police, working in close cooperation with the FBI and other partners of the international law enforcement task force Operation Magnus, disrupted operation of the Redline and META infostealers.
Involved parties will be notified, and legal actions are underway." (c) https://operation-magnus.com/

Video, made by Dutch police

title

Hi all,

I’ve been waiting over 7 months for a Triage API key, but my status is still “pending.” Does anyone have advice on getting access, or possibly let me use theirs?

Feel free to add me on Discord @_h3 if you can help. Thanks!

Does anybody at all recognize a R.A.T named Phoenix in 2022? Due to my exit of the cyber community, I lost track of it and now I'm trying to figure out if its name was changed or if the owner completely abandoned the project.

I've tried posting this on r/asus and r/techsupport but they are too thick headed.

This asus lan driver from asus site for Z790 e Gaming wifi is malware.

http://virustotal.com/gui/file/93fc1c1b990f8cabf405cf4910c9879eefd53ace9423e10434d59410c5bde5ab/detection

If you go behavior tab you can see it dropping fake Google Updater files and doing stuff with WER.

Can someone please confirm this.

EDIT 11/6: No reply from asus. You do not need to install driver from asus. The Ethernet controller is a intel chipset so you can download driver directly from intel. Just download the network adapter pack, extract, right click 'Ethernet controller' in device manager. Update driver and browse my computer, then just select the intel 'Release ...' folder u extracted. And driver will be auto installed and Ethernet will work. I didn't scan the intel for virus.

https://youtu.be/oUi5MNhHitw

A few days ago I received a message to a friend that I haven't spoken to a while on discord. They told me that they had a game project titled "Yemoza" that they worked on with friends and they wanted me to test it. Upon installing it it crashed my discord and my firefox and he informed me that I was hacked. he sent me passwords that he stole. Of the 6 he grabbed only 2 we're right, one of them being my discord. Shortly after I was kicked out. I deleted all traces of it, cleared all cache and temporarily files, did several virus scans using several platforms, and changed all my passwords. The only thing the hacker truly compromised was my discord but after communicating with discord support I got it back the next day. I haven't been able to find much on this Trojan, so I wanted to shed some light on it and maybe find a little bit more information. If there's anything you know about this virus please let me know

Malware analysis: https://www.vmray.com/latrodectus-a-year-in-the-making/

Good day friends. Hope this complies with the rules.

I'm working on my master's thesis. The project somewhat mirrors what DISCOVER did, so an automated cybersecurity warning generator. Right now, I'm looking for new sources to pull the data from. I'd like to use anything relevant to malware/vuln discussion, so tweets, potentially relevant, subreddits, hacker blogs/forums (anything in english, russian or chinese is fair game), any other social media/blog, anything that can anticipate official reports is welcome. Ideally I'd like to find dumps/datasets, but I'm prepared to scrape.

For now, I'm looking into this dataset on tweets and this more general one, as well as the russian and english forums listed on the wiki. I'm having trouble finding more underground sources.

Any suggestion is welcome, and I thank you for your time.

I used to like RE a lot. It was a fascinating idea in my mind.

After trying everything, I bought 2 courses from Udemy by Paul Chin:

https://www.udemy.com/course/malware-analysis-fundamentals/

https://www.udemy.com/course/malware-analysis-intermediate/

I have only 1 complaint with this that the professor taught only about unpacking a malware dynamically. I'm shocked that nobody over the whole internet has written in any of their blogs that you had to bp a freaking WinAPI and save it as a dump. That's it. I just paid few dollars solely for this "secret". I couldn't find a single blog or article about it.

Now, next hurdle, same situation. I don't know what to do with the unpacked executable. I know x86 assembly and C language but staring on disassembled malware on Ghidra is totally different skill but the sad part is no helping material to learn this skill.

I tried searching up for many real world malwares' technical analysis to know how experts solve them but there's simply a lack of explanation on why they chose to do this action say inspecting a particular function or using this plugin or script.

Unlike in software development, here nobody shares the thought behind choosing a specific action, it's either use this tool or just straight away follow things as it is.

I couldn't get one nice blog on a latest malware or ransomware which could explain step by step disassembly.

I request you guys to help me know what's wrong with me or am I unfit for this field? It'd be great if you could also provide some good quality resources for reverse engineering malware/ransomware