☩MalwareMustDie

Okay, listen up. THIS (see prev thread) #malware campaign is on-going, even now. Adversaries are in control of these .INFO domains: crystalogletree[.]info, coraliereinger[.]info and kevinsaad[.]info, Which they are spreading infection campaign relayed from various IP MTA located in this subnet 160[.]250.128.0/23 at AS150895/EZ TECHNOLOGY CO LTD, I attached. email they used for the infection. Chains infection: docx -> rtf -> xml obj #cve-2017-118822 load shellcode to decrypt & load another shellcode to execute malicious script in rtf (there are license.vbs/.js/Client.vbs) that downloads python312x86()zip contains evil Protected(py) to be persistence installed & executed, or execute a DLL binary of "license(.)ini" to be injected to into process. That evil python is lastly served at sendspace(.)com/pro/dl/5qcr3i So all of scripts used & binary will be heavily obfuscated. They tried hard to evade all checks and aiming unpatched #EQEDIT on older #msoffice app. The above #IOC and #CTI info should be their #TTP so use information above to #block ur network in anyway you can. Just saying, in a glimpse, it seems like adaptation of previously known as #hancitor docx campaign added w/ AI steroid. No, this isn't emotet, and no this is not Heodo/Geodo but could be the copycat. #MalwareMustDie!!

Well, the adventure continues.. w/same bad-actors (pivoted attackers spambot: 160[.]250.128.165/VN) who's very eager to do more #malware CTF with me. But.. the endgame is now different...an AI generated hash-obfuscated DLL loader.. See the pics of details & links (it has my hint to crack the hash), below is chain of infections: docx: virustotal.com/gui/file/467f… rtf: virustotal.com/gui/file/4289… DLL loader: virustotal.com/gui/file/1a11… #MalwareMustDie!

(smile) Someone at 160[.]250.128.122 spammed me w/docx email attachment..(downloader), it downloaded Protected.py (a persistent installer),then runs classic shed api shellcode with reversed shell injected to SndVol..(snipped part sc).. to bad..no reg+SndVol in #BSD