Category: Malware Analysis

Articles tagged Malware Analysis

Filters
Malware Analysis

TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

TELEPUZ is a modular malware that emerged through CLICKFIX-VIDAR attacks in April. We reverse-engineered it to show you the infrastructure and evasion techniques that matter.

Cyril François
Malware Analysis

ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

Elastic Security Labs tracks REF6045, an active operator-assisted banking fraud operation targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges.

Jia Yu Chan
Malware Analysis

Lost in relocation: analysis of a new loader distributing CASTLESTEALER

Find out how a new obfuscated loader evades static detection using .reloc section abuse, five anti-VM/language checks and MBA obfuscation to deliver infostealer malware via Google Ads.

Daniel Stepanic
Malware Analysis

PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT

Elastic Security Labs presents a detailed reverse-engineering analysis of PHANTOMPULSE, the long-lived RAT delivered to crypto-sector victims through the REF6598 intrusion set.

Salim Bitam
Malware Analysis

TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

REF3076 uses a trojanized Logitech installer to deploy TCLBANKER, a Brazilian banking trojan with environment-gated payloads, WPF fraud overlays, and self-propagating WhatsApp and Outlook worm modules.

Jia Yu Chan
Malware Analysis

Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT

Elastic Security Labs uncovers a novel social engineering campaign that abuses the popular note-taking application, Obsidian's legitimate community plugin ecosystem. The campaign, which we track as REF6598, targets individuals in the financial and cryptocurrency sectors through elaborate social engineering on LinkedIn and Telegram.

Salim Bitam
Malware Analysis

Hooked on Linux: Rootkit Detection Engineering

In this second part of a two-part series, we explore Linux rootkit detection engineering, focusing on the limitations of static detection reliance, and the importance of rootkit behavioral detection.

Ruben Groenewoud
Malware Analysis

Inside the Axios supply chain compromise - one RAT to rule them all

Elastic Security Labs analyzes a supply chain compromise of the axios npm package delivering a unified cross-platform RAT

Ruben Groenewoud
Malware Analysis

Fake Installers to Monero: A Multi-Tool Mining Operation

Elastic Security Labs dissects a long-running operation deploying RATs, cryptominers, and CPA fraud through fake installer lures, tracking its evolution across campaigns and Monero payouts.

Jia Yu Chan
Malware Analysis

Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework

Elastic Security Labs analyzes VoidLink, a sophisticated Linux malware framework that combines traditional Loadable Kernel Modules with eBPF to maintain persistence.

Ruben Groenewoud
Malware Analysis

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

SILENTCONNECT is a multi-stage loader that leverages VBScript, in-memory PowerShell execution, and PEB masquerading to silently deploy the ScreenConnect RMM tool.

Daniel Stepanic
Malware Analysis

Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft

In this first part of a two-part series, we explore Linux rootkit taxonomy, trace their evolution from userland shared object hijacking and kernel-space loadable kernel module hooking to modern eBPF- and io_uring-powered techniques.

Remco Sprooten