We’ve previously explained why it’s essential to configure privacy settings before using training trackers — both on your phone in general and within the app itself. Doing so minimizes the risk of exposing your personal data, including your location, to the public. You wouldn’t want just anyone to be able to follow your runs and know exactly where and when to find you offline, would you?

You can check out our already published guides on configuring smartphones and the popular running apps Strava and Nike Run Club. Today, we’re focusing on privacy settings in MapMyRun.

MapMyRun (available for Android and iOS) has a rather interesting history. In September 2024, it was acquired as part of the MapMyFitness suite of apps by the media company Outside (led by CEO Robin Thurston) from the American sportswear manufacturer Under Armour. And Under Armour, in turn, had acquired this suite for $150 million back in 2013 from… Robin Thurston, the very same person who founded MapMyFitness in 2007! So, after 11 years, Thurston regained the company he had founded 17 years earlier.

Setting up privacy in MapMyRun

Unlike many apps, you won’t find the privacy settings under the usual cog icon in the top right corner of the main screen – that’s for workout settings. Instead, tap the three dots in the bottom right corner for iOS, or the three-line “burger” menu in the top left corner for Android, then select Settings (not Privacy Center — that’s something else). On the next screen, choose Privacy.

What should you configure here? First, under Profile Sharing, make sure it’s set to My Friends or, even better, Only me. It’s also a good idea to toggle off the switch next to Find me by email address so people can’t do just that.

Next, check Route Sharing and Workout Sharing and ensure they’re also set to My Friends or, preferably, Only me. Finally, go back to Settings, find Push Notifications, and disable any unnecessary notifications — or just turn them all off with the toggle at the top.

If you decide to stop using MapMyRun, it’s a good idea to delete your account. To do this, navigate to Settings → Privacy Center and choose Delete Account.

If you use other fitness apps to track your workouts, you can set their privacy settings using our guides:

Strava
Nike Run Club
adidas Running (formerly Runtastic) – still to come
ASICS Runkeeper (ditto)

You can also learn how to configure privacy in other apps — from social networks to browsers — on our website Privacy Checker.

And Kaspersky Premium will maximize your privacy protection and shield you from digital identity theft on all your devices.

Don’t forget to subscribe to our blog to stay ahead of scammers with more guides and helpful articles.

Kaspersky official blog – ​Read More

Editor’s note: The current article was originally published on August 16, 2022, and updated on October 21, 2024.

Malware analysis is a challenge as it is. But after your hard work on cracking a new sample, it is important to present all your results to the company and colleagues. And today, we will talk about how to write a malware analysis report in one click. 

How to write a malware analysis report?

To write a typical malware analysis report, you should cover the following points:

Summary. Provide the highlights of your research with the malicious program’s name, origin, and main characteristics.  

General information. Include malware type, file’s name, size, and current antivirus detection capabilities. Don’t forget about hashes: MD5, SHA1, SHA256, and SSDEEP. And if a sample has different family names, it’s worth mentioning them, too. 

Characteristics. Write how the sample infects a system, self-preserves, distributes, communicates with servers, collects data, etc. 

Dependencies. Note malware functionality with the required OS version, software set, executables and initialization files, DLLs, list of URLs, and scripts.

Behavior activities. Give a review of the behavior activities like what executable files malware drops, if it checks the language, runs injected code in another process, or changes any settings.

Static information. Code analysis results, headers information.

Additional data. Attach screenshots, logs, string lines excerpts, etc. 

IOCs. Show indicators of compromise that are necessary for successful detection and future prevention.

Get an automated malware analysis report with ANY.RUN 

It’s essential to save and share your reports for further cybersecurity strategy and investigation. And ANY.RUN sandbox allows you to do it effortlessly and with just one click. 

You can download text reports with detailed information, get PCAP and SSL keys, check request/response content, copy malware config information from the memory dump, use the process graph and MITRE ATT&CK matrix. Besides that, you can export data in JSON format.

We took the RedLine malware sample to show all report examples. 

1. Text reports

Our HTML report is a one-click option to get all data about a sample. It’s a ready-made solution, so you don’t need to write a malware report by yourself. Information is displayed conveniently, so you can easily find whatever you need. 

You can also adjust the document online, share and print it. Also, get the report via API. 

The text report includes all data from the task: 

created processes

events and files in the registry

information about network activity

IOCs

screenshots 

process behavior graph

Depending on your goal, you can customize an HTML report and choose what sections to include. 

2. JSON reports

Download a summary of all task information in JSON format. You can parse the maximum information with this file and analyze precisely the data you need. Then include it in the final report to show all malware footprints.

3. STIX reports

ANY.RUN lets you export collected threat data in the Structured Threat Information eXpression (STIX) format. It is a standardized language used to transfer cyber threat intelligence in a consistent and machine-readable format.

The provided report contains a variety of data related to the threat analysis, including the link to the sandbox session, hashes, network traffic details, file system modifications, TTPs, and more.

To export data in STIX:

Run your analysis in the ANY.RUN sandbox or open any report from Public submissions.

Click Export.

Choose STIX from the list of options.

These reports can be ingested by Security Information and Event Management (SIEM) systems and other automated tools, enabling faster and more efficient threat detection and response.

Using STIX reports, your analysts and incident response teams can share threat data across different platforms in a more convenient way.

4. PCAP and SSL keys

One of ANY.RUN features is to intercept network traffic. SSL Keys and network dump in a PCAP format are available for your report and further analysis. Just download it from the task and include it in your final report.

5. Request/response content

Take a look at the content from HTTP/HTTPS requests and responses. Besides, connection streams are also available. You can also investigate the header’s query. And this data should be highlighted in the report. 

6. Malware configuration 

ANY.RUN extracts the content of the malicious process’s memory dump, so you can dive into analysis with malware configuration: encrypted strings, IP addresses, ports that communicate with the C2 server, family name, version, mutex, and other data.  

7. Process graph 

One of the most effective ways to get a summary of malicious execution is to use a process graph of behavior activities. All processes are presented clearly and logically, especially if the process tree is large. The graph gives you a new angle to look at the processes’ relations and maybe discover something new.  Also, it helps to point out the conclusion about the program’s behavior quickly. 

8. MITRE ATT&CK matrix

Research sample’s tactics and techniques. In ANY.RUN, you can analyze malware functionality with the MITRE ATT&CK matrix.

Check how to get free malware samples and reports from ANY.RUN’s 6 million database. It will help to see other versions of malware samples and provide a more profound investigation for your research.

9. AI reports 

AI reports are highly useful when you need a detailed, easy-to-understand perspective on the threat at hand. These reports detail what occurred during the interactive session and highlight traits that may indicate malicious activity, explaining the rationale behind such assessments.

To generate a comprehensive report on any specific event registered during the malware’s execution, click the AI icon next to it. 

Wrapping up 

Check how to get free malware samples and reports from ANY.RUN’s 6 million database. It will help to see other versions of malware samples and provide a more profound investigation for your research. 

About ANY.RUN

 ANY.RUN is a cloud malware sandbox that handles the heavy lifting of malware analysis for SOC and DFIR teams. Every day, 300,000 professionals use our platform to investigate incidents and streamline threat analysis.      

Request a demo today and enjoy 14 days of free access to our Enterprise plan.     

Request demo →  

The post Malware Analysis Report in One Click appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Key takeaways

Cyble Research and Intelligence Labs (CRIL) uncovered a sophisticated multi-stage malware attack originating from an archive file that contains a malicious LNK file.

The lure document observed in the campaign indicates that the Threat Actor (TA) is targeting job seekers and digital marketing professionals, especially those involved with Meta Ads.

The malware employs several techniques to detect virtual machine environments, evading detection and analysis in sandboxed or emulated environments.

The malware uses multiple anti-debugging techniques to detect if it is being debugged, making analysis or reverse engineering more challenging.

The malware employs defense evasion techniques, including disabling event tracing and altering in-memory functions, to evade detection by security tools.

The malware attempts to escalate privileges to administrative levels using different approaches and sets up persistence by hiding in system directories, ensuring continued execution even after system reboots.

The malware employs AES encryption in several phases of execution to conceal the malicious payload, which is only decrypted in memory after passing anti-virtualization and anti-debugging checks. This strategy makes it difficult for static analysis engines to detect the threat, as the payload remains hidden until runtime.

The final stage of the attack deploys Quasar RAT, a well-known open-source remote access trojan, granting attackers full control over the compromised system. This access enables activities such as data theft, surveillance, and further exploitation of the system, making it a versatile tool for malicious purposes.

This campaign has been attributed to a Vietnamese Threat Actor based on its specific targeting of Meta Ads digital marketing professionals and the tools employed. The tactics and techniques used in this attack closely align with a previous campaign identified in July 2022, reinforcing the connection to the same threat group.

Overview

Cyble Research and Intelligence Lab (CRIL) has uncovered an advanced attack campaign that likely originates from spam emails containing phishing attachments. These emails include an archive file with an LNK file disguised as a PDF file. The attack begins when the LNK file triggers PowerShell-based commands, which proceed to download and execute additional scripts hosted externally. These scripts are highly encoded and obfuscated to evade detection by security tools. The TAs use a variety of evasion techniques, including checks for virtual machines, sandbox environments, and debugging tools, ensuring that the malicious code can remain undetected and function stealthily in non-virtualized environments while bypassing standard security defenses.

Once the environment is confirmed to be free from sandboxing or analysis, the payload is decrypted using hardcoded keys, resulting in the execution of Quasar RAT. In this final stage, attackers gain complete control over the compromised system, allowing them to conduct a range of malicious activities, including data exfiltration, persistent access, data theft, and even deploying additional malware.

In July 2022, a Vietnamese threat group began spreading Ducktail malware, an info-stealer targeting digital marketing professionals. Over time, the group expanded its operations, distributing additional information stealers and remote access trojans (RATs). They also leveraged Malware-as-a-Service (MaaS) to facilitate payload delivery, making their campaigns more versatile and scalable.

This campaign is attributed to the Vietnamese threat group due to several indicators: the choice of target victims, the tools employed in the attacks, the payload delivery mechanisms, and the creation of lure documents. These elements closely mirror the tactics, techniques, and procedures (TTPs) observed in previous campaigns identified by WithSecure, further linking this campaign to the same group. We have observed that the TA behind this campaign is also delivering malware families such as Stromkitty. The figure below shows the execution flow of this campaign.

Technical Analysis

Cyble Research and Intelligence Lab (CRIL) has identified a campaign that leverages a malicious LNK file containing a PowerShell command designed to download and execute an additional PowerShell script hosted on Dropbox using the link: hxxps://www.dropbox[.]com/scl/fi/b9diosgl68vg9xlaytsbz/sav3_encrypt[.]txt?rlkey=k2ojylfvks6xyef3vb21n45gp&st=suprpdhv&dl=1. This is done by using the Invoke-Expression (IEX) and Invoke-RestMethod (irm) PowerShell commands from the LNK file

Once downloaded, the script contains two components encoded in base64: a lure PDF file and a batch file. These are decoded and saved to the Downloads folder as “PositionApplied_VoyMedia.pdf” and “output.bat.” The script then executes these files using the “Start-Process” PowerShell command.

Lure Document Analysis:

The potential target of this attack is likely job seekers or professionals in the digital marketing, e-commerce, or performance marketing sectors, particularly those specializing in Meta (Facebook, Instagram) Ads within the United States. Figures 4 and 5 below show the lure document used in this campaign.

Output.bat

Upon execution, the “output.bat” file retrieves the disk drive type and manufacturer name using WMIC commands to detect if the system is running in a virtual machine. It checks for disk types such as “DADY HARDDISK”, “WDS100T2B0A” or “QEMU HARDDISK” and manufacturers like “BOCHS_”, “BXPC___”, “QEMU“, or “VirtualBox“. If any of these checks indicate a virtual environment, the script exits without further execution. However, if no virtual machine is detected, it proceeds to execute another obfuscated PowerShell script. The process tree below illustrates how malware checks the virtual environment.

 The de-obfuscated PowerShell code is shown below

The PowerShell script reads the content of the “output.bat” file by scanning each line that begins with “:: “ and extracts a substring. A separator is used to split the line into two sets of base64 strings. These base64 strings are then decoded and passed through an AES decryption process using a hardcoded key and IV, both of which are base64 encoded. After decryption, the data is decompressed using a GZip stream, and the resulting output is executed using Invoke-Expression through PowerShell.exe, as shown in Figure 7.

The decrypted payload results in a .NET executable, which is executed in memory via Invoke-Expression. It then carries out a series of detection-evasion checks using various methods defined within the .NET loader.

Triage environment check

This method performs a check for a Triage sandbox by querying the disk drive model using the command “SELECT * FROM Win32_DiskDrive”. It retrieves the model of the disk drive and compares it with “DADY HARDDISK” or “QEMU HARDDISK”. Additionally, it checks the Triage sandbox VM’s desktop wallpaper by comparing the bytes of the current wallpaper image file with a hardcoded set of bytes. If either of these checks detects the presence of Triage, the program throws an exception and halts execution.

Checks for Qemu

This method checks if the system is running in a QEMU virtual environment by searching for specific QEMU-related files in the system directory. It iterates through all the files in the system folder and checks if any file names contain the strings “qemu-ga” or “qemuwmi”. If a match is found, the method returns true; otherwise, it returns false.

Checks for Parallels

This method checks if the system is running in a Parallels virtual environment by searching for specific Parallels-related files in the system directory. It looks for file names containing the strings “prl_sf”, “prl_tg”, or “prl_eth”. If any of these strings are found in the system folder, the method returns true; otherwise, it returns false.

Sandbox Detection

These methods are designed to detect the presence of various sandboxing solutions by checking if specific DLL modules are loaded in the system. The malware detects Sandboxie by looking for the “SbieDll.dll” module, and if found, the method is designed to crash the Sandboxie environment. Similarly, the Comodo sandbox is identified by searching for either the “cmdvrt32.dll” or “cmdvrt64.dll” modules, while the Qihoo 360 sandbox is detected by checking for the “SxIn.dll” module. For Cuckoo sandbox detection, the system searches for the “cuckoomon.dll” module. If any of these modules are found, the system returns true, indicating a sandbox environment. In the case of Sandboxie, it intentionally crashes the environment.

Emulation environment checks

This method checks for emulation by measuring the system’s tick count before and after a 500-millisecond pause. If the time difference is less than 500 milliseconds, it suggests the system may be running in an emulated environment, returning true. Otherwise, it returns false.

Username checks

This method checks if the current system’s username matches any common usernames often associated with virtual machines, sandboxes, or test environments. It converts the current username to lowercase and compares it against a predefined list, which includes names like “Johnson,” “Miller,” “malware,” “Sandbox,” ”virus,” ”John Doe,” “test user,” “sand box,” “WDAGUtilityAccount,” “DefaultUser,”  If a match is found, it returns true, indicating that the system is running under virtual environment. Otherwise, it returns false.

Wine Emulator check

This method checks if the system is running in a Wine environment by looking for the presence of the “wine_get_unix_file_name” function in the kernel32.dll module. If the function is found, it returns true, indicating Wine is present; otherwise, it returns false.

VMWare check

This method checks if the system is running in a VMware or VirtualBox virtual environment by querying the “Select * from Win32_ComputerSystem”. It retrieves the manufacturer and model information of the system. If the manufacturer is “Microsoft Corporation” and the model contains “VIRTUAL,” or if the manufacturer contains “vmware,” it returns `true`, indicating the presence of a virtual environment. If no such conditions are met, it returns false.

KVM check

This method checks if the system is running in a KVM (Kernel-based Virtual Machine) environment by searching for specific KVM-related drivers in the system directory. It looks for file names such as “balloon.sys“, “netkvm.sys“, “vioinput“, “viofs.sys”, and “vioser.sys”. If any of these files are found, it returns true, indicating a KVM environment.

Hyper-V check

This method checks if the system is running in a Hyper-V environment by inspecting the services currently running. It looks for services with names that contain “vmbus”, “VMBusHID”, or “hyperkbd”. If any of these services are found, it returns true, indicating the presence of Hyper-V.

Check for VMWare-related files

This method checks for the presence of virtual machine/Virtual box-related files and directories to detect a virtual environment. It searches the system directory for specific files like “VBoxMouse.sys”, “VBoxGuest.sys”, “VBoxSF.sys”, “VBoxVideo.sys”, “vmmouse.sys”, “vboxogl.dll”, and “vmmouse.sys” that are associated with VMware or VirtualBox. Additionally, it checks for the existence of directories like “C:\Program Files\VMware” or “C:\Program Files\oracle\virtualbox guest additions”. If any of these files or directories are found, it returns true, indicating the system is running in a virtual machine.

VMProcess Checks

This Method checks for the presence of processes associated with virtual machine environments by searching for specific process names, such as “vboxservice,” “VGAuthService,” “vmusrvc,” and “qemu-ga.” If any of these processes are found running on the system, it returns true, indicating the presence of a virtual machine. If none of these processes are detected, it returns false.

Device Check

This method checks for the presence of specific virtual machine-related device files by attempting to open paths such as \.pipecuckoo, \.HGFS, \.vmci, \.VBoxMiniRdrDN, \.VBoxGuest , \.pipeVBoxMiniRdrDN , \.VBoxTrayIPC. If any of these device files are successfully opened, it closes the file and returns true, indicating the system is likely running in a virtual machine.

Operating System Edition check

This method checks if the operating system is an Enterprise, Business, or Server edition by querying the Win32_OperatingSystem class and retrieving the OS name from the “Caption” field. If the OS name contains the words “Enterprise,” “Business,” or “Server,” it returns true, indicating that the system is running one of these editions.

If any of the above-mentioned methods return “True”, the program triggers an exception, halting the execution and preventing the intended malicious activity from being executed.

After these environmental checks, the program proceeds to assess whether it is being debugged. This stage typically involves additional scrutiny for signs of a debugging process or sandbox environment, such as monitoring for attached debuggers or identifying system artifacts that suggest the program is running under observation.

DebuggerAttached

This method performs various checks to detect if a debugger is attached to the current process. It checks for a debugger using standard .NET methods and by querying system information via the “NtQueryInformationProcess” function. These checks look for specific flags, ports, and object handles that indicate the presence of a debugger. If any of these conditions are met, the methods return `true`, indicating that the process is being debugged.

Using NtSetInformationThread

This method attempts to hide threads from a debugger by iterating through the current process’s threads. It opens each thread and uses the “NtSetInformationThread” function to hide it. If the operation succeeds for all threads, it returns “Success”; otherwise, if an error occurs, it returns “Failed.”

Using PageGuard

This method allocates a block of memory using “VirtualAlloc” and sets specific protections to detect if a debugger is present. It writes data to the allocated memory and changes its protection to include guard pages. If an exception is triggered when executing code from this memory block, it indicates the presence of a debugger, returning false. If no exception occurs, the memory is freed, and it returns true, indicating no debugger is detected.

Using Hardware Breakpoints

This code checks for hardware breakpoints by retrieving the current thread’s context, specifically the debug registers. If any of the debug registers (Dr1, Dr2, Dr3, Dr4, Dr5, Dr6, or Dr7) contain non-zero values, it indicates the presence of a hardware breakpoint, returning true. If no breakpoints are detected, it returns false.

Debugger attach

This method attempts to prevent debugging by modifying the behavior of specific functions in ntdll.dll. It retrieves the addresses of DbgUiRemoteBreakin and DbgBreakPoint and overwrites them with custom instructions (0xCC for DbgUiRemoteBreakin and 0xC3 for DbgBreakPoint). If the memory modification is successful, it returns “Success”; otherwise, it returns “Failed.”

If any of the above methods detect that the process is being debugged, the program immediately triggers an exception. This action effectively halts further execution and prevents the program from continuing its operations.

Antivirus check

Upon execution, the program specifically checks for antivirus products like Kaspersky, BitDefender, or Avast Antivirus. However, the presence of these security products on the system does not interfere with or halt the program’s execution. It continues running as intended.

Privilege Escalation

Once the .NET executable completes its checks, it verifies if it has administrative privileges. If not, it modifies the Process Environment Block (PEB) of the current process to change its image path and command line to “C:Windowsexplorer.exe“. After modifying the PEB, it initiates a new instance of the current process using a PowerShell command with the “-Verb runas” option, running the process in hidden mode with elevated admin privileges.

If the PowerShell method fails for any reason, the process switches to an alternative approach by invoking a COM object (CMSTPLUA) using the CLSID “3E5FC7F9-9A51-4367-9063-A120244FBEC7” with the prefix “Elevation:Administrator!new:”. It then calls ShellExec to launch a new instance of the current process with elevated administrative privileges.

Persistence

After achieving privilege escalation, the .NET executable checks the process’s origin to determine whether it is running from the “Windows” directory. If the process is not operating from this directory, it sets up persistence by creating a hidden folder named “$rbx-onimai” in the “C:Windows” directory and copies itself into this folder as “$rbx-CO2.bat”. The original file located in the “Downloads” folder is then deleted. Afterward, it initiates a new instance from the “C:Windows$rbx-onimai” folder using the following command.

Command : cmd.exe /C echo Start-Process -FilePath C:Windows$rbx-onimal$rbx-CO2.bat -WindowStyle Hidden | powershell.exe -WindowStyle Hidden

It also creates a run entry by modifying the registry key of “SOFTWAREMicrosoftWindowsCurrentVersionRun$rbx-XVR” to point to the newly copied file, ensuring it runs automatically after restart.

Defense Evasion

Upon Execution, the .Net executable modifies the “EtwEventWrite” function in ntdll.dll to disable event tracing by inserting specific opcode code.

On 32-bit systems, it replaces the function with the opcodes “0xC2, 0x14”, which translates to the assembly instruction RETN 20. This causes the function to return early and bypass its normal operations.

On 64-bit systems, it uses the opcode “0xC3”, which corresponds to the instruction RET, making the function return immediately.

After this, it decrypts data from its resource section labeled “1789d7d0-48bf-48f5-bad6-e0262117d577.tmp” using AES decryption with a hardcoded base64 key and IV. The decrypted data is subsequently decompressed using GZip.

Quasar RAT

In the final step, the .NET executable runs the decompressed payload using the Invoke command. The payload has been identified as Quasar RAT, but the threat actor has made several modifications, such as changing the certificate name and other references where “Quasar RAT” typically appears. These alterations are likely intended to evade detection and attribution.

Quasar RAT configuration:

Field
Value

Tag
 Team

version
 1.7.3

Hosts
 “144.76.68.248:4782;”

Sub-Directory
 “$cnt-onimai2”

Install Name
 “$cnt-CO2.exe”

Mutex
 “928569f3-e524-4f67-936e-0d7f0a47cfad”

Startup Key
 “$cnt-Onimai”

Log Directory name
 “$cnt-Logs”

Additional Information:

Additionally, the program includes several checks designed to detect debuggers and evaluate the system’s environment, though these specific methods are not directly called. This suggests that the TA may have implemented these checks as part of a more extensive anti-debugging or evasion mechanism. By leaving these methods dormant, the TA retains the option to enable further checks in the future, enhancing the program’s ability to evade detection or analysis in debugging or virtualized environments.

Analysis Tools check

This method checks for debugging or reverse engineering tools by searching for specific process window titles or the foreground window’s title. It looks for tools like x32dbg, x64dbg, windbg, ollydbg, dnspy, immunity debugger, hyperdbg, cheat engine, cheatengine, ida, and wireshark. If any of these tools are detected in the process list or as the current foreground window, it either closes the process or flags their presence by returning true. If none are found, it returns false.

OutputDebug string

This code attempts to detect a debugger by logging a message and checking the result of “GetLastWin32Error()”, returning true if no error is found. Additionally, it logs a specially crafted format string to potentially exploit vulnerabilities in certain debuggers like OllyDbg by flooding it with “%s” format specifiers.

Drivers Execution check

These two methods check whether unsigned drivers and test-signed drivers are allowed to run on the system by querying the system’s Code Integrity settings using NtQuerySystemInformation. This is done to evaluate if the machine could be a potential malware-testing environment. If unsigned drivers are allowed, the method returns True. Similarly, if test-signed drivers are permitted, it also returns True.

Kernel Debugging check

The method checks if kernel debugging is active on the system. It does so by querying the system information using the “NtQuerySystemInformation” function (with a specific system information class ‘35’). It retrieves the status of the kernel debugger through the “SYSTEM_KERNEL_DEBUGGER_INFORMATION” structure. The method returns true if either the kernel debugger is enabled or present but not active. Otherwise, it returns false.

This check helps determine if the system is being debugged, which can be useful in detecting potential test environments.

SecureBoot Check

The method checks if Secure Boot is enabled on the system. It queries system information using NtQuerySystemInformation with a system information class 145 to retrieve Secure Boot status via the SYSTEM_SECUREBOOT_INFORMATION structure. The method returns true if the system is Secure Boot capable and Secure Boot is enabled. Otherwise, it returns false.

Virtualization Check

This method checks if Virtualization-Based Security (VBS) is enabled on the system. It queries the system using WMI to check the encryption status of the system volume (C: drive) through the Win32_EncryptableVolume class. The method returns true if the volume’s “ProtectionStatus” is 1, indicating that encryption is enabled (suggesting VBS is active). If any errors occur during the query, the method catches the exception and returns false.

Memory Integrity check

This method checks if Memory Integrity (also known as Hypervisor-Enforced Code Integrity) is enabled on the system. It reads a specific registry key: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlDeviceGuardScenariosHypervisorEnforcedCodeIntegrity. If the Enabled value in the registry key is set to 1, the method returns true, indicating that Memory Integrity is enabled. If the key or value is not present or an error occurs, the method returns false.

Invoke Assembly check

This method checks whether the currently executing assembly (the program) is running from a different location than the application’s expected executable path. It does this by comparing the location of the executing assembly (Assembly.GetExecutingAssembly().Location) with the application’s executable path (Application.ExecutablePath). If they differ, the method returns true, indicating that the assembly may have been invoked or loaded from an unusual or external location.

The code performs several security checks to determine if the system is potentially insecure or used for malware testing. It checks conditions like whether unsigned drivers are permitted, whether Secure Boot is disabled, kernel debugging is active, and whether key security features like Virtualization-Based Security and Memory Integrity are turned off. It also verifies if the program is running from an unexpected location. Additionally, it cross-checks the username against a list of blacklisted names commonly associated with testing environments. If any of these checks trigger a flag, and the username matches a blacklisted name, the program throws an exception, stopping any malicious activity from proceeding.

Conclusion

This attack demonstrates a sophisticated, multi-layered approach to deploying the Quasar RAT, using a seemingly benign LNK file as the initial entry point. Through the use of sandbox evasion, anti-virtualization checks, and privilege escalation techniques (such as PowerShell and CMSTP), the TA ensures that the payload bypasses detection and establishes persistent control over compromised systems.

The employment of AES encryption for the payload, along with anti-debugging techniques and advanced .NET-based obfuscation, illustrates the attackers’ strong focus on evading traditional security solutions and complicating the analysis and reverse engineering process. The modular structure of the attack, with some evasion techniques left unused but ready to deploy based on the target environment, underscores the threat actor’s adaptability and capability to overcome varying levels of defense.

This campaign aligns closely with the ongoing operations of a Vietnamese threat group that has been active since July 2022. The group initially spread Ducktail malware, targeting digital marketing professionals. Over time, the group has evolved, expanding its operations through the use of Malware-as-a-Service (MaaS) and replicating its tactics, techniques, and procedures (TTPs) across multiple campaigns.

Recommendations

Ensure robust email security tools are in place to detect and block malicious email attachments, such as LNK files or suspicious links. Advanced filtering systems with AI and machine learning can help detect unusual patterns and phishing attempts that may bypass traditional security filters.

PowerShell is a common tool leveraged in attacks. Monitor its usage via logging, restrict execution policies to signed scripts, and enforce strict policies on script execution to prevent unauthorized scripts from running. Disable or limit PowerShell on systems where it is unnecessary to mitigate risk.

Implement security solutions that utilize behavioral analysis to detect unusual system activities, such as process injection, sandbox evasion techniques, or modifications to critical functions like EtwEventWrite. These tools can flag abnormal behavior in real time and prevent attacks before they escalate.

Ensure that users operate with the least privileges necessary for their roles. Limit administrative access and restrict execution of potentially harmful scripts or processes, like PowerShell, to reduce the risk of privilege escalation.

Keep all systems, software, and antivirus solutions updated with the latest patches. Regular updates help protect against vulnerabilities that threat actors often exploit to deliver malicious payloads or execute privilege escalation techniques.

MITRE ATT&CK® Techniques

Tactic
Technique
Procedure

Initial Access (TA0001)
Phishing (T1566)
The LNK file in a RAR archive may be delivered through phishing or spam emails.

Execution (TA0002)
Command and Scripting Interpreter: PowerShell (T1059.001)
The LNK file executes PowerShell commands

Execution (TA0002)
Windows Command Shell (T1059.003)
Uses cmd.exe to execute wmic and findstr commands

Persistence (TA0003)
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (T1547.001)
Added Run entry by modifying the Registry key

Privilege Escalation (TA0004)
CMSTP (T1218.003)
CMSTPLUA is used for UAC bypass

Defense Evasion (TA0005)
Obfuscated Files or Information: LNK Icon Smuggling (T1027.012)  
LNK file comes with PDF Icon

Defense Evasion (TA0005)
Obfuscated Files or Information: Encrypted/Encoded File (T1027.013)
TA decrypts the payload using AES decryption

Defense Evasion (TA0005)
Disabling Security Tools (T1562.001)
EtwEventWrite function in ntdll.dll is modified to disable event tracing

Defense Evasion (TA0005)
Virtualization/Sandbox Evasion (T1497)
Checks for virtual environments (e.g., QEMU, VirtualBox, VMware, Sandboxie)

Defense Evasion (TA0005)
Process Injection (T1055)
Invoke-Expression is used to invoke decrypted payloads

Discovery (TA0007)
Query Registry (T1012)
The script queries registry keys to gather system information for further checks, including checks related to virtualization.

Discovery (TA0007)
System Information Discovery (T1082)
Using Windows Management Instrumentation Control gathers system information.

Command and Control (TA0011)
Encrypted Channel (T1573)
The final payload, Quasar RAT, establishes C2 communication over an encrypted channel (AES encryption used in earlier stages).

Command and Control (TA0011)
Application Layer Protocol (T1071)
After the payload is executed, the Quasar RAT communicates with its C2 server over standard HTTP or other application layer protocols.

Indicators Of Compromise

Indicators 
Indicator Type
Description

dc616cc55a345e448a058368aea7c99ab9dd2a9c8ec42674312b66dbc29b7878
SHA-256
Career_Development_Plan_for_Meta_Ads_Specialist_Hotpoint_With_Numerical.rar

3de5e0b27c69c93b4c4b4812ed4453d4b81e99b7d407640a752e62e33b1ede2a
SHA-256
Career_Development_Plan_for_Meta_Ads_Specialist_Hotpoint_With_Numerical/Career_Development_Plan_for_Meta_Ads_Specialist_Hotpoint_With_Numerical.lnk

hxxps://www.dropbox.com/scl/fi/9p8no6tz85e09vg59kfwk/sav2_encrypt.txt?rlkey=hw7c83mq8uws216q3d4b1cfyi&st=4oycb9or&dl=1
URL
URL from LNK

9a00d0859bc7a81d6e289a414c39aa2bd95319fa3d1d0e5f1be6d348604d640c
SHA-256
payload_1.ps1 (downloaded from Dropbox)

b35452610c2cbc5a6a2bebd82af7c3883037b40be7072e43fc5989298bb26ea5
SHA-256
PositionApplied_VoyMedia.pdf <space>  .lnk

d8bc59a1acf2f9a14a2fb96de979672dbed27d798eecc9454021f352f2bf973a
SHA-256
PositionApplied_VoyMedia.rar

16ef774020e5754e4a8890789b7c798376a9521823c8897f9c97af5b33b27013
SHA-256
payload_1.bin

8229f281a93f18612a47843aa69e94312b52180e7f775fd58e5ea04608e23bd0
SHA-256
LNK file delivers stromkitty

The post Vietnamese Threat Actor’s Multi-Layered Strategy on Digital Marketing Professionals appeared first on Cyble.

Blog – Cyble – ​Read More

Although automation and machine learning (ML) have been used in information security for almost two decades, experimentation in this field continues non-stop. Security professionals need to combat increasingly sophisticated cyberthreats and a growing number of attacks without significant increases in budget or personnel. On the positive side, AI greatly reduces the workload on security analysts, while also accelerating many phases of incident handling — from detection to response. However, a number of seemingly obvious areas of ML application are underperforming.

AI-based detection of cyberthreats

To massively oversimplify, there are two basic — and long-tested — ways to apply ML:

Attack detection. By training AI on examples of phishing emails, malicious files, and dangerous app behavior, we can achieve an acceptable level of detection of similar The main pitfall is that this area is highly dynamic — with attackers constantly devising new methods of disguise. Therefore, the model needs frequent retraining to maintain its effectiveness. This requires a labeled dataset — that is, a large collection of recent, verified examples of malicious behavior. An algorithm trained in this way won’t be effective against fundamentally new, never-before-seen attacks. What’s more, there are certain difficulties in detecting attacks that rely entirely on legitimate IT tools (LotL). Despite these limitations, most infosec vendors use this method, which is quite effective for email analysis, phishing detection, and identifying certain classes of malware. That said, it promises neither full automation nor 100% reliability.
Anomaly detection. By training AI on “normal” server and workstation activity, we can identify deviations from this norm — such as when an accountant suddenly starts performing administrative actions with the mail server. The pitfalls here are that this method requires (a) collecting and storing vast amounts of telemetry, and (b) regular retraining of the AI to keep up with changes in the IT infrastructure. Even then, there’ll be many false positives (FPs) and no guarantee of attack detection. Anomaly detection must be tailored to the specific organization, so using such a tool requires people highly skilled in cybersecurity, data analysis, and ML. And these priceless employees have to provide 24/7 system support.

The philosophical conclusion we can draw thus far is that AI excels at routine tasks where the subject area and object characteristics change slowly and infrequently: writing coherent texts, recognizing dog breeds, and so on. Where there is a human mind actively resisting the training data, statically configured AI in time gradually becomes less and less effective. Analysts fine-tune the AI instead of creating cyberthreat detection rules — the work domain changes, but, contrary to a common misconception, no human-labor saving is achieved. Furthermore, the desire to improve AI threat detection and boost the number of true positives (TP) inevitably leads to a rise in the number of FPs, which directly increases the human workload. Conversely, trying to cut FPs to near zero results in fewer TPs as well — thereby increasing the risk of missing a cyberattack.

As a result, AI has a place in the detection toolkit, but not as a silver bullet able to solve all detection problems in cybersecurity, or work completely autonomously.

AI as a SOC analyst’s partner

AI can’t be entirely entrusted with searching for cyberthreats, but it can reduce the human workload by independently analyzing simple SIEM alerts and assisting analysts in other cases:

Filtering false positives. Having been trained on SIEM alerts and analysts’ verdicts, AI can filter FPs quite reliably: our Kaspersky MDR solution achieves a SOC workload reduction of around 25%. See our forthcoming post for details of this “auto-analytics” implementation.
Alert prioritization. The same ML engine doesn’t just filter out FPs; it also assesses the likelihood that a detected event indicates serious malicious activity. Such critical alerts are then passed to experts for prioritized analysis. Alternatively, “threat probability” can be represented as a visual indicator — helping the analyst prioritize the most important alerts.
Anomaly detection. AI can quickly alert about anomalies in the protected infrastructure by tracking phenomena like a surge in the number of alerts, a sharp increase or decrease in the flow of telemetry from certain sensors, or changes in its structure.
Suspicious behavior detection. Although searching for arbitrary anomalies in a network entails significant difficulties, certain scenarios lend themselves well to automation, and in these cases, ML outperforms static rules. Examples include detecting unauthorized account usage from unusual subnets; detecting abnormal access to file servers and scanning them; and searching for pass-the-ticket attacks.

Large language models in cybersecurity

As the top trending topic in AI, large language models (LLMs) have also been extensively tested by infosec firms. Leaving aside cybercriminal pursuits such as generating phishing emails and malware using GPT, we note these interesting (and plentiful) experiments in leveraging LLMs for routine tasks:

Generating detailed cyberthreat descriptions
Drafting incident investigation reports
Fuzzy search in data archives and logs via chats
Generating tests, test cases, and code for fuzzing
Initial analysis of decompiled source code in reverse engineering
De-obfuscation and explanation of long command lines (our MDR service already employs this technology)
Generating hints and tips for writing detection rules and scripts

Most of the linked-to papers and articles describe niche implementations or scientific experiments, so they don’t provide a measurable assessment of performance. Moreover, available research on the performance of skilled employees aided by LLMs shows mixed results. Therefore, such solutions should be implemented slowly and in stages, with a preliminary assessment of the savings potential, and a detailed evaluation of the time investment and the quality of result.

Kaspersky official blog – ​Read More