15 May 2022 RTF SHA256: ac64adbfa128fd5f31bd922957942a1b80c56ee119791a29b939be04e1d7e2ba Filename: PO#JEL180409TH IR & JEL180409TH IRB.doc VirusTotal Score: 30/59 as of 12 May 2022 What’s An RTF? First released some 35 years ago, the Rich Text Format (RTF) file… Analysis of an Obfuscated RTF File
Background Adversaries frequently utilize scheduled tasks, a legitimate Windows operating system utility to establish/maintain persistence and even execute code in a victim network. Scheduled tasks allow for persistence on a victim network between reboots as… Detecting COM Object Tasks Used by DarkHotel
Although not utilized in attacks for initial access, web shells remain a go-to for all sorts of attackers, from cyber criminals to APT’s when it comes to post-exploitation. The server-side component of a web shell… A Tale of Two Shells
Summary On January 27, 2022, Malwarebytes Labs shared an article covering new tactics including abusing the Windows Update Client for code executing believed to be the work of Lazarus. The purpose of this post will… Shortcut to Windows Update
Summary SHA256: dedb8516befa4a5088000b8c7f699dae7f33761403dd355a14684ac89ff56a9a Filename: Unknown Filetype: DLL File size: 39KB From here on, the above DLL will be referred to as “downloader.dll”. The file is capable of: Downloading files Interacting with a C2 server Malware… Analysis of a DLL Downloader
Summary SHA256: 3275f42c85c9e2fcb80d1f8c1c6227c2bcde9c0e719905ddbd2ca7373c6a8ec6 Filename: UpHelpers.exe Size: 3.41MB Extension: EXE Compilation Timestamp: 2022-01-05 23:41:20 Sandbox analysis: https://tria.ge/220118-emrgjsgfb7 UpHelpers.exe is an information-stealing/reconnaissance tool disguised as a Naver One Time Password, (OTP) generator app. Naver is a South… Info-Stealing Tool Posing As Naver OTP
I wanted to do a quick write-up on an interesting PowerPoint macro document that contains njRAT. njRAT is a .NET trojan first identified in 2013 that has largely targeted countries in the Middle East as… Analysis of njRAT PowerPoint Macros
Often attributed to Chinese-speaking threat actors, PlugX a remote access trojan(RAT), was identified by security researchers in 2012. With several variants of the RAT identified by vendors over the year, many techniques used to compromise… A “GULP” of PlugX
No stranger to this blog, BlackTech has continued to modify techniques to compromise networks and even suffered an OPSEC slip in the way of an open directory. This post will cover a malicious document similar… More Flagpro, More Problems
Overview On November 10, 2020, JPCert[1] published a blog post in Japanese (the English version followed about a week later), providing an overview of BlackTech’s PLEAD backdoor, referred to as “ELF_PLEAD”, specifically targeting *nix systems.… BlackTech Updates Elf-Plead Backdoor