Jump to content
Sign in to follow this  
iulik

Threat Spotlight: Astaroth — Maze of obfuscation and evasion reveals dark stealer

Recommended Posts

Cisco Talos detected a new Astaroth attack campaign targeting users in Brazil. The operation began when a user received an email written in Portuguese that resorted to a car rental service as a lure in order to trick the user into clicking on a link that masqueraded as an overdue invoice. In actuality, that link redirected the user to Google Drive for the purpose of downloading a malicious ZIP file.

 

image28.jpg

 

detalii -> https://blog.talosintelligence.com/2020/05/astaroth-analysis.html

  • Upvote 1

Share this post


Link to post
Share on other sites

Nu am citit articolul, dar din imagine ma gandesc la faptul ca e stupid de inutil complicat... 

Share this post


Link to post
Share on other sites
1 hour ago, Nytro said:

Nu am citit articolul, dar din imagine ma gandesc la faptul ca e stupid de inutil complicat... 

cam da :)) 

image32.jpg

imaginea asta am uitat sa o pun

  • Upvote 1

Share this post


Link to post
Share on other sites

Cat au evoluat malwarii astia.

Anti-debug check: Portuguese language! :)) 

  • Haha 1

Share this post


Link to post
Share on other sites

Din cate am citit, i-a dat cateva dureri de cap sa ii faca debug.

 

Sunt targetati oamenii din mexic, malware-ul verifica daca limba setata pe sistemul de operare e portugheza, daca nu termina procesul.

 

Ce mi s-a mai parut interesant e ca foloseste canale de youtube, canalele de youtube linkuiesc catre o serie de domenii, iar de acolo domeniile trimit instructiuni la persoanele infectate.

image27.png

image6.png

  • Upvote 1

Share this post


Link to post
Share on other sites

Parca in rootkits and bootkits descriau ca foloseau canale de twiter, telegram sau generatoare de domenii. Daca malwareul nu gasea domeniul respectiv apela generatorul offline si stia unde sa mearga.

Mai erau si malwareurile care foloseau pastebin.

La youtube nu m-am gandit niciodata, dar pe langa faptul ca este mai repede de dezvoltat partea de infrastructura (se folosesc de youtube) ii ajuta si faptul ca pe multe pc-uri traficul catre youtube e permis.

  • Upvote 1

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

×
×
  • Create New...