Anti-Sandbox

Описание Обнаружение песочницы AnyRun, и в будущем появится больше возможностей. Демонстрация обнаружения AnyRun https://github.com/user-attachments/assets/45533630-3c64-457a-80d0-a0f12ae84b98...

BL00DYM4RY

🎭 BloodyMary 트로이 목마 피싱 시뮬레이터 📋 설명 BloodyMary 는 사이버보안 전문가 교육을 위한 교육용 도구트로이 목마 바이러스 또는 랜섬웨어로, 사회공학적 요소를 포함한 현실적인 피싱 공격을 시뮬레이션합니다. 이 프로젝트는 사이버 위협에 대한 인식을 높이고 의심스러운 파일 실행의 결과를 시연하기 위해 제작되었습니다. ⚠️ 경고 : 이 도구는 교육 목적과 통제된 환경에서의 승인된 테스트를 위해서만 사용해야 합니다. 🎯 프로젝트 목표 훈련 : 사이버보안 기초에 대한 인력 교육 시연 : 현실적인 피싱 기법 시연 인...

Tourmaline

Tourmaline I recently stumbled upon a piece of cleverly designed malware that calls itself "Tourmaline". This README is very kindly written by Claude as I was super busy with exams at the time of this repository's inception. Exploiting and decrypting this malware took a huge chunk of my time from...

Percino

Percino 탐지 회피형 Golang 로더 Percino는 프로세스 할로잉Process Hollowing 기법을 사용하여 셸코드를 실행하는 Golang 로더로, 안티 샌드박스 및 안티 분석 기능을 포함합니다. 셸코드는 Triple DES3DES 암호화 알고리즘으로 암호화됩니다. 모든 C2 프레임워크에서 완전한 EDR 우회를 지원합니다. MDE EDR 환경에서 Cobalt Strike로 테스트되었습니다. 주요 기능: 3DES 암호화 샌드박스 회피 분석 회피 실행 지연 프로세스 할로잉 팁: CS로 바이너리에 서명하는 것을...

Bypass_AV

Это образец трояна, способный обойти подавляющее большинство антивирусов и песочниц Ниже я опишу технологии, используемые в трояне, и объясню их отдельно для shellcode и загрузчика. Секция загрузчика 1. Анти-песочница Как известно, обычное детектирование анти-песочниц основано на операциях с CPU,...

MAL-2026-13735 Malicious code in @aerodrome-finance/slipstream (npm)

@aerodrome-finance/slipstream is a malicious npm package that impersonates Aerodrome Finance's Slipstream concentrated-liquidity AMM. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall ru...

Malicious code in sea-bound-siren (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd5f2d5cc691968b1bb69f12ea7476c618f6432b42976869906df06312b912c0 On npm install, postinstall.js executes a shell pipeline that collects the output of id, os.hostname, the full process environment env | sort, the...

Malicious code in unique-id-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ab3b19e4bd1602de93ca092a5909f8b69927c01d5a690d3484116024dfc46e2 Package impersonates the well-known sindresorhus/unique-string utility: package.json copies the author block name 'Sindre Sorhus', email...

CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads

Unknown threat actors compromised CPUID "cpuid.com", a website that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor, for less than 24 hours to serve malicious executables for the software and deploy a remote access trojan called STX RAT. The incident...

Exploit for Out-of-bounds Write in Mediatek Software_Development_Kit

What is Registry Exploit? Phantom-Registry-Exploit-Cve2025-20...

ZigStrike 2.0

ZigStrike is a robust shellcode loader developed in Zig, offering a variety of injection techniques and anti-sandbox features. It leverages compile-time capabilities for efficient shellcode allocation, demonstrating proven success in bypassing advanced security solutions. ZigStrike includes a...

A Deep Dive into the Latest Version of Lumma InfoStealer

Unmasking the Evolving Threat: A Deep Dive into the Latest Version of Lumma InfoStealer with Code Flow Obfuscation By Mohideen Abdul Khader · April 21, 2025 Summary Lumma Stealer, first identified in 2022, remains a significant threat to this day, continuously evolving its tactics, techniques, an...

LummaC2 Malware Deploys New Trigonometry-Based Anti-Sandbox Technique

The stealer malware known as LummaC2 aka Lumma Stealer now features a new anti-sandbox technique that leverages the mathematical principle of trigonometry to evade detection and exfiltrate valuable information from infected hosts. The method is designed to "delay detonation of the sample until...

BunnyLoader: The New Malware-as-a-Service Threat

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary BunnyLoader is a Malware-as-a-Service threat, boasting advanced features like anti-sandbox techniques, keylogging, stealing data, cryptocurrency wallets, and remote command execution, posing risks to...

BunnyLoader: New Malware-as-a-Service Threat Emerges in the Cybercrime Underground

Cybersecurity experts have discovered yet another malware-as-a-service MaaS threat called BunnyLoader that's being advertised for sale on the cybercrime underground. "BunnyLoader provides various functionalities such as downloading and executing a second-stage payload, stealing browser credential...

DeathRansom - A Ransomware Developed In Python, With Bypass Technics, For Educational Purposes

What is a ransomware? A ransomware is malware that encrypts all your files and shows a ransom request, which tells you to pay a set amount, usually in bitcoins BTC, in a set time to decrypt your files, or he will delete your files. How it works? First, the script checks if it's in a sandbox,...

Delphi Packer Looks for Human Behavior Before Deploying Payload

As bad actors continue to innovate in the area of sandbox evasion, the use of the Delphi programming language to pack malware code has become more and more prevalent. Researchers recently observed several spam campaigns using a specific packer written in Delphi that goes to great lengths to hunt...

Energy-warning! Be wary EnMiner mining kill-vulnerability warning-the black bar safety net

Recently, sangfor found a high strength of the virus against the behavior of the new mining virus, its viral mechanisms and conventional mining large difference, once infected, the cleanup is extremely difficult. Currently the virus in the outbreak early, sangfor has this virus named EnMiner mini...

Locky ransomware adds anti sandbox feature (updated)

By Marcelo Rivero and Jérôme Segura The Locky ransomware has been very active since its return which we documented in a previous blog post. There are several different Locky campaigns going on at the same time, the largest being the one from affiliate ID 3 which comes with malicious ZIP containin...

SmoothCriminal: Sandbox Detection Via Cursor Speeds!

PenTestIT RSS Feed It's that exciting time of the year folks when new people from the security walks of life throng to casinos in the desert. Yes! I am talking about Black Hat, BSidesLV, DefCon. Bringing to you a part of utility that will be completely released at BSidesLV - SmoothCriminal, which...