73 matches found
bat
Behavioral Adversary Tracer BAT BAT は、Linux と Windows 向けの現実的で進化する敵対的脅威モデルです。これは C2 フレームワークでもルートキットでもありません。C2 通信、カーネルレベルのステルスルートキットモジュール、ユーザースペース回避、権限昇格、永続化、プロセスインジェクション、認証情報収集、データ流出、横展開を単一の統合された敵対者にまとめた完全な脅威シミュレーションプラットフォームです。設計目標は、2026 年に達成可能な最も高度で現実的な Linux 脅威となることであり、現在の検出システムが何を捕捉するかとは独立しています...
bunitu_tests
bunitutests 用于与Bunitu木马C&C通信的脚本 自行承担使用风险！ 作者： : hasherezade Malwarebytes : Sergei Frankoff Sentrant 文件： cnc1test.py - 将你的主机注册为Bunitu僵尸网络中的代理僵尸（与C&C1通信） cnc2test.py - 检查给定主机是否为Bunitu隧道C&C（与C&C2通信） 如何使用这些脚本：https://github.com/hasherezade/bunitutests/wiki...
AcrStealer-Custom-Protocol-Credential-Theft-Payload-Extraction-Analysis
1. 网络连接与 SSL/TLS 配置 通过 Process Hacker 内存分析发现，AcrStealer 使用 SSL/TLS 建立网络连接，以与其 C2 服务器进行安全通信。 关键观察： SslClientCert – 使用客户端证书进行身份验证（规避检测）。 EnabledProtocols – 指定支持的 TLS 协议（例如 TLS 1.2、1.3）。 EnabledRevertToSelfClientCertificate – 允许回退到自签名证书。 Connection / DataChunks – 表示活跃的数据传输。 Available – 待发送的数据缓冲区。...
StealC-Stealer-RuntimeBroker-Hollowing-C2-Extraction-Payload-Extraction-Analysis
1. RuntimeBroker.exe Hollowing & C2 IP Addresses Process Hacker memory analysis reveals that StealC Stealer performs process hollowing on RuntimeBroker.exe and establishes connections to multiple C2 servers. Key Observations: Target Process: RuntimeBroker.exe PID 14900. C2 IP Addresses:...
Malicious code in @vitemirrorte/element-plus-vite-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d616b037ed0b4ebbb3a3ddf36963379ea00d4b5f8513641db05e7773dd2696c9 On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materiali...
Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script VBScript payload to newly connected systems. According to Huntress, three unrelated incidents have been found to use diverse initial access...
MAL-2026-14387 Malicious code in @opap/player-kyc-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...
MAL-2026-14380 Malicious code in fund-list-filter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deb78208f7aa932298e92a8c241ed970296c567a273fc21013dd83bb7916e81b On npm install, package.json's preinstall hook runs index.js which harvests installer host identifiers — os.hostname, os.userInfo username, local IPv...
MAL-2026-14360 Malicious code in stillm4ddpocs-demo-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f71ba0f8c2f1f0a1207d3e30ab38321406bff6ba0e68e21d9f27d999f69c4e2b The OpenSSF Package Analysis project identified 'stillm4ddpocs-demo-widget' @ 999.9.9 npm as malicious. It is considered malicious because: - Th...
Malicious code in proc_macro1 (crates.io)
proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay dtolnay. Its metadata forges authors 'David Tolnay ' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependen...
MAL-2026-14295 Malicious code in mcp-dev-toolkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea6d82bd4d62a015c59af54ac277d0381c43203b3475ef1137e57893e67126c Package [email protected] contains multiple files whose behavior matches operational malware rather than a developer toolkit. index.js collects...
MAL-2026-14181 Malicious code in lodahsjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9c02962476bddd8c1cde1b5c222ee420f4957a1e4ce3a906a3c9d36fda6318 Package name typosquats 'lodash'; index.js exports nothing. scripts/postinstall.js runs at install time and performs two hostile actions. First, it...
MAL-2026-14185 Malicious code in mutex-thread (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e142539248a690ef78ebe7ceeaa4c16e9903107a04704e1947cf296bce543097 The package presents itself as a mutex library but lib/Mutex.js contains an injected branch in runExclusive that, when a caller passes...
Malicious code in typescrit-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adcb90c6a48b3b20928967d1aea32cde54035ed455c474a6db4fab148b424b53 On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a hidden URL that resolves to an unrelated personal GitHub account...
Malicious code in @oyo_tech/oyochat_user (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e @oyotech/[email protected] is a dependency-confusion probe. package.json declares a preinstall script that runs node -e...
glassworm-hunter v1.0.4
glassworm-hunter Detect GlassWorm supply chain attack payloads on your machine. Scans VS Code extensions, npm packages, Python packages, and git repositories. This scanner detects the attack technique itself - invisible Unicode variation selector payloads, GlassWorm decoder patterns, C2...
MAL-2026-13917 Malicious code in @years20/n8n-nodes-utils-helper-h (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96661ee04dc82c36bfa5683fc33f6d7a29d10d1e1bc21ece83ea4189dcf33ef3 Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file nodes/PwnNode.node.js, self-labeled 'Pwn'. The rea...
MAL-2026-13910 Malicious code in @years20/n8n-nodes-utils-helper-b (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f282ccd8bb4c80e0316cecf2a9294b7f183bb2339cca52ff72508f2978f2e60 On npm install postinstall and on require/import of the package's main entry, callback.js and index.js execute id, hostname, and WSL detection, read...
MAL-2026-13847 Malicious code in @years18/n8n-nodes-utils-helper-a (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3cd688f6f3a7075db2ae860db719600fda1fdd23485262a9f72de758834a582 The package presents itself as an n8n community node but ships a hostile payload in both callback.js invoked from scripts.postinstall and index.js...
