zeek-quasarrat-detector

A Zeek Based QuasarRAT Malware Detector Malware often hides communications with its command and control C2 server over HTTPS. The encryption in HTTPS usually conceals the compromise long enough for the malware to accomplish its goal. This makes detecting malware that uses HTTPS challenging, but...

DuplexSpyCS

DuplexSpy DuplexSpyCS CS stands for CSharp is a open source RAT base on C/S Continuously update: Branch-Version2.1.0 Documents The online documents are here: DuplexSpy Fileless Execution DLL and shellcode injector and loader Remote Plugin Proxy Introduction DuplexSpy is a open-source Windows RAT...

ZeroRAT

ZeroRAT Introduction A remote control tool for Windows. The client only needs to execute a single command, utilizing native Windows programs for execution without writing files to disk, providing inherent AV evasion. It becomes ineffective after reboot. In the program, download and upload are fro...

Fake npm Packages Impersonate PostCSS Tool to Steal Chrome Passwords

JFrog warns of malicious npm packages that mimic PostCSS tooling, drop a Windows RAT, and target Chrome-stored passwords through a staged infection setup route...

Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT

Cybersecurity researchers have discovered a set of malicious npm packages that are designed to deliver a Windows-based remote access trojan RAT. The list of identified packages, is below - aes-decode-runner-pro 145 downloads postcss-minify-selector 256 downloads postcss-minify-selector-parser 615...

New Windows RAT Evades Detection for Weeks Using Corrupted DOS and PE Headers

Cybersecurity researchers have taken the wraps off an unusual cyber attack that leveraged malware with corrupted DOS and PE headers, according to new findings from Fortinet. The DOS Disk Operating System and PE Portable Executable headers are essential parts of a Windows PE file, providing...