Malware - Denwp Research

Denwp Research

Malware

A collection of 6 posts

Dissecting Lumma Malware: Analyzing the Fake CAPTCHA and Obfuscation Techniques - Part 2

Dissecting Lumma Malware: Analyzing the Fake CAPTCHA and Obfuscation Techniques - Part 2

In Part 1 of our series on Lumma Stealer, we explored the initial attack vector through a fake CAPTCHA page. We observed how the malware deceives users into downloading and executing malicious payloads. In this second series, we delve deeper into the technical details of the Lumma Stealer’s loader,

Anatomy of a Lumma Stealer Attack via Fake CAPTCHA Pages - Part 1

Anatomy of a Lumma Stealer Attack via Fake CAPTCHA Pages - Part 1

As of late August 2024, attackers have been using fraudulent "human verification" pages to trick users into executing a malicious PowerShell script. This blog post will explore the full attack vector, detailing how the malware is delivered, executed, and the indicators of compromise (IOCs) involved. Lumma Stealer is

Decoding AsyncRAT: From ISO file to C2 domain

Decoding AsyncRAT: From ISO file to C2 domain

ASYNC RAT (Remote Access Trojan) is a malware designed for remote control of infected systems. The malware is commonly used to steal sensitive information, deploy additional malware, and maintain persistent access to compromised networks. Once installed on a target machine, ASYNC RAT can perform various malicious activities, including keylogging, screen

From Base64 to Reverse Shell: Unpacking Malware from a Word Document

From Base64 to Reverse Shell: Unpacking Malware from a Word Document

Malware distribution through infected documents, especially Microsoft Word files containing malicious macros, is a common threat. This article explores the process of reversing malware found in a Windows Word document, highlighting the techniques used by attackers and ways to mitigate such threats. The sample has been download from Malware Bazaar

Unveiling the Stealth: How Malware Hides Using Alternate Data Streams

Unveiling the Stealth: How Malware Hides Using Alternate Data Streams

Understanding the intricacies of malware evasion techniques is very important. One such method gaining notoriety is the use of Alternate Data Streams (ADS). In this article, we delve into the covert world of ADS and explore how malware exploits this file system feature to hide from detection. Alternate Data Streams

The Spy Within: A Close Encounter with Agent Tesla Malware

The Spy Within: A Close Encounter with Agent Tesla Malware

The analyzed sample is part of the notorious malware family known as 'Agent Tesla,' classified as a Remote Access Trojan (RAT). This particular variant, encapsulated in a compiled .exe file, unfolds a complex web of functions and methods designed to gather sensitive data from the infected device. Throughout