Szabolcs Schmidt

In October, saw a possible interesting sample named "NonElevatedDll.dll" uploaded to VT from Taiwan. Shared it with some big brains, one said something like it's some advanced APT sample... 🤔 It is using ASUS WebStorage - I not remember ever seeing or even just hearing about any malware that used that before (there was some case in 2019 in which actors hijacked the ASUS WebStorage client, but that is a different thing). Started at 3/72 detection ratio on VT, and at the last rescan, that was already 5 days ago, was at 19/71 already... Anyway, was waiting for someone I shared with to tweet about it some details (as commonly doing nowadays), but he looks too busy (as usual), so decided it's not worth the waiting anymore, so just asked @smica83 to upload it to Bazaar as usual, and as soon as he does it, anyone will be able to look at it... 🤷‍♂️

Some sample: https://nov6fp-zone-1488-reg.westus2.cloudapp\.azure.com/files/U11 A file coming from Microsoft's Azure network, with no AV vendor detecting it on VT and even the Code insights on VT tells "There are no embedded executables, CustomActions, scripts, or malicious indicators detected in the triage report.", means that it must be legit, right? 😂 🤷‍♂️

There's also this "NOTIFICARE_PRIVIND_NERESPECTAREA_CERINTELOR_DE_RAPORTARE.lnk"... 🤔 🤷‍♂️

The "MachineID" value of this "Reguli_documentatie_financiara.lnk" looks strange... not sure if the actors doing something with that or just the parser not handles everything correctly... 🤔 🤷‍♂️

Some totally legit looking package comes from here: https://freemeetly[.]com/download/v1.0.3/mac-x86_64.zip 😂 ESET detected as "Python/DeceptiveDevelopment.S Trojan", so North Korean? 🤔 🤷‍♂️

Some strange DNS TXT records these have: get.xiner[.]top get.yabgo[.]top get.xabatay[.]top get.api-mall[.]vip 🤔 🤷‍♂️

216.203.20[.]126 🤷‍♂️