Continuing from last month, the team at ANY.RUN has been hard at work. We’ve rolled out more features, ramped up our threat detection capabilities, and added new rules. <\/p>\n\n\n\n
Let’s dive into the details. <\/p>\n\n\n\n
Product updates <\/h2>\n\n\n\n
New detection logic for IP, URL, Domain<\/strong>. The overhauled logic enables more robust detection of malicious IPs, <\/strong>URLs,\u00a0and domains.\u00a0<\/p>\n\n\n\n We\u2019ve added support for several new malware and improved detection capabilities for families that were already supported.\u00a0<\/p>\n\n\n\n Lu0Bot<\/a> uses Node.js and heavily obfuscates its code. It starts by unpacking an SFX file, passes byte data to node input, then decrypts and executes the main JS code. Functions include string decryption using its own cipher suite like base64 and RC4, domain assembly, PC info collection, and AES-128-cbc encryption for traffic.\u00a0<\/p>\n\n\n\n Strela<\/a> is a stealer that specializes in stealing email credentials from Thunderbird and Outlook applications. The malware itself is relatively simple, but its analysis is complicated by the packer layer.\u00a0<\/p>\n\n\n\nNew malware config extractors and fixes <\/h2>\n\n\n\n
Lu0Bot support <\/h3>\n\n\n\n
![\"Lu0Bot](\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-26.png\")
<\/figure>\n\n\n\nStrela extractor and new YARA rules <\/h3>\n\n\n\n
<\/figure>\n\n\n\nRaccoonClipper extractor and new YARA rules <\/h3>\n\n\n\n
![\"RaccoonClipper](\"\/cybersecurity-blog\/wp-content\/uploads\/2023\/08\/image-27.png\")
<\/figure>\n\n\n\n