{"id":6349,"date":"2023-11-29T07:38:36","date_gmt":"2023-11-29T07:38:36","guid":{"rendered":"\/cybersecurity-blog\/?p=6349"},"modified":"2023-11-29T13:29:50","modified_gmt":"2023-11-29T13:29:50","slug":"5-threats-nov-2023","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/5-threats-nov-2023\/","title":{"rendered":"5 malware threats we discovered in the wild in November 2023"},"content":{"rendered":"\n

ANY.RUN<\/a> interactive sandbox excels in analyzing malware that evades automated solutions, which means that we always have a supply of interesting samples. Trusted by top security teams worldwide, the ANY.RUN malware sandbox sees over 14,000 sample submissions daily from our community. <\/p>\n\n\n\n

Our malware analysts at ANY.RUN use this \u2014 and other resources \u2014 to continuously scan the threat landscape. Make sure to follow our ambassador Jane<\/a> and ANY.RUN’s official page<\/a> on Twitter for interesting findings and timely updates.<\/p>\n\n\n\n

But in case you missed some of recent posts, this article compiles our notable observations about the threat landscape from the past month. <\/p>\n\n\n\n

1. Steganography <\/h2>\n\n\n\n

We identified a new phishing campaign utilizing steganography, a technique historically seldom used due to its complexity. However, its application has notably increased. <\/p>\n\n\n\n

Read our analysis of steganography in phishing.<\/a> <\/p>\n\n\n\n

As of recently, the campaign subsided, but new samples suggest its resurgence \u2014 as seen in this sample<\/a>. <\/p>\n\n\n\n

This new campaign employs steganography in multiple stages:<\/p>\n\n\n

\n
\"\"<\/figure><\/div>\n\n\n
    \n
  1. The modified “Google Update” app downloads multiple PE files and an image containing a DLL <\/li>\n<\/ol>\n\n\n\n
      \n
    1. TrueUpdate, downloaded in the previous step, extracts and decrypts the DLL from the image file with 256 bytes XOR key and transfers control to the received DLL <\/li>\n<\/ol>\n\n\n\n
        \n
      1. Then a malicious module comes into play, hosting a Remote Access Trojan and intercepting control. The actions of gh0strat become evident on the network at the specified address: 112.213.101.146:7700 <\/li>\n<\/ol>\n\n\n\n

        You can find more samples that employ steganography in ANY.RUN\u2019s public submissions \u2014 just search by tag #stego or use this link<\/a>. <\/p>\n\n\n\n\n

        \n\n

        \nANY.RUN Enterprise plan at a discount\n
        \nUse promo: SANDBOXSAVER<\/span> \n<\/p>\n\n        \nBook a call\n<\/a>\n<\/div>\n\n\n\n