Python Backdoor Uploaded from Taiwan
On April 18, 2025, I came across an interesting LNK file uploaded from Taiwan (f4bb263eb03240c1d779a00e1e39d3374c93d909d358691ca5386387d06be472), which I subsequently found had been initially disco...
dmpdump
Unattributed Shellcode Loader Likely Targeting Cambodia
On March 20, 2025, MalwareHunterTeam shared a sample of a ZIP file containing an LNK, uploaded from Cambodia: The ZIP file is named CNP_MFA_Meeting_Documents.zip. It contains an LNK file named M...
China-nexus Kivars Backdoor Uploaded from Taiwan
On February 22, 2025, MalwareHunterTeam shared a DLL uploaded from Taiwan with hash 1286aa5c73cf2c8058c52271869a5727d71ca5bd4dd0854be970d2a25cb52bf8 The DLL was uploaded from Taiwan on February ...
Lazarus Backdoor with IT Lure
On January 27, 2025, @smica83 shared a sample on X indicating that it looked like Lazarus malware. I reviewed the sample and concluded that, indeed, it is a North Korean backdoor, likely the latest...
Targeted Campaign Delivering Havoc
On January 15, 2025, a file named DH-Report76.pdf.lnk was uploaded to VirusTotal. The LNK file was likely being delivered to victims from army-mil[.]zapto.org. Parsing the LNK file, we can see t...
North Korea-nexus Golang Backdoor/Stealer from Contagious Interview campaign
On December 28, 2024, @tayvano_ shared a great thread on X describing activity consistent with what is typically known as the “Contagious Interview” campaign conducted by North Korea-nexus threat a...
Trojanized Chrome Extensions
I rarely deal with malicious browser extensions, however, they are likely to become increasingly relevant in the future. It is commonly said that “the browser is the new OS”, so it only makes sense...
PUBLOAD Likely Delivered to Thailand via GrimResource MSC
On December 20, 2024, a Microsoft Management Console (MSC) file named “Invitation Letter.msc” was uploaded from Thailand to VirusTotal. File name: Invitation Letter.msc Hash: 5b18f8b379cb3294...
KoiLoader/KoiStealer
On November 29,2024, MalwareHunterTeam posted the following sample in X: https://x.com/malwrhunterteam/status/1862624900592119903 File name: mysetup.exe Hash: e29d2bd946212328bcdf783eb434e1b...