R136a1

Losing access to VirusTotal Intelligence at the start of the year was surprisingly productive.

You might have also wondered why, especially over the last few years, it has become increasingly rare to read about truly interesting malware and its in-depth analysis.

This blog post analyzes the latest version of Turla’s Kazuar v3 loader, which was previously examined at the beginning of 2024.

Originally, this topic should be part of an analysis of Turla’s COM Kazuar loader, but I decided to write a blog post about this DLL sideloading in general instead.

You might remember ZeroAccess, one of the largest and most advanced P2P botnets that ever existed.

In April, Kaspersky briefly described a new malware dubbed DreamLand in their APT trends report Q1 2023.

While analysing the downloader from APT29 that uses the Slack messaging service (SHA-256: 879a20cc630ff7473827e7781021dacc57bcec78c01a7765fc5ee028e4a03623), I’ve found another downloader that utilizes Google Drive.

You may have heard of dotnetfile, a library to extract header information from .NET assemblies.

During a malware analysis, you may encounter the situation where a next stage payload is loaded or injected into another process.

◝(⁰▿⁰)◜ (ﾉﾟ▽ﾟ)ﾉ