Malcat

Reported Context (8)

Tools used: Malcat, capa, FLOSS, KesaKode, a sandboxed Wine run with gdb, Python (pefile, pycryptodome), ANY.RUN and Recorded Future Triage. New Spyder Downloader Uses Sandbox Evasion and Targets South Asian Police
Tools used: Malcat, pefile, capa, Capstone, the Speakeasy emulator, Wine, tshark with a small custom decryptor for the malware’s traffic, ARIN RDAP, Shodan, and the ANY.RUN and Hatching Triage sandboxes. Signed Light Alloy Installer Lure Delivers SnappyClient Crypto-Stealing RAT
Tools used: Malcat, capa, objdump, msitools, tshark, a sandboxed Wine environment, ANY.RUN and Recorded Future Triage. Fake CAPTCHA Installer Deploys a Signed Updater That Can Run Remote Programs
Tools used: Malcat, ILSpy, a small custom .NET bundle extractor, capa, YARA, osslsigncode and OpenSSL, tshark, and the Hatching Triage sandbox. BlackCrypt Malware Uses Signed RMM Agent to Hide Phishing Lures
Tools used: Malcat (including KesaKode), capstone, Python, capa, FLOSS, StringSifter, speakeasy, a locally sandboxed Wine run, the ANY.RUN sandbox and Hatching Triage. Analysis Uncovers “Zenith” Backdoor Hidden in Signed QuartzLine PDF Viewer

CVE (1)

Malware (8)

People (4)

Threat Actors (5)

MITRE ATT&CK (33)

Vendors (6)

Products (16)

Tools (28)

Industries (4)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.