Remove 2016 Remove Analysis Remove Encryption Remove Libraries
article thumbnail

Deadglyph, a very sophisticated and unknown backdoor targets the Middle East

Security Affairs

In 2016, researchers from the non-profit organization CitizenLab published a report that describes a campaign of targeted spyware attacks carried out by the Stealth Falcon. The authors used different languages to hinder analysis, researchers explained. ” reads the analysis published by ESET.

Libraries 121
article thumbnail

North Korea-linked Lazarus APT uses a Mac variant of the Dacls RAT

Security Affairs

The group is considered responsible for the massive WannaCry ransomware attack, a string of SWIFT attacks in 2016, and the Sony Pictures hack. ” reads the analysis published by the researchers. The Mac version uses the same AES key and IV as the Linux variant to encrypt and decrypt the config file.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

JSWorm: The 4th Version of the Infamous Ransomware

Security Affairs

Technical Analysis. JSWorm encrypts all the user files appending a new extension to their name. During the encryption phase, the ransomware creates an HTML Application “JSWRM-DECRYPT.hta” in each folder it encounters. The malware encrypts all the files whose extension is not present in the list. The Encryption Scheme.

article thumbnail

Taking down Gooligan: part 2 — inner workings

Elie

This post provides an in-depth analysis of the inner workings of Gooligan, the infamous Android OAuth stealing botnet. This is the second post of a series dedicated to the hunt and takedown of Gooligan that we did at Google, in collaboration with Check Point, in November 2016. first post. Android malware. since at least 2011.

article thumbnail

Taking down Gooligan: part 2 — inner workings

Elie

This post provides an in-depth analysis of the inner workings of Gooligan, the infamous Android OAuth stealing botnet. This is the second post of a series dedicated to the hunt and takedown of Gooligan that we did at Google, in collaboration with Check Point, in November 2016. first post. Android malware. since at least 2011.

article thumbnail

Taking down Gooligan: part 1 — overview

Elie

This series of posts recounts how, in November 2016, we hunted for and took down Gooligan, the infamous Android OAuth stealing botnet. and the analysis of. The second post provides an in-depth analysis of Gooligan’s inner workings and an analysis of its network infrastructure. fake phone verified accounts. ,

Libraries 107
article thumbnail

Taking down Gooligan: part 1 — overview

Elie

This series of posts recounts how, in November 2016, we hunted for and took down Gooligan, the infamous Android OAuth stealing botnet. and the analysis of. provides an in-depth analysis of Gooligan’s inner workings and an analysis of its network infrastructure. This APK embedded a secondary hidden/encrypted payload.