Anyrun

Editor’s note: The current article is authored by Mostafa ElSheimy, a malware reverse engineer and threat intelligence analyst. You can find Mostafa on X and LinkedIn. In this malware analysis report, we conduct an in-depth examination of AZORult, a sophisticated credential and payment card information stealer. Our walk-through covers the malware’s evolution, including its transition from Delphi to […]

The post AZORult Malware: Technical Analysis appeared first on ANY.RUN's Cybersecurity Blog.

Welcome to ANY.RUN‘s monthly update, where we share what our team has been working on.  In August, we focused on enhancing our detection tools and improving your experience. We added the new XOR-URL extractor, updated YARA rules, added new signatures, and improved network detection rules.   Here’s a closer look at what we’ve done in […]

The post Release Notes: New YARA Rules, Signatures, Config Extractors, and More  appeared first on ANY.RUN's Cybersecurity Blog.

Cyber attacks are becoming more complex and frequent, targeting organizations of all sizes. To counter these threats effectively, organizations need insights into their adversaries’ methods and capabilities.   This is where threat intelligence comes in.  Threat intelligence involves analyzing data about potential or current attacks to understand and defend against adversaries more effectively. It’s not […]

The post Why is Threat Intelligence Important   appeared first on ANY.RUN's Cybersecurity Blog.

Malware is evolving faster than ever. As security measures improve, so do the techniques used to bypass them. This ongoing arms race has led to increasingly sophisticated obfuscation methods that challenge even seasoned analysts.  This blog post will explore some of the cutting-edge obfuscation tactics we’re seeing in the wild. We’ll break down how they […]

The post 6 Common Obfuscation Methods in Malware  appeared first on ANY.RUN's Cybersecurity Blog.

Editor’s Note: This is an edited version of an article originally posted in October 2023. It has been updated with some new information about ANY.RUN’s threat intelligence products. Cyber Threat Intelligence (CTI) — often referred to as “Threat Intelligence” or “Threat Intel” — is the practice of gathering and analyzing data to identify, understand, and […]

The post What is Cyber Threat Intelligence appeared first on ANY.RUN's Cybersecurity Blog.

At ANY.RUN, we’re committed to staying at the forefront of cybersecurity threats. Our team continuously monitors and analyzes emerging phishing campaigns to keep our users informed and protected. We regularly share our findings on our X (formerly Twitter) account.    In this article, we’ve compiled a selection of the most notable phishing campaigns we’ve seen […]

The post Recent Phishing Campaigns Discovered by ANY.RUN Researchers appeared first on ANY.RUN's Cybersecurity Blog.

A sophisticated campaign is targeting Chinese-speaking users, distributing a malware known as ValleyRAT.  What’s happening?  There’s a new campaign spreading a multi-stage threat designed to monitor and control infected systems while deploying additional plugins to cause further damage.  Key components of the campaign: ValleyRAT employs a range of techniques to evade detection, including the use […]

The post New ValleyRAT Campaign Spotted with Advanced Techniques  appeared first on ANY.RUN's Cybersecurity Blog.

When you investigate suspicious files or potential malware, you need deep visibility into process behavior. ANY.RUN‘s Advanced Process Details provides exactly that – in-depth information about how a specific process interacts with the system.  In this article, we’ll take a high-level look at what information you can find in advanced process details. Let’s get started!  […]

The post Advanced Process Details: See How Each Process Interacts with the System appeared first on ANY.RUN's Cybersecurity Blog.

Today’s malware is complex, and often comes with a wide assortment of evasion methods.   Many families got so good at evading automated sandboxes, that traditional methods often fall short in detecting them. This is where interactive malware sandboxes like ANY.RUN come into play — it offers a powerful tool for cybersecurity professionals to engage directly […]

The post What is an Interactive Malware Sandbox? appeared first on ANY.RUN's Cybersecurity Blog.

An emerging threat is a new or evolving cybersecurity risk that is particularly challenging to defend against due to the lack of intelligence on its attack methods, strategies, and techniques.  These threats can take various forms, from sophisticated malware to unconventional attack vectors. They also often exploit new vulnerabilities or technologies that can bypass current […]

The post What Are Emerging Threats <br>and How to Investigate Them appeared first on ANY.RUN's Cybersecurity Blog.

We’re excited to share that ANY.RUN has been honored with multiple recognitions from G2, the world’s leading business software and services review platform!   As always, we’re committed to providing top-tier malware analysis and system security solutions to all our customers, which is reflected in these titles ANY.RUN received on G2:  Here’s what each title […]

The post ANY.RUN Recognized as a Leader in Multiple G2 Categories for 2024 appeared first on ANY.RUN's Cybersecurity Blog.

We’ve uncovered a new campaign delivering DeerStealer malware by exploiting Google’s own advertising platform and other legitimate services.  Read in-depth analysis of DeerStealer.  What’s happening?  Adversaries are impersonating Google Authenticator in Google Ads to deliver the DeerStealer information-stealing malware.  Easily analyze malware in ANY.RUN sandbox  Get started free The campaign uses sophisticated techniques to evade […]

The post Fake Google Authenticator Website Installs Malware via Google Ads appeared first on ANY.RUN's Cybersecurity Blog.

Welcome to ANY.RUN‘s monthly updates, where we share our team’s achievements over the past month.   In July, we introduced new features in Threat Intelligence Lookup, added Windows 10 for free users, reduced task startup time, implemented numerous YARA rules and signatures, and expanded our Suricata ruleset.   Let’s break down what’s new in ANY.RUN […]

The post Release Notes: New IOCs in TI Lookup, Network Threats Tab, Free Windows 10 VM, and More appeared first on ANY.RUN's Cybersecurity Blog.

Our team recently uncovered a malware distribution campaign for a threat we’ve named DeerStealer.  The malware was spread through fake Google Authenticator websites, captured in this analysis session.  The site appears to be a Google page offering the application for download. The first site we discovered, authentificcatorgoolglte[.]com, mimics safety.google/intl/en_my/cybersecurity-advancements:  Clicking the Download button sends visitor […]

The post Brief Overview of the DeerStealer Distribution Campaign  appeared first on ANY.RUN's Cybersecurity Blog.

TTPs stands for Tactics, Techniques, and Procedures, a concept commonly used in cybersecurity to describe the behavior patterns of threat actors or adversaries. What are TTPs? TTPs refer to the specific methods and patterns that adversaries use to carry out their objectives. Understanding TTPs is crucial for defenders to anticipate, detect, and respond to threats […]

The post What are TTPs: Tactics, Techniques <br>and Procedures appeared first on ANY.RUN's Cybersecurity Blog.

Indicators of compromise (IOCs) are essential for proactive cybersecurity. They help you identify and respond to threats effectively. However, getting high-quality IOCs can be difficult, as the best source for this data is the malware’s code, analyzing which often requires hours of intensive work.  ANY.RUN sandbox users know that config-extracted indicators can be easily found […]

The post Collect and Use IOCs from Malware Configs <br> in TI Lookup  appeared first on ANY.RUN's Cybersecurity Blog.

At ANY.RUN, we’re all about making in-depth technical information accessible. One of the ways we do this is by providing you with various detailed, yet easy-to-understand reports on malware behavior. One such report is Process graph.  What is Process graph?  Process graph is a report that visually shows how system processes, especially malicious ones, relate […]

The post See Malicious Process Relationships <br> on a Visual Graph  appeared first on ANY.RUN's Cybersecurity Blog.

Editor’s note: The current article is authored by Mohamed Talaat, a cybersecurity researcher and malware analyst. You can find Mohamed on X and LinkedIn. Brute Ratel C4 (BRC4) is a customized, commercial command and control (C2) framework that was first introduced in December 2020. Its primary use is for conducting adversarial attack simulation, red-team engagements, […]

The post Brute Ratel C4 Badger Used to Load Latrodectus appeared first on ANY.RUN's Cybersecurity Blog.

A recent update by CrowdStrike on July 18, 2024, resulted in a worldwide outage, causing significant disruption for users who were left with blue screens of death (BSODs) on their devices. Cybercriminals seized the opportunity to target affected users with phishing scams and malware.  The ANY.RUN team has been closely monitoring the situation after the […]

The post Find Threats Exploiting CrowdStrike Outage <br> with TI Lookup   appeared first on ANY.RUN's Cybersecurity Blog.

Cyber Threat Intelligence is a powerful tool that helps organizations make sense of the vast amounts of data generated by their cybersecurity systems.  By analyzing this data, cyber threat intelligence provides insights into the specific details of an organization’s security posture. It enables security teams to identify risks, anticipate potential threats, and assess the effectiveness […]

The post What Are the 3 Types of Threat Intelligence Data appeared first on ANY.RUN's Cybersecurity Blog.