Ethical Hacking Techniques

My PC was infected by a #ransomware after I installed a cracked version of Adobe #Photoshop. The hacker told me to sit and cry, but what did i actually do? I reversed it. I used to love using #PiratedSoftware because it offered premium feature for free, but I also have zero tolerance for being hacked by someone as a result of using it. So, instead of paying the ransom while crying, I did the opposite. I stayed in the environment to see exactly how the malware was talking to the attacker’s server. Here is what i got from low-level analysis: 1. The executable file (Setup.exe) is a malware loader which drops multiple stages of payloads: Infostealer > RAT > RCE via cmd > ransomware 2. The malware Steals Discord authentication tokens from LevelDB, Telegram session files from tdata, and Steam session tokens from loginusers.vdf 3. It also steals saved passwords and cookies from 30+ Chromium browsers and all major Gecko-based browsers 4. Somehow the ransomware was not triggered in my 2nd run so, im stuck analyzing the ransomware part. 🖼️ The image below explains malware capabilites and my analysis result. Image 2: Browser credential theft flow, including autofill entries, email logins, payment data, and cookie-related data Image 3: Attacker's wallet address was decoded from hex to ASCII, resulting in C2 IP address Image 4: Exfiltration payload being recovered from memory before encryption, where it appears as a base64 blob beginning with ZIP magic bytes "If it's free, you're the product." So, avoid installing pirated software if you don't want your data being sold online. I have written my malware analysis result in the following link. Let me know your insight! 🔗 Link: https://lnkd.in/gfceCcMj #MalwareAnalysis #MalwareDevelopment #ReverseEngineering #CyberSecurity #CrackedSoftware #AdobePhotoshop

Analyzing the leaked code from the Vanhelsing Ransomware, it is essentially a highly modular and automated builder, developed in C++, designed to dynamically generate executable binaries (.exe) based on instructions received from a C2 server. The core logic includes a persistent loop (wmain) that continuously polls for new tasks via REST HTTP requests to an attacker-controlled endpoint. When a task is received, the system automatically compiles two binaries: the locker, responsible for encrypting the victim's files, and the decrypter, which allows for data recovery if the correct key is provided. The main payload is encrypted using AES-256-GCM (via libsodium), with a key derived from an X25519 key pair. The compiled locker binary is read, encrypted, converted into a binary header, and embedded into the loader, which is the final stage responsible for decrypting and executing the locker at runtime. The modular architecture allows the same locker to be reused with multiple loaders. File operations are handled directly through low-level Win32 API calls (CreateFileA, ReadFile, MoveFileA, DeleteFileA), with no dependency on external libraries. PowerShell’s Compress-Archive is also used to efficiently package and transmit artifacts via HTTP. There is a clear separation of responsibilities in the build pipeline: reading, encryption, macro substitution, architecture-specific compilation (Win32/x64), binary renaming, and upload to the C2 are all handled in well-defined stages, with error handling and diagnostics performed via GetLastError(). Summary of Evasion Techniques: - Encryption of artifacts using X25519 + AES-256-GCM - Use of fileless-like execution via loader with embedded payload - Per-build uniqueness through dynamic key and ID insertion - Compilation via MSBuild (LOLBin abuse) #redteam #cybersecurity #malware #malwaredevelopment #malwareanalysis

One key area we focused on was how malware interacts with DLLs (Dynamic Link Libraries). DLLs are shared libraries that contain functions used by multiple programs. Instead of rewriting code, Windows programs (including malware) simply call DLLs to perform common tasks like network connections, file access, or UI rendering. 🔍 Why does this matter in malware analysis? Malware often imports functions from DLLs like kernel32.dll, user32.dll, or ws2_32.dll. By analyzing which DLLs are imported, we can predict behavior before executing the file. Tools like Dependency Walker help us explore these imports in detail. As SOC analysts, we also watch for malicious DLL behaviors like: *DLL sideloading, where attackers drop a fake DLL next to a legitimate program *Export manipulation, where malware mimics the expected functions of trusted DLLs *Suspicious load paths, like DLLs running from Temporary file paths instead of places where legitimate programs typically store DLLs. Every unexpected or unusual DLL import is a clue. Learning to trace those patterns helps us catch threats early, often before any real damage is done. Here are some important DLLs and their functions:

Malware analysts, this one’s for you. If you’re currently investigating an MSI file, always make sure to dump binaries from the Binary table and inspect the binary overlays. By reviewing the CustomActions table, it usually becomes clear very quickly which files are of real interest and which are less relevant. In a recent analysis of several EvilAI infections, we came across an MSI package that dropped a CAB file, fairly typical behavior for installer packages. However, this CAB archive contained a particularly suspicious C# executable, which, once disassembled, revealed the primary dropper functionality. Interestingly, many public write-ups on MSI-based malware, including this specific campaign, mention difficulties in identifying the actual dropper source or issues handling MSI files in general. That’s often a sign of overlooking how installer packages are structured. I highly recommend taking a deeper look at the MSI file format itself and familiarizing yourself with common installer frameworks such as WiX. We see similar analysis challenges with Inno Setup and comparable packagers. Always remember to examine the File sections, overlays, and magic bytes carefully, they often hold the key to uncovering what’s really going on. #MalwareAnalysis #ThreatResearch #EvilAI #ReverseEngineering #CyberSecurity #DigitalForensics

𝗗𝗶𝗴𝗶𝘁𝗮𝗹 𝗙𝗼𝗿𝗲𝗻𝘀𝗶𝗰𝘀 𝗧𝗶𝗽: 𝗛𝘂𝗻𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝗣𝗲𝗿𝘀𝗶𝘀𝘁𝗲𝗻𝗰𝗲! 🕵️♀️ After a system is compromised, an attacker's top priority is to ensure their malware survives a reboot. They achieve this by leveraging 𝘼𝙪𝙩𝙤𝙧𝙪𝙣 mechanisms, which are legitimate Windows functions designed to launch programs and services automatically. By analyzing these registry keys, we can uncover hidden threats. 🔍 Here are two key locations to investigate: 𝟭. 𝗦𝘆𝘀𝘁𝗲𝗺 𝗕𝗼𝗼𝘁 𝗣𝗲𝗿𝘀𝗶𝘀𝘁𝗲𝗻𝗰𝗲 🖥️ Malware, especially sophisticated threats like 𝗥𝗼𝗼𝘁𝗸𝗶𝘁𝘀 and 𝗕𝗼𝘁𝗻𝗲𝘁𝘀, loves to embed itself in locations that run with high privileges at system startup, even before a user logs in.  • 𝗥𝗲𝗴𝗶𝘀𝘁𝗿𝘆 𝗣𝗮𝘁𝗵: `𝘏𝘒𝘌𝘠_𝘓𝘖𝘊𝘈𝘓_𝘔𝘈𝘊𝘏𝘐𝘕𝘌\𝘚𝘺𝘴𝘵𝘦𝘮\𝘊𝘶𝘳𝘳𝘦𝘯𝘵𝘊𝘰𝘯𝘵𝘳𝘰𝘭𝘚𝘦𝘵\𝘚𝘦𝘳𝘷𝘪𝘤𝘦𝘴`  • 𝗪𝗵𝗮𝘁 𝘁𝗼 𝗟𝗼𝗼𝗸 𝗙𝗼𝗿: Examine the `𝗜𝗺𝗮𝗴𝗲𝗣𝗮𝘁𝗵` value within each service's subkey. This value points to the 𝘦𝘹𝘦𝘤𝘶𝘵𝘢𝘣𝘭𝘦 𝘧𝘪𝘭𝘦 for that service. Finding an unfamiliar or suspicious path (e.g., in temporary user folders) is a strong indicator of a malicious service used for persistence. 𝟮. 𝗨𝘀𝗲𝗿-𝗟𝗲𝘃𝗲𝗹 𝗣𝗲𝗿𝘀𝗶𝘀𝘁𝗲𝗻𝗰𝗲 👤 Another strategic spot for malware is the `𝗦𝗵𝗲𝗹𝗹𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝗢𝗯𝗷𝗲𝗰𝘁𝗗𝗲𝗹𝗮𝘆𝗟𝗼𝗮𝗱` key.  • 𝗥𝗲𝗴𝗶𝘀𝘁𝗿𝘆 𝗣𝗮𝘁𝗵: `𝘏𝘒𝘌𝘠_𝘓𝘖𝘊𝘈𝘓_𝘔𝘈𝘊𝘏𝘐𝘕𝘌\𝘚𝘖𝘍𝘛𝘞𝘈𝘙𝘌\𝘔𝘪𝘤𝘳𝘰𝘴𝘰𝘧𝘵\𝘞𝘪𝘯𝘥𝘰𝘸𝘴\𝘊𝘶𝘳𝘳𝘦𝘯𝘵𝘝𝘦𝘳𝘴𝘪𝘰𝘯\𝘚𝘩𝘦𝘭𝘭𝘚𝘦𝘳𝘷𝘪𝘤𝘦𝘖𝘣𝘫𝘦𝘤𝘵𝘋𝘦𝘭𝘢𝘺𝘓𝘰𝘢𝘥`  • 𝗪𝗵𝘆 𝗜𝘁'𝘀 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹: Any COM objects registered here are loaded directly by the 𝗘𝘅𝗽𝗹𝗼𝗿𝗲𝗿.𝗲𝘅𝗲 process when the graphical user interface starts. This ensures the malicious code executes early and with user privileges, making it a stealthy persistence method. Mastering these analysis techniques is essential for uncovering hidden malware and securing systems. Don't skip these crucial steps in your next investigation! ✅ #CyberSecurity #DFIR #MalwareAnalysis #WindowsForensics #Persistent #APT #DF

During recent memory forensics research I've been doing on evading memory scanners, I was researching how to bypass Volatility's 𝗠𝗮𝗹𝗳𝗶𝗻𝗱 plugin, and I developed a reflective PE loader for that. 𝗠𝗮𝗹𝗳𝗶𝗻𝗱 searches for memory regions where the VAD (Virtual Address Descriptor) shows both 𝗪𝗥𝗜𝗧𝗘 and 𝗘𝗫𝗘𝗖𝗨𝗧𝗘 permissions, since legitimate applications rarely allocate 𝗣𝗔𝗚𝗘_𝗘𝗫𝗘𝗖𝗨𝗧𝗘_𝗥𝗘𝗔𝗗𝗪𝗥𝗜𝗧𝗘 memory. This makes 𝗪+𝗫 a strong indicator of shellcode injection. But since VADs store the initial allocation protection set by 𝗩𝗶𝗿𝘁𝘂𝗮𝗹𝗔𝗹𝗹𝗼𝗰, when 𝗩𝗶𝗿𝘁𝘂𝗮𝗹𝗣𝗿𝗼𝘁𝗲𝗰𝘁 changes page permissions, only the underlying page table entries (PTEs) permissions are modified, while the VAD's 𝗔𝗹𝗹𝗼𝗰𝗮𝘁𝗶𝗼𝗻𝗣𝗿𝗼𝘁𝗲𝗰𝘁 field remains as originally set. To demonstrate this, I wrote a reflective loader that: 1. Allocates memory with 𝗣𝗔𝗚𝗘_𝗥𝗘𝗔𝗗𝗪𝗥𝗜𝗧𝗘 (VAD records: RW) 2. Writes the PE image, resolves imports, applies relocations 3. Calls 𝗩𝗶𝗿𝘁𝘂𝗮𝗹𝗣𝗿𝗼𝘁𝗲𝗰𝘁 to set 𝗣𝗔𝗚𝗘_𝗘𝗫𝗘𝗖𝗨𝗧𝗘_𝗥𝗘𝗔𝗗 on the .𝘁𝗲𝘅𝘁 section The VAD still shows 𝗣𝗔𝗚𝗘_𝗥𝗘𝗔𝗗𝗪𝗥𝗜𝗧𝗘 (no execute), so 𝗠𝗮𝗹𝗳𝗶𝗻𝗱 doesn't flag it. The code executes normally because the CPU uses the actual page permissions from the PTEs, not the VAD. This shows that in an investigation, relying on a single tool can lead to missed evidence and wrong conclusions. To detect this technique, dump private VAD regions (e.g., using Volatility's 𝘃𝗮𝗱𝗶𝗻𝗳𝗼 plugin with --𝗱𝘂𝗺𝗽) and scan for PE headers (𝗠𝗭/𝟬𝘅𝟰𝗗𝟱𝗔), which reveals injected code that 𝗠𝗮𝗹𝗳𝗶𝗻𝗱 misses. However, this approach requires filtering out legitimate PEs (e.g., Windows system DLLs), and this might take some time. In a follow-up post, I'll share a detection method I developed that reliably identifies reflectively loaded PEs regardless of VAD permissions. 𝗚𝗶𝘁𝗛𝘂𝗯: https://lnkd.in/dUFiGp8z #DFIR #IncidentResponse #MalwareAnalysis #CyberSecurity #MemoryForensics #Volatility

[MALWARE ANALYSIS] PlugX Unpacked: Mustang Panda’s Multi-Layer Execution Chain ℹ️ Researchers have analyzed a January 2026 PlugX malware sample associated with Mustang Panda (aka TA416, RedDelta). The main focus is the malware’s multi-layer execution chain, especially how the sample uses a three-file set and staged execution to eventually run PlugX. 📍 EXECUTION CHAIN ■ Stage 0: Browser_Updater Fake browser/software update interface. When the user clicks Install, it downloads iis.jpg, which is actually an MSI installer, not an image. ■ Stage 1: File Dropping / Avk.exe The MSI drops the three-file PlugX set into %LOCALAPPDATA%\pZhozR\: - Avk.exe (legitimate G DATA AntiVirus binary used as a cover), - Avk.dll, and - AVKTray.dat ■ Stage 2: DLL Side-Loading / Avk.dll Avk.exe loads Avk.dll, which resolves APIs using hashing and loads the encrypted AVKTray.dat payload. ■ Stage 3: AVKTray.dat Decryption AVKTray.dat decrypts itself using XOR 0x63 and transfers execution to the next payload layer. ■ Stage 4: Manual PE Mapping The decrypted payload manually maps a 32-bit PE into memory, resolves imports, applies relocations, and runs the final payload without using the normal Windows loader. ■ Stage 5: Runtime Bootstrap and Persistence The malware installs itself into %PUBLIC%\GData, creates persistence in the HKCU\...\Run\G Data registry key, and uses the mutex aumhYjQIQ to avoid multiple instances. ■ Stage 6: Config Unpacking The malware unpacks its configuration using RC4 key VOphJo plus XOR, revealing the install path, mutex, marker, and C2 configuration. ■ Stage 7: C2 The implant uses WinHTTP to connect to fruitbrat[.]com:443, enters a controller loop, and supports commands such as download/execute, process launch, file transfer, filesystem operations, and upload. 📌 Source: 🔗 https://lnkd.in/eTpDx8AB #PlugX #MustangPanda #threathunting #threatdetection #threatanalysis #threatintelligence #cyberthreatintelligence #cyberintelligence #cybersecurity #cyberprotection #cyberdefense

21 Email Intelligence Tools Every OSINT & Cybersecurity Professional Should Know Most people think an email address is just a way to send messages. Cybersecurity professionals know it's much more than that. A single email address can reveal: → Breach history → Social media accounts → Domain ownership → Public records → Digital footprints → Reputation signals → Professional profiles That's why email intelligence has become one of the most powerful skills in OSINT, threat hunting, and cyber investigations. 🔥 21 Email Intelligence Tools Worth Bookmarking: GHunt — Investigate Google accounts and connected services. Castrick — Reverse search emails to uncover online identities. EmailRep.io — Check email reputation and risk signals. BreachDirectory — Search leaked data and breach records. ScamSearch.io — Investigate scams and suspicious identities. OSINT.Rocks — Access a collection of OSINT resources. Hunter.io — Find professional email addresses. EPIEOS — Discover digital footprints linked to emails. Holehe — Check where an email is registered online. Have I Been Pwned — Find accounts exposed in breaches. Whoxy — Research domains and WHOIS records. That's Them — Connect emails with public records. Skymem — Locate company email addresses. SimpleLogin — Create private email aliases. OSINT Industries — Perform advanced email reconnaissance. Mailcat — Find emails from usernames and aliases. DeHashed — Investigate leaked credentials and accounts. Reverse WHOIS — Identify domains owned by the same entity. InsE — Discover Instagram-linked email intelligence. SignalHire — Find professional contacts using AI. Proton Mail — Secure your communications with encryption. The future of cybersecurity isn't about having more data. It's about finding the right intelligence faster than everyone else. The professionals who master AI-powered OSINT and digital investigations will have a significant advantage in the years ahead. 📌 Save this post for future investigations. ♻️ Reshare it with your network to help other cybersecurity professionals. 👉 Follow Marcel Velica for more AI, Cybersecurity, OSINT, Threat Hunting, and Digital Investigation content.

If you’re studying Political Science and not exploring OSINT, you might be missing out on the fastest-growing career path in risk & security. Here’s why 👇 Most PolSci students get trained to read theories, debates, and history. But OSINT (Open-Source Intelligence) teaches you how to apply that knowledge to the real world. Think about it: 🔎 Instead of just studying “conflict theory,” you’re live-tracking how protests, coups, or cyberattacks unfold. 🗺️ Instead of writing about borders, you’re mapping satellite images or shipping routes. 📡 Instead of abstract debates, you’re decoding signals from Telegram, TikTok, or local news wires. 💡 Why this matters: Companies, NGOs, and governments all rely on OSINT analysts to anticipate disruptions, from supply chain risks to political instability. And PolSci students are naturally good at it because you already know how to connect dots across politics, society, and security. ✨ Want to start? Try these free resources: - OSINTCurious— beginner-friendly blogs & streams. - Trace Labs OSINT Discord — hands-on practice. - Bellingcat’s Guides — practical tutorials. PolSci isn’t just about books & exams anymore. It’s about being the person who can say: “I saw this coming.” ✨ Over the years, so many Humanities, Political Science & IR grads have reached out to me — usually feeling lost about what comes after the degree. 💡 Each time, I’ve shared a few resources that gave them clarity and helped them take real steps forward. And almost every single person comes back saying: “I wish I had this earlier.” 👉 If you’re figuring out your own path and don’t want to waste months in trial-and-error, just DM me or drop your email — I’ll share them with you too.

Part 2: Dynamic Malware Analysis Dynamic Malware Analysis is the process of running potentially malicious software in an isolated environment to monitor and analyze its actions and effects on the system. Key Aspects to Monitor: • File System Activity: Creation, modification, or deletion of files. • Process Activity: New processes spawned, process injection, or unusual process behavior. • Registry Changes: Modifications to registry keys and values. • Network Traffic: Outgoing connections, data exfiltration, or communication with suspicious IP addresses or domains. • Memory Activity: Unusual memory usage or memory injection techniques. • Persistence Mechanisms: Attempts to achieve persistence through startup entries, scheduled tasks, or services. • API Calls: Suspicious or uncommon API calls that might indicate malicious intent. • System Changes: Changes to system settings, configurations, or security policies. • Behavioral Anomalies: Any behavior that deviates from the norm, such as unexpected encryption or obfuscation. Tools for Dynamic Malware Analysis: Sandbox Environments Cuckoo Sandbox, FireEye , Joe Sandbox, Hybrid Analysis, Any.Run, VxStream Sandbox Process and System Monitoring: Process Monitor, Process Hacker, Autoruns, Noriben, Sysinternals Suite Network Analysis: Fiddler, Wireshark, TCPView, ApateDNS Static and Hybrid Analysis: VirusTotal, ReversingLabs TitaniumCloud, Intezer Analyze, Ghidra Registry and System Change Detection: Regshot Debugging and Code Analysis: OllyDbg, x64dbg, PE-sieve, Windbg, Radare2 Visual Analysis and Correlation: ProcDot Specialized Linux Toolkit: REMnux Other Tools: SysInternal Tools, CFF Explorer, PEView, BinText, PEiD, Regshot, HashMyFiles Detailed Focus Areas: Process Activities: Detect processes, focus on new child processes, DLL imports, and user context. Tools like Process Hacker help visualize these processes Network Activities: Analyze connections using Wireshark and Fiddler to understand and report the malware’s network activities Registry Activities: Monitor key registry locations HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce Tools like Regshot can compare registry states before and after malware execution to identify changes made by the malware. File Activities: Monitor directories like "Temp" and "Startup" for suspicious activities. '%TEMP%' for temporary files 'shell:startup' and 'shell:common startup' for startup directories Step-by-Step Guide for Dynamic Malware Analysis: 1. Prepare the Analysis Environment 2. Install Analysis Tools 3. Configure Monitoring Tools 4. Execute the Malware Sample 5. Monitor and Record Behavior 6. Analyze Collected Data 7. Restore the Environment BlackPerl DFIR #CyberSecurity #MalwareAnalysis #CyberDefense #Hacking