← Toutes les actualités
Everyone on X was yapping about this Meccha Chameleon malware thingie. Internet nerds have been d...
Synthèse
Analyse technique d'une campagne malveillante appelée Meccha Chameleon, caractérisée par une chaîne d'infection utilisant des fichiers batch non obfusqués, des téléchargements HTTP et des scripts AutoHotKey. Le malware final est un voleur de cryptomonnaies écrit en C# .NET avec des tentatives de chiffrement AES256 et des fonctionnalités de RAT, présentant une sécurité globalement faible avec des clés de chiffrement documentées.
Everyone on X was yapping about this Meccha Chameleon malware thingie. Internet nerds have been doing some internet detective research trying to find out who did it (I have no idea why, it was a relatively small malware campaign, there is much more dangerous malware than this). Anyway, I bonked it with a stick. > everyone yappin about this > look inside > goofy ahh batch file > http downloads from ip address > http? not https?
what year is it? > steamb. bat > more ghetto batch files > not obfuscated > ok thanks i guess idk > more http downloads > makes fake microsoft security center folder > ??? > downloads auto hot key script > notes present > AI GENERATED TRASH > aes256 encrypted data blob > fragmented > all parts are labeled (part 1 - part 66) > aes256 iv and key labeled > ??? WHO IS THIS FOOLING BRO > image 1 > make goopy python script > add p1 - p66 together > decrypt with documented aes256 keys > lmfao wtf > makes .
exe > look at . exe > . NET c# goop > first line of code > EXTRACT PAYLOAD FROM RESOURCE SECTION > ??? > encrypted, but encryption goopies still there > image 2 > extract goopies > another .