Deep Malware Analysis Reports
Dive deep into the latest behavior analysis and reverse engineering reports generated by Joe Sandbox and Joe Reverser.
Reverser Reports
Sandbox Reports
Cloud 42.3.0
Rhadamanthys delivered by an in-browser fake Windows Update, abusing the Fullscreen API (on-click), and using ClickFix-style
hxxps://thefatshallot[.]com/
Open ReportCloud 42.0.0
CloudFlare Theme ClickFix/CAPTCHAScam dropping Redline
hxxp://gogocharters[.]com/lexington-charter-bus
Open ReportCloud 42.0.0
Phishing Chain from e-Mail to Catpcha to Tycoon2FA
SHA256: c99ce182e582b618ae2fe4c7258fc113625730739086e73029f022fb689588b4
Open ReportCloud 41.0.0
CloudFlare Theme ClickFix/CAPTCHAScam dropping NetSupport RAT
hxxps://webdemo[.]biz
Open ReportCloud 40.0.0
EvilProxy using open redirect vulnerability
https://m.exactag.com/ai.aspx?tc=d9282403bc40b07205bbd26a23a8d2e6b6b4f9&url=http%3Asellartatauction.com/oplo/osiwuhjfmniek/bobibobi@outlook.com
Open ReportCloud 40.0.0
HTML payload leading to download and installation of WSHRAT
SHA256: 427fb9938ca75db1a362fe51356a1dc06350daa5f9db788a4ca2f7e2cb21fd34
Open ReportCloud 40.0.0
HTML based phisher exhibiting a large spectrum of malicious behaviors
SHA256: 360a04ca0c6ef3401d14f04089d6e7e08869ab298dbf842d8f063bfaca618891
Open ReportCloud 38.0.0
CVE-2023-36884 using RTF to load Word DOC via MSHTML iframe injection
SHA256: a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f
Open ReportCloud 38.0.0
SolarMarker with file pumping, valid PE signature, Powershell dropper and .Net backdoor
SHA256: 6f7332625d573ccc7b14264ee0db7e671305e1206c7eaf920e17c26f7b5b64a7
Open ReportCloud 37.0.0
STOP Djvu Ransomware via SmokeLoader with full config extracted
SHA256: 5ea4451ca1ce36db2dc6e7a85f07c748ddbb758b65f2194d734afd08bd141126
Open ReportCloud 36.0.0
AgentTesla v3 with full malware configuration
SHA256: c6dae959f8e5373c6ac8746cfd8227b8d8099b692ee726aacbe18ecf1479282e
Open ReportCloud 35.0.0
Stealthy new payload delivery method: HTML (showing a PW) -> ZIP encrypted -> ISO -> LNK -> Calc.exe -> DLL -> DLL -> QBOT
SHA256: f5c16248418a4f1fd8dff438b26b8da7f587b77db9e180a82493bae140893687
Open ReportCloud 33.0.0
noPac using CVE-2021-42287 - CVE-2021-42278 Exploit to gain DC Admin
SHA256: 4e37819484e865f8e20c2aaa94ec05f3bfe3bb6f36ea4bb6df376c8d4f1ffcca
Open ReportCloud 33.0.0
SysJoker Multi-Platform Backdoor
SHA256: 1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c
Open ReportCloud 33.0.0
Emotet dropped by Hidden Macro
SHA256: bb1f500a59544aa8e44a0377cc506dfbebca1ecb7a8c73dc72d3268803976ff5
Open ReportCloud 33.0.0
Kimsuky Espionage Campaign, JS instrumentation
SHA256: 20eff877aeff0afaa8a5d29fe272bdd61e49779b9e308c4a202ad868a901a5cd
Open ReportCloud 33.0.0
Hanictor analysis with VBA and shellcode execution graph, dropping FickerStealer
SHA256: 83c9c9beaca0a147e23995b84792f56cd130ccf262147374bd1114c2ac698fee
Open ReportCloud 33.0.0
Kaseya attack dropping Sodinokibi
SHA256: 939aae3cc456de8964cb182c75a5f8cc
Open Report