As manager of the free Intezer Analyze community edition I witness first hand the interesting samples our users upload on a daily basis. Among these uploads users will discover unique samples such as previously undetected malware or new variants. As part of a recurring theme and in the spirit of information sharing, I would like to highlight five notable uploads made to the Intezer Analyze community this month and explain why I believe they are significant.
1) https://analyze.intezer.com/#/analyses/559d7ca7-ca28-44e0-9cf7-a9771db8df1d
This is a linux malware which shares 1,517 genes and is classified by Intezer Analyze as Equation Group. Also known as Tilded Team, Lamberts, and EQGRP, Equation Group is a threat actor described by Kaspersky Labs as having one of the most sophisticated cyber attack groups in the world, operating alongside but always from a position of superiority with the creators of Stuxnet and Flame.
This file is considered 100% trusted by VirusTotal as of this moment, demonstrating the importance of code reuse in identifying and classifying threats.
2) https://analyze.intezer.com/#/analyses/a08f7504-4376-497c-b973-6f048a467e40
This sample was packed by UPX. It was automatically unpacked by Intezer Analyze and the payload was classified as TG-3390, also known as APT27, a Chinese threat actor.
3) https://analyze.intezer.com/#/analyses/e4ec5d3a-8fe6-45a8-bee5-dda997dde925
This is a malicious installer which drops payloads related to Foudre, an upgraded version of Infy, also known as Prince of Persia. This malware is part of a campaign which is believed to be of Iranian origin and ongoing for more than 10 years.
Read more in our blog post on the subject.
4) https://analyze.intezer.com/#/analyses/2b1b732f-ac74-4a61-8773-df5e8e7b71a1
The following is an analysis related to APT33. Note the process tree which was spawned during dynamic unpacking. You can see processes like StikyNote.exe and iexplore.exe which were injected with malicious code.
5) https://analyze.intezer.com/#/analyses/143d92a2-1e0c-4e9f-828c-3222a26a16b9
This sample initially seems trusted, but it contains an embedded malicious PE, extracted by static unpacking. It’s not uncommon to see a malicious payload hiding within a seemingly trusted piece of software, which is why Intezer Analyze provides automatic unpacking capabilities.
Not an Intezer Analyze community member? Sign up for free here: https://www.intezer.com/intezer-analyze/.
The post Top Five Community Uploads | February 2019 appeared first on Intezer.
Article Link: https://www.intezer.com/blog-top-five-community-uploads-feb-2019/