Malware · Analysis · Reference
Malware Analysis
Reference database of active malware families with TTPs, evasion techniques, C2 protocols and detection opportunities. Updated from threat intelligence feeds.
Analysis Methodology
01
Triage
- ·Hash (MD5/SHA256/SHA1)
- ·VirusTotal submission
- ·File type + magic bytes
- ·String extraction (FLOSS)
- ·Packer detection (Detect-It-Easy)
02
Static Analysis
- ·PE header review (PE-bear)
- ·Import/Export table analysis
- ·Certificate check
- ·Resource extraction
- ·Code similarity (CAPA, Yara-X)
03
Behavioural (Sandbox)
- ·Any.run / Triage detonation
- ·Process tree analysis
- ·Registry + FS modifications
- ·Network traffic capture
- ·API call monitoring
04
Deep Reverse
- ·Disassembly (Ghidra/IDA)
- ·Deobfuscation of strings
- ·C2 protocol reconstruction
- ·Decryption of config
- ·MITRE ATT&CK mapping
05
Detection
- ·YARA rule authoring
- ·Sigma SIEM rule
- ·Network IDS signature
- ·IOC extraction (IPs, domains, hashes)
- ·Hunting query (KQL/SPL)
Active Malware Families
Information Stealers
| Family | Language | Since | Targets / Payload | C2 Protocol | Key Evasion | MITRE |
|---|---|---|---|---|---|---|
| RedLine | C#/.NET | 2020 | Browsers, crypto wallets, FTP clients | HTTP/S | DotNet obfuscation, AntiVM | |
| Raccoon | C++ | 2019 | Browsers, crypto, email clients | Telegram, HTTP | Process injection, string encryption | |
| Vidar | C++ | 2018 | Browsers, VPNs, gaming clients, 2FA apps | Mastodon/Telegram → HTTP fallback | Legitimate binary masquerade | |
| Lumma | C | 2022 | Browsers, crypto, Telegram, Discord | HTTP with domain rotation | Heaven's Gate, APC injection |
Remote Access Trojans (RATs)
| Family | Language | Since | Targets / Payload | C2 Protocol | Key Evasion | MITRE |
|---|---|---|---|---|---|---|
| AsyncRAT | C#/.NET | 2019 | Windows endpoints, corporate networks | TCP (custom protocol) | AMSI bypass, reflective loading | |
| Remcos | C++ | 2016 | Corporate, government, OT environments | TCP/UDP with RC4 encryption | Process hollowing, WMIC persistence | |
| NjRAT | VB.NET | 2013 | MENA region, government, industrial | TCP (hardcoded port) | Mutex check, AntiVM registry | |
| Quasar | C#/.NET | 2014 | Financial, government (also used by APT10) | AES-256 encrypted TCP | Legitimate process name masquerade |
Ransomware
| Family | Language | Since | Targets / Payload | C2 Protocol | Key Evasion | MITRE |
|---|---|---|---|---|---|---|
| LockBit 3.0 | C/C++ | 2019 | All sectors, 60+ countries | Tor .onion, HTTPS exfil | Intermittent encryption, anti-debug, VM-aware | |
| ALPHV/BlackCat | Rust | 2021 | Healthcare, critical infrastructure | Tor v3, I2P, HTTPS | SafeMode boot reboot, volume shadow deletion | |
| Play | C++ | 2022 | Manufacturing, healthcare, government | Tor-based, public key crypto | BYOVD (bring your own vulnerable driver) | |
| RansomHub | Go | 2024 | Healthcare, financial, critical infra | Tor negotiation portals | AES+x25519 hybrid encryption |
Loaders / Droppers
| Family | Language | Since | Targets / Payload | C2 Protocol | Key Evasion | MITRE |
|---|---|---|---|---|---|---|
| SmokeLoader | C | 2011 | Delivers stealers, banking trojans, ransomware | HTTP with base64+RC4 | Process injection, API hashing, anti-analysis | |
| GuLoader | VBScript/Shellcode | 2019 | Delivers Remcos, AgentTesla, FormBook | CloudServices (Google Drive, OneDrive) | NTDLL unhooking, junk code, anti-sandbox | |
| IcedID (BokBot) | C | 2017 | Banking, enterprise, initial access broker | HTTPS with domain fronting | Stolen cert signing, DLL sideloading | |
| Gootloader | JavaScript | 2020 | Law firms, accountancies (SEO poisoning) | WordPress compromised sites | JavaScript obfuscation, environment checks |
Wipers & Destructive
| Family | Language | Since | Targets / Payload | C2 Protocol | Key Evasion | MITRE |
|---|---|---|---|---|---|---|
| INDUSTROYER2 | C++ | 2022 | Ukrainian energy grid (IEC 60870-5-104) | Hardcoded (no C2 needed) | Legitimate ICS protocol abuse | |
| WhisperGate | C# | 2022 | Ukrainian government, financial sector | None (destructive only) | Fake ransomware display, MBR overwrite | |
| HermeticWiper | C++ | 2022 | Ukraine, pre-invasion preparation | None (wiper) | Signed EaseUS Partition Master driver |
Analysis Resources & Sandboxes
MalwareBazaar
Upload/download malware samples, query by hash/tag/YARA. Public API available.
VirusTotal
Multi-engine scan, behaviour reports, YARA livehunt, graph pivoting.
Any.run
Interactive sandbox — watch malware execute in real time. Free tier available.
Tria.ge
Fast automated sandbox with CAPE-based YARA extraction. API accessible.
Unpac.me
Automated unpacker for common packers (UPX, NSPack, Themida). Public submissions.
CAPE Sandbox
Open-source sandbox focused on config extraction and payload unpacking.