#ThreatHunting Open Directory (Index of /) -> 101.201.62[.]40 Process: - All files in the directory (.exe, .part, .reg, .bat, .sh) were examined. - Static and dynamic analysis was applied to suspicious samples. - Code segments were evaluated for common origin detection using SHA-256 comparison. Static and Dynamic Analysis Findings: - The PE code sections (CODE sections) of the four different samples presented as HWID spoofer, Steam installation, motherboard replacement tool, and Windows activator have the same SHA-256 hash value (9251b16208...). The fact that only the .rsrc sections differ indicates that the core code is common, but the embedded payloads have been modified. - The detected mutexes, SMTP configurations, and C2 indicators show similarities to the previously reported XRed/XRedRAT infrastructure. During the analysis, functions related to keyboard logging, SMTP communication, and remote command execution were detected. - The SteamSetup_iELl2y3l_.exe.part instance does not have a valid Valve digital signature and shares the same code section as the other three instances. - Hiding -> High entropy of 7.75–7.96 observed in the .rsrc partition (indicator of compressed or encrypted content); Synaptics.exe is silently writing to disk within the NSIS installation structure. In Summary: At first glance, the package appeared to be a game cheat/activator archive, but analysis of the files revealed the true picture; Key Components: - Backdoor: QTspoofer硬刷工具.exe, SteamSetup_iELl2y3l_.exe.part, 一键主板修改_微星无脑改_.exe, 激活系统.exe — XRed/XRedRAT similarity. - 关杀毒.exe(.part) -> UPX packed; it includes functions designed to disable security products. - 大志无敌解码.exe -> It includes functions for modifying Windows Defender configurations. - 注册表管理.exe -> Dropper carrying 9 MB encrypted payload. - 重装工具_密码vip0.EXE -> It includes password protection, driver usage, encryption, and anti-debug techniques. - 请打开我-关闭管理员权限.reg -> EnableLUA=0 modifies the UAC configuration. - 修改显示器.exe -> EDID changers can be used for hardware identity manipulation purposes. #IOCs: - C2 / Network: xred.mooo[.]com, xred.site50[.]net, freedns.afraid[.]org, api.ilanzou[.]com, share.weiyun[.]com, xyboot[.]com - E-mail / Extraction: xredline1[@]gmail.com, xredline2[@]gmail.com, xredline3[@]gmail.com - Mutex: Synaptics2X - Extracted Files: Synaptics.exe Synaptics.dll SUpdate.ini SSLLibrary.dll cachex.ini autorun.inf - Registry / Persistence: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] "EnableLUA"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /d 1 /t REG_DWORD /f reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /d 1 /t REG_DWORD /f reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /d 1 /t REG_DWORD /f reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /d 1 /t REG_DWORD /f reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /d 1 /t REG_DWORD /f #ThreatIntelligence #DFIR #MalwareAnalysis #OpenDirectory #OSINT #BlueTeam #CyberSecurity #Cyberthint

🚨 Threat Research The research started from an open "Index of" directory accessible at 103.80.134[.]8[:]8085. Process Followed: - The "SEWanClt.exe", "Domains.dat", and related configuration files located in the open directory were examined. - The relevant ZIP packages were obtained, and static and dynamic analyses were performed. Under Review: "SEWanClt.exe" Summary of Static and Dynamic Analysis: 1. Main Component — RAT (SEWanClt.exe). A 1.58 MB PE32 file compiled with Borland Delphi (fake build timestamp: 1992-06-19). The DATA partition's entropy of 7.83 points to embedded encrypted data. The imported functions provide a complete surveillance profile: - Keyboard recording (SetWindowsHookEx) - Remote input injection (keybd_event / mouse_event / SendInput) - Voice recording (waveInOpen) - Backdoor listening (socket / listen / accept) - Screen capture (BitBlt) - Privilege escalation (AdjustTokenPrivileges) 2. In Delphi form definitions, voice listening (VoiceSpy), remote command shell (RCmdRun / StdIORedirect), and transparent cover window (TransMouse) were found. When a form header encoded in UTF-7 was decoded, "本机已锁定" (This machine is locked) was obtained — a screen locking function is present, but no ransomware operation was found during the investigations. 📌 Toolkit The analysis resulted in a Delphi-based remote management/monitoring platform consisting of at least 16 components belonging to the same ecosystem. Key Components: - Persistence: %APPDATA%\SyncEXPwan, System32\WanStarter.exe, HKLM\CurrentVersion\Run + RunOnce - Dropped Files: DeskSide.exe, DXGICap2.dll, DXGICap3.dll, Locker.jpg, Domains.dat, IPlist.dat - Mutex: Global\AppRescuer2MapLocker - Defense Evasion: DisableTaskMgr, DisableRegistryTools #ThreatIntelligence #DFIR #MalwareAnalysis #ThreatHunting #CyberThreatIntelligence #MalwareResearch #OSINT #BlueTeam #IncidentResponse #CyberSecurity #Cyberthint

New RaaS Platform Discovered: HYFLOCK In our recent extensive threat hunting operations, we uncovered a new, previously undocumented RaaS (Ransomware-as-a-Service) platform operating on the Tor network: HYFLOCK (http[:]//e5hdifgit6ua7k4ggmltume7kbyryksdnlrkc55we33fnshgxfeqgsyd[.]onion/) Our team not only mapped the outer surface of the target (traces like Chinese comment lines hidden in CSS files), but also went behind the authentication layer, directly accessing the operational management panel and the current user manuals (v1.0.0) used by cybercriminals. This firsthand intelligence clearly reveals the corporate workings of modern ransomware groups. Here are the critical findings we've uncovered from the depths of Operation HYFLOCK: 🔍 Cross-Platform Builder Automation: Affiliates can log into the panel and compile target-specific malware (encryptor) within minutes. The system supports Windows, Linux/NAS, and ESXi platforms. A new hash is generated with each compilation, rendering static analysis security measures ineffective. ⚙️ Advanced Operating Parameters: The parameters included in the guide show how attackers adapt their tactics (TTPs) depending on the target: "--gpospread": Automatic deployment via GPO in Active Directory environments (with Domain Admin privileges). "--network-only": Only encrypt network shares and cloud storage areas. "--delete-shadows": Deleting shadow copies prevents recovery. 💰 Trustless Business Model and Separation of Powers: The system operates with an 80% affiliate commission and a 20% platform commission. The most notable OPSEC (Opposition-to-Personal Security) measure is that affiliates never have access to the decryptor. Once negotiations are complete, the key is directly transmitted to the victim by the system administrators. This strict rule prevents commission evasion while also protecting infrastructure administrators. 🌐 Underground Market: HYFLOCK is not just a ransomware panel; it also houses an integrated marketplace ecosystem where attackers can buy and sell exploit code, leaked databases, and privilege escalation tools among themselves. The traces of Chinese developers we identified in the code structure and the global marketing of the platform with Russian/English interfaces demonstrate the latest stage in international subcontracting within the cybercrime world. The images show the panel's internal interface and details of the directory used by the attackers among themselves. #CTI #ThreatIntelligence #Ransomware #HYFLOCK #RaaS #CyberSecurity #InfoSec #MalwareAnalysis #ThreatHunting #Cybercrime