Mops is a modular x64 loader delivered by MixLoader and packed with the Golang packer Dormouse. It talks to its operator over a hand-rolled WebSocket channel, keeps a 64-domain DGA as fallback, and receives all of its capabilities as DLL modules mapped into a suspended cmd.exe. This post details the loader, its C2 protocol, and the two modules recovered from the live infrastructure: the Mops stealer (also seen branded Redhive) and an update/download-and-execute module.
ACECryptor is a crypter utilized by numerous cybercriminals. The service has been observed dropping various types of malicious software, including Remote Access Trojans (RATs), stealers, and loaders such as RedLine, SmokeLoader, and GCleaner, among others. This article provides a hands-on, step-by-step walkthrough of the process to unpack ACECryptor.
XWorm is a Remote Access Trojan (_RAT_) developed in .NET, the malware is mostly spread via phishing campaigns using homemade or opensource packing tools. Note, that some versions of the source code have leaked on Cybercrime forums and also on Telegram channels. This analysis focuses on the XWorm version 3.0.
BumbleBee is categorized as a Loader, the malware is used by Initial Access Brokers to gain access in targeted companies. This article aims to summarizing the different TTPs observed in campaigns distributing BumbleBee and provides a script to extract its configuration.
