Loading story…
Check Point Research published a reverse-engineering walkthrough showing how analysts can directly invoke native assembly functions from malware instead of reimplementing complex logic by hand. Using MiniDuke’s modified SHA1 routine as the example, the report explains that the malware builds a per-system encryption key by hashing a buffer containing the computer name and network interface descriptions, and that the function uses a custom calling convention while returning the 160-bit digest across five registers.
The researchers demonstrated three working approaches to reproduce the same Duke-SHA1 output: IDA Pro Appcall, Dumpulator with a process minidump, and standalone emulation with Unicorn Engine. The write-up says Appcall is effective when operating inside IDA with a debugger, Dumpulator is especially useful for preserving process context, and Unicorn offers the most independent option when analysts only have the target code bytes and need to execute the routine in isolation.
Get the actors, campaigns, and ATT&CK mapping behind it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a digitally signed .NET malware sample, `PDFriend.exe`, that posed as a PDF utility while acting as a modular fileless dropper. The binary used Costura.Fody to embed dependencies, fetched raw C# source code from `api.mikonfig.com`, compiled it in memory through .NET Roslyn APIs, and executed the resulting modules without writing a new executable to disk. Those modules performed host fingerprinting, killed browser processes, tampered with Chrome and Edge SQLite databases to hijack search settings, deployed a secondary payload from `installmyapps.com`, created persistence with a scheduled task named `PDfriendTask`, and supported data exfiltration to remote infrastructure. The sample was also signed with a GlobalSign EV code-signing certificate issued to **THE-SHOP STOP LLC**, with timestamping preserving trust after certificate expiration. Separate reporting on Wicked Panda (**APT41**) described a comparable intrusion pattern built around stealthy in-memory execution and evasion. In the simulated chain, attackers used DLL sideloading with a legitimate executable such as `taskhost.exe` to launch the DodgeBox loader, decrypt a second-stage payload from an encrypted DAT file, and reflectively load the MoonWalk backdoor in memory. DodgeBox employed sandbox checks, dynamic API resolution, obfuscated hashing, and `NtAllocateVirtualMemory`, while MoonWalk enabled remote command execution and persistence through a Windows Run registry key. The activity also showed how command-and-control and data exfiltration could be concealed inside legitimate-looking Google Drive API traffic, underscoring continued attacker reliance on trusted binaries, signed code, and fileless payload delivery to evade detection.
Jun 29, 2026
SentinelOne published a technical walkthrough showing how analysts can reverse the macOS malware **EvilQuest** and defeat its anti-analysis behavior with **radare2**. The guide demonstrates how to prepare a malware sample in a controlled macOS virtual machine, attach the debugger with elevated privileges, inspect functions and cross-references, and rename imported library calls to clarify the sample’s execution flow. The tutorial focuses on dynamically bypassing EvilQuest checks without patching the binary, including skipping function execution and altering register return values during debugging. SentinelOne highlights routines such as `_is_virtual_mchn` and `user_info`, and notes that one of the checks appears closer to sleep-based sandbox evasion than true virtual-machine detection. The malware, first seen in 2020 and initially described as ransomware, is characterized in the report as ineffective in the wild and possibly a proof of concept or early-stage project.
Aug 14, 2026
Palo Alto Networks' Unit 42 analyzed **Seaduke**, a Windows backdoor detected by some antivirus products as `Trojan.Win32.Seadask`, and linked it to the broader **Duke malware family** previously documented by Symantec. The sample was a UPX-packed Windows PE file built from Python with **PyInstaller** and shielded by several obfuscation layers, including **Base64**- and **ZLIB**-encoded payloads. Researchers decompiled the embedded Python, recovered a JSON configuration, and identified a sophisticated implant designed for stealthy remote access. The malware can maintain persistence through **PowerShell**, the Windows **Run** registry key, or a **Startup `.lnk`** file, and it supports command execution, file transfer, process migration, and self-removal. Unit 42 found that Seaduke used an **HTTP-based command-and-control** channel with **RC4-encrypted** traffic, deriving session keys from random strings and **SHA1**, while hiding encrypted data in HTTP cookies and HTML-like server responses. The recovered configuration referenced `http://monitor.syn[.]cn/rss.php`, used a **Facebook** referer, and specified a **SiteBar** user agent, underscoring the malware's effort to blend malicious traffic into normal web activity.
Jun 29, 2026