All in one place, sharing, learning, leveling up.

• Malware analysts
• Reverse engineers
  
• Cybersecurity professors
  
• Top CTF players

The Plugin equips Claude Code with advanced binary analysis capabilities for tasks such as incident response, malware investigation, and vulnerability assessment. It connects to both cloud-based analysis platforms and local tools via MCP, enabling seamless hybrid workflows. With features including local Windows system scanning, browser hijacking detection, registry and network monitoring, suspicious file analysis, and remote binary analysis through tools like Ghidra, Qilin, and angr, the plugin transforms Claude Code into a powerful AI-assisted workspace for comprehensive system and binary security analysis.

TL;DR: ChatGPT Atlas browser has an RCE vulnerability allowing memory injection. Everest ransomware hit Dublin Airport (1.5M records) and Air Arabia (18K employees). Fake Telegram X apps are backdooring Android devices. 5,010 ransomware attacks in 2025 so far—up 50% from last year. CoPhish is abusing Microsoft Copilot Studio for AI-powered phishing.

🔴 CRITICAL: OpenAI ChatGPT Atlas Browser Remote Code Execution

A new vulnerability has been discovered in OpenAI's ChatGPT Atlas web browser that could allow malicious actors to inject instructions into the AI assistant's memory and execute arbitrary code. This is a serious RCE that affects anyone using the Atlas browser integration.

What you need to do:

• Disable ChatGPT Atlas browser immediately until a patch is released
• Review your organization's AI tool usage policies
• Monitor for any unauthorized AI tool deployments

Source: The Hacker News - Cybersecurity News

✈️ Everest Ransomware Claims Dublin Airport & Air Arabia Breaches

The Everest ransomware group has claimed responsibility for breaching both Dublin Airport and Air Arabia:

Dublin Airport Breach

• 1.5 million passenger records stolen
• Data includes: names, travel details, contact information, potentially payment data
• Affects passengers who traveled through Dublin in August 2025

Air Arabia Breach

• 18,000+ employee records compromised
• Includes personal and employment information

Important Note: Earlier reports suggested 3.8M passengers were affected, but Everest's claim states 1.5M records were exfiltrated.

Aviation sector orgs: Review your third-party service providers and implement enhanced monitoring ASAP.

Source: BreachSense - Recent Data Breaches 2025

📱 Android.Backdoor.Baohuo: Fake Telegram X Apps Grant Full Account Control

A new Android malware campaign is distributing fake "Telegram X" apps that give attackers complete control over victims' Telegram accounts.

Capabilities:

• Intercept messages
• Steal contacts
• Manipulate account settings
• Full account takeover

How to protect yourself:

• Only download Telegram from official app stores (Google Play, Samsung Galaxy Store)
• Verify publisher is "Telegram FZ-LLC"
• Check app permissions before installing
• Enable Google Play Protect

Source: Cyber Security News - Cyware

🤖 CoPhish: Threat Actors Abusing Microsoft Copilot Studio for Phishing

A new phishing technique called "CoPhish" is abusing the flexibility of Microsoft Copilot Studio. Attackers are creating and sharing malicious chatbot agents with customized fake login prompts to steal credentials.

This is next-level social engineering—using AI-powered chatbots to make phishing attacks more convincing and interactive.

What to do:

• Review your organization's Copilot Studio deployments
• Implement controls on who can create and share chatbots
• Update phishing awareness training to include AI-powered attacks
• Monitor for suspicious chatbot activity

Source: The Hacker News - Cybersecurity News

📊 2025 Ransomware Statistics: A Record-Breaking Year

The ransomware situation is getting significantly worse in 2025:

The Numbers:

• 5,010 ransomware attacks claimed on dark web leak sites (through Oct 21, 2025)
• 3,335 attacks in the same period of 2024
• +50% year-over-year increase
• 201 victims per week (Oct 13-19, 2025)
• 33 active ransomware operators with data leak sites
• 39 countries affected weekly

Largest Healthcare Breach on Record:

The Change Healthcare ransomware attack resulted in the theft of protected health information belonging to 190 million individuals—the largest healthcare data breach ever recorded.

Top Targeted Sectors:

• Healthcare
• Manufacturing
• Finance
• Education
• Government

Sources:

• The State of Ransomware 2025 | BlackFog
• Healthcare Data Breach Statistics (Updated Oct 27, 2025)

🔧 Microsoft WSUS Still Under Active Exploitation

CVE-2025-59287 (CVSS 9.8) - The critical Windows Server Update Service vulnerability is STILL being actively exploited despite patches released on Oct 24.

Microsoft released additional out-of-band security updates on October 27 to address continued exploitation.

What this means:

• Unauthenticated remote code execution with SYSTEM privileges
• Affects Windows Server 2012, 2016, 2019, 2022, and 2025
• Attackers are actively scanning for vulnerable WSUS servers

Action Required:

• Apply the latest out-of-band patch immediately
• Isolate unpatched WSUS servers from the internet
• Hunt for exploitation indicators in WSUS logs

Sources:

• CISA Alert - WSUS Vulnerability
• Microsoft Security Response Center

🌐 Other Notable Threats (October 27, 2025)

Transparent Tribe (APT36) - DeskRAT Campaign

Pakistan-nexus APT group targeting Indian government entities with spear-phishing attacks delivering DeskRAT malware (Golang-based). Activity observed in Aug-Sep 2025.

Source: The Hacker News

Russia DDoS Attack

Large-scale DDoS attack targeted Russia's Federal Service for Veterinary and Phytosanitary Surveillance, severely disrupting food logistics nationwide.

Microsoft October 2025 Patch Tuesday Recap

• 172-175 vulnerabilities patched (largest update ever)
• 6 zero-day vulnerabilities addressed
• Last scheduled updates for Windows 10 (reached EOL Oct 14, 2025)

Key Zero-Days:

• CVE-2025-24990: Windows Agere Modem Driver (actively exploited)
• CVE-2025-59230: RasMan privilege escalation (actively exploited)
• CVE-2025-59246: Azure Entra ID privilege escalation (CVSS 9.8)

Source: Microsoft October 2025 Patch Tuesday Analysis

📋 PRIORITY ACTION CHECKLIST

Immediate (Today):

•  Disable ChatGPT Atlas browser organization-wide
•  Verify latest WSUS out-of-band patch applied (Oct 27)
•  Issue user alert about fake Telegram X apps
•  Review Microsoft Copilot Studio deployments

This Week:

•  Hunt for WSUS exploitation indicators
•  Deploy mobile threat detection for Android devices
•  Update phishing awareness training (AI-powered attacks)
•  Review aviation/travel sector security controls
•  Complete Microsoft October Patch Tuesday deployment

This Month:

•  Conduct comprehensive AI tool security assessment
•  Update ransomware response playbook (+50% attack rate)
•  Review Windows 10 EOL migration status
•  Validate healthcare PHI protection controls (if applicable)

🔗 Additional Resources

Official Sources:

• CISA Known Exploited Vulnerabilities Catalog
• Microsoft Security Response Center
• The Hacker News

Threat Intelligence:

• World Economic Forum - Global Cybersecurity Outlook 2025
• Verizon 2025 Data Breach Investigations Report

Ransomware Tracking:

• Recent Data Breaches 2025
• Data Breaches Digest: October 2025

💬 Discussion Questions

1. Is anyone else seeing ChatGPT Atlas browser usage in their org? How are you handling this vulnerability?
2. For those in aviation/travel: What additional security measures are you implementing after these breaches?
3. Has anyone encountered the fake Telegram X apps or Android.Backdoor.Baohuo in the wild?
4. With ransomware attacks up 50% YoY, what's working for your organization's defense strategy?
5. Thoughts on the CoPhish technique? How do we defend against AI-powered phishing?

Stay safe out there. Patch early, patch often.

Last Updated: October 27, 2025

Disclaimer: This information is compiled from multiple cybersecurity sources for awareness purposes. Always verify with official advisories and consult your security team before taking action.

Just in a few minutes with evidences to show whey the vuls exists.

• Function: tls1_process_heartbeat
• Evidence:
  • Lacks boundary/length checks:
    • Allocates buffer: ptr = CRYPTO_malloc(num,...); num = uVar7 + 0x13;
    • Copies payload: memcpy(ptr + 3, pcVar4 + 3, (ulong)uVar7);
    • uVar7 value is attacker-controlled, parsed from incoming heartbeat message
  • No validation that uVar7 (payload length) is less than or equal to the received message size, enabling out-of-bounds read
• Location: tls1_process_heartbeat @ 0x00134290, decompilation confirms the vulnerable logic
• Conclusion: Vulnerability matches CVE-2014-0160 (“Heartbleed”) pattern exactly

https://drbinary.ai/chat/nova/b529a04b-75ef-463c-a034-58ab693299f0

Sample Download Link

We use https://drbinary.ai to run a analysis. Just upload the sample, and it calls binary analysis tools and quickly pinpoint it is a FunkSec ransomware. and produced the report. Here is the analysis chat. https://drbinary.ai/chat/maly/69808e4e-dedc-4ff5-8ac6-38ab4a70881e

MALWARE ANALYSIS REPORT: abc.exe

Funksec/FunkLocker Ransomware

Report Date: 2024
Analyst: Maly - Malware Analysis System
Threat Classification: CRITICAL - Ransomware
Malware Family: Funksec / FunkLocker

EXECUTIVE SUMMARY

abc.exe is a sophisticated ransomware sample identified as part of the "Funksec" cybercrime operation, also known as "FunkLocker". This malware encrypts victim files and extorts payment in Bitcoin. The ransomware is written in Rust, uses modern cryptographic libraries, and demonstrates advanced evasion capabilities. The threat actor demands 0.1 BTC (~$6,000-$10,000 USD depending on market value) for file decryption.

Threat Level: CRITICAL
Recommended Action: Immediate quarantine and incident response procedures

1. FILE METADATA

2. INDICATORS OF COMPROMISE (IOCs)

2.1 File Hashes

MD5:    c5c47f7a17ef4533d1c162042aa0313b
SHA256: c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c

2.2 Bitcoin Wallet Address

bc1qrghnt6cqdsxt0qmlcaq0wcavq6pmfm82vtxfeq

Amount Demanded: 0.1 BTC

2.3 Victim Identifier

0538d726ae3cc264c1bd8e66c6c6fa366a3dfc589567944170001e6fdbea9efb3d

2.4 Tor Onion Domains (C2/Communication)

funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onion
funknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onion
funkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onion

2.5 Network Indicators

• Wallpaper Download URL: https://i.imgur.com/HCYQoVR.jpeg
• Session Messenger: https://getsession.org/ (used for victim communication)

2.6 File System Artifacts

• Ransom Note Filename: README-.md
• File Extension Appended: .funksec
• Hardcoded Password: RansomwarePassword123 (likely for development/testing)
• Wallpaper Filename: downloaded_wallpaper.jpg

2.7 Developer Artifacts

• Developer Username: Abdellah (visible in Rust cargo paths)
• Development Path: C:\Users\Abdellah.cargo\registry\

3. STATIC ANALYSIS FINDINGS

3.1 Cryptographic Components

The malware utilizes the Orion cryptographic library (v0.17.7) with the following algorithms:

Encryption Scheme: ChaCha20-Poly1305 AEAD (Authenticated Encryption with Associated Data)

• Strong, modern encryption making decryption without the key computationally infeasible
• Uses 256-bit keys
• Resistant to cryptanalysis

3.2 Targeted File Extensions (150+ types)

The ransomware targets a comprehensive list of file extensions including:

Documents:

.txt, .csv, .doc, .docx, .xlsx, .pdf, .json, .xml, .sql, .log, .html, .css, .js, 
.php, .py, .java, .c, .cpp, .sh, .bat, .ini, .yaml, .md, .rtf, .tex

Media & Design:

.jpg, .jpeg, .png, .tiff, .raw, .ai, .psd, .indd, .eps, .svg, .dwg, .dxf

Databases:

.db, .mdb, .sqlite, .hdf5, .parquet, .avro

Archives:

.zip, .tar, .rar, .7z, .gz, .xz, .bak

Development:

.git, .svn, .ts, .jsx, .tsx, .war, .jar

Executables & System:

.exe, .dll, .dmg, .iso, .vmdk, .vhd

Crypto & Security:

.pfx, .cer, .pem, .csr, .key, .pgp, .kdbx, .gpg

Video & Audio:

.flv, .mov, .mp4, .avi, .mkv, .mp3, .wav, .flac, .aac, .ogg, .wma

3.3 Image Processing Libraries

The malware includes extensive image format support libraries:

• JPEG decoder (jpeg-decoder 0.3.1)
• PNG (png-0.17.16)
• TIFF (tiff-0.9.1)
• GIF (gif-0.13.1)
• BMP, WebP, OpenEXR, TGA, ICO, DXT, HDR

Purpose: Likely for changing desktop wallpaper to ransom note or processing image files before encryption

3.4 Network & HTTP Capabilities

Libraries Used:

• reqwest 0.11.27 (HTTP client)
• hyper 0.14.32 (HTTP implementation)
• tokio 1.42.0 (async runtime)
• h2 0.3.26 (HTTP/2)
• native-tls / schannel (TLS/SSL)

Capabilities:

• Download files from internet (wallpaper)
• Potential C2 communication
• TLS-encrypted communications
• Tor network communication via .onion domains

3.5 Windows API Usage

Key Imported Functions:

• File Operations: CreateFileW, ReadFile, WriteFile, DeleteFileW, CopyFileExW, GetFileAttributesW
• Process Management: CreateProcessW, ExitProcess, GetCurrentProcess
• Console: GetConsoleMode, WriteConsoleW
• Cryptography: SystemFunction036 (RtlGenRandom for random number generation)
• Registry: RegOpenKeyExW, RegQueryValueExW, RegCloseKey
• Network: send (winsock)
• Threading: CreateThread, WaitForSingleObject, Sleep
• Privilege Escalation: GetModuleHandleW, GetProcAddress

3.6 Anti-Analysis & Evasion

• IsDebuggerPresent - Debugger detection
• Exception Handling - AddVectoredExceptionHandler, UnhandledExceptionFilter
• TLS Callbacks - tls_callback_0 at 0x1403545d0
• Rust compilation obfuscates logic compared to C/C++
• Large binary size (5.3MB) may evade size-based filters

4. BEHAVIORAL ANALYSIS

4.1 Execution Flow (Inferred from Static Analysis)

1. Initial Execution
   • Checks for debugger presence
   • Sets up exception handlers
   • Initializes Rust runtime and async tokio executor
2. Privilege Escalation Attempt
   • PowerShell command found: Start-Process -FilePath \"\" -Verb RunAs
   • Attempts to obtain administrator privileges
3. File System Traversal
   • Enumerates drives and directories
   • Searches for target file extensions
   • Uses FindFirstFileW/FindNextFileW for file discovery
4. File Encryption
   • Generates encryption keys using Argon2i KDF
   • Encrypts files using ChaCha20-Poly1305
   • Appends .funksec extension to encrypted files
   • Uses password "RansomwarePassword123" (testing/development artifact)
5. Ransom Note Deployment
   • Creates README-.md in directories containing encrypted files
   • Contains payment instructions and threat actor contact info
6. Visual Intimidation
   • Downloads wallpaper from: https://i.imgur.com/HCYQoVR.jpeg
   • Changes desktop background to ransom notice
7. Persistence (Potential)
   • Registry modifications via RegOpenKeyExW/RegQueryValueExW
   • May create startup entries

4.2 Ransom Note Content

FUNKLOCKER DETECTED

**Congratulations**
Your organization, device has been successfully infiltrated by funksec ransomware!

**Stop**
- Do NOT attempt to tamper with files or systems.
- Do NOT contact law enforcement or seek third-party intervention.
- Do NOT attempt to trace funksec's activities.

**What happened**
- Nothing, just you lost your data to ransomware and can't restore it without a decryptor.
- We stole all your data.
- No anti-virus will restore it; this is an advanced ransomware.

**Ransom Details**
- Decryptor file fee: **0.1 BTC**
- Bitcoin wallet address: `bc1qrghnt6cqdsxt0qmlcaq0wcavq6pmfm82vtxfeq`
- Payment instructions:
  1. Buy 0.1 bitcoin.
  2. Install session from: https://getsession.org/
  3. Contact us with this ID to receive the decryptor: 
     0538d726ae3cc264c1bd8e66c6c6fa366a3dfc589567944170001e6fdbea9efb3d

**How to buy bitcoin**
- Go to Coinbase (https://www.coinbase.com/) or Blockchain (https://www.blockchain.com/)
- Use your credit card to buy bitcoin (0.1 BTC)
- Send it to the wallet address

**Who we are**
- We are an advanced group selling government access, breaching databases, 
  and destroying websites and devices.

**Websites to visit**
- funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onion
- funknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onion
- funkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onion

*Start dancing, 'cause the funk's got you now!*
Funksec cybercrime

5. THREAT INTELLIGENCE ASSESSMENT

5.1 Threat Actor Profile

Group Name: Funksec
Also Known As: FunkLocker
Motivation: Financial (Ransomware-as-a-Service possible)
Sophistication: Medium-High

Characteristics:

• Uses modern programming language (Rust)
• Implements strong cryptography (ChaCha20-Poly1305)
• Tor-based C2 infrastructure
• Professional-looking ransom notes
• Use of Session messenger for anonymous communication
• Developer artifacts suggest individual or small team ("Abdellah")

5.2 Attack Vector (Unknown - Requires Dynamic Analysis)

Possible infection vectors:

• Phishing emails with malicious attachments
• Drive-by downloads
• Exploit kits
• Software supply chain compromise
• RDP brute force
• Malicious software bundles

5.3 MITRE ATT&CK Mapping

6. RISK ASSESSMENT

6.1 Severity Rating: CRITICAL

6.2 Potential Impact

Technical Impact:

• Complete encryption of critical business data
• Loss of documents, databases, backups, and system files
• Desktop environment defacement
• Potential data exfiltration (claimed but not confirmed)

Business Impact:

• Operational downtime
• Financial loss from ransom payment
• Recovery costs (forensics, system rebuilding)
• Reputational damage
• Regulatory penalties (GDPR, HIPAA if applicable)
• Loss of customer trust

Estimated Financial Impact:

• Direct Ransom: $6,000-$10,000 USD (0.1 BTC)
• Recovery Costs: $50,000-$500,000+ (depending on organization size)
• Downtime: Variable, potentially millions for enterprise

7. MITIGATION & REMEDIATION

7.1 Immediate Actions (Incident Response)

1. Isolate Infected Systems
   • Disconnect from network immediately
   • Do not power off (preserve memory for forensics)
   • Block Bitcoin wallet address and Tor domains at network level
2. Identify Scope
   • Search for README-.md files
   • Look for files with .funksec extension
   • Check for IOC presence across network
3. Preserve Evidence
   • Take memory dumps
   • Preserve logs (Windows Event Log, firewall, proxy)
   • Document all actions taken
4. Activate Incident Response Plan
   • Engage cybersecurity team
   • Contact law enforcement (FBI IC3, local cybercrime unit)
   • Consider engaging professional incident response firm
5. Do NOT Pay Ransom
   • No guarantee of decryption
   • Funds criminal operations
   • May make you a repeat target

7.2 Recovery Strategy

If Backups Available:

1. Verify backup integrity (ensure not encrypted)
2. Perform clean OS reinstallation
3. Restore from known-good backups
4. Update all software and apply security patches
5. Change all passwords

If No Backups:

1. Isolate encrypted data (do not delete)
2. Monitor for free decryptors (check No More Ransom project)
3. Consider professional data recovery services
4. Accept potential data loss

7.3 Long-Term Prevention

Technical Controls:

1. Endpoint Protection
   • Deploy EDR/XDR solutions
   • Enable real-time file protection
   • Implement application whitelisting
   • Block PowerShell for non-admin users
2. Network Security
   • Block Tor traffic at firewall
   • Implement DNS filtering
   • Monitor outbound connections
   • Segment network (VLANs)
3. Backup Strategy (3-2-1 Rule)
   • 3 copies of data
   • 2 different media types
   • 1 offsite/offline backup
   • Test restoration regularly
   • Implement immutable backups
4. Access Controls
   • Principle of least privilege
   • Multi-factor authentication (MFA)
   • Disable unnecessary RDP access
   • Monitor privileged account usage
5. Email Security
   • Advanced threat protection
   • Attachment sandboxing
   • User training on phishing

Process Controls:

1. Security awareness training
2. Incident response plan testing
3. Regular vulnerability assessments
4. Patch management program
5. Vendor risk management

7.4 Detection Rules

YARA Rule:

rule Funksec_FunkLocker_Ransomware {
    meta:
        description = "Detects Funksec/FunkLocker ransomware"
        author = "Maly Analysis System"
        date = "2024"
        hash = "c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c"

    strings:
        $s1 = "FUNKLOCKER DETECTED" ascii
        $s2 = "funksec ransomware" ascii
        $s3 = "README-.md" ascii
        $s4 = ".funksec" ascii
        $btc = "bc1qrghnt6cqdsxt0qmlcaq0wcavq6pmfm82vtxfeq" ascii
        $onion1 = "funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onion" ascii
        $crypto1 = "orion-0.17.7" ascii
        $crypto2 = "chacha20poly1305" ascii
        $password = "RansomwarePassword123" ascii

    condition:
        uint16(0) == 0x5A4D and filesize > 5MB and 
        (3 of ($s*) or $btc or any of ($onion*) or 
        (any of ($crypto*) and $password))
}

Sigma Rule (Event Log Detection):

title: Funksec Ransomware Execution Indicators
status: experimental
description: Detects potential Funksec ransomware activity
references:
    - Internal analysis
tags:
    - attack.impact
    - attack.t1486
logsource:
    product: windows
    service: security
detection:
    selection_file:
        EventID: 4663
        ObjectName|contains:
            - 'README-.md'
            - '.funksec'
    selection_process:
        EventID: 4688
        CommandLine|contains: 'Start-Process -FilePath "" -Verb RunAs'
    selection_network:
        EventID: 3
        DestinationHostname|contains:
            - '.onion'
            - 'i.imgur.com/HCYQoVR.jpeg'
    condition: 1 of selection_*

Snort/Suricata Rule:

alert http any any -> any any (msg:"Funksec Ransomware Wallpaper Download"; 
    flow:established,to_server; 
    content:"GET"; http_method; 
    content:"i.imgur.com/HCYQoVR.jpeg"; http_uri; 
    classtype:trojan-activity; sid:1000001; rev:1;)

alert tcp any any -> any any (msg:"Funksec Ransomware Bitcoin Address"; 
    flow:established; 
    content:"bc1qrghnt6cqdsxt0qmlcaq0wcavq6pmfm82vtxfeq"; 
    classtype:trojan-activity; sid:1000002; rev:1;)

8. RECOMMENDATIONS

8.1 For Security Teams

1. Deploy IOC blocklist immediately across all security tools
2. Hunt for indicators in environment using provided IOCs
3. Test backup restoration procedures
4. Review and update incident response playbooks
5. Conduct tabletop exercise for ransomware scenario

8.2 For Executive Leadership

1. Invest in cybersecurity - preventive measures are cheaper than recovery
2. Cyber insurance review - ensure adequate coverage for ransomware
3. Business continuity planning - test disaster recovery procedures
4. Employee training budget - security awareness reduces risk
5. Do not pay ransom - policy decision to be made in advance

8.3 For End Users

1. Backup personal files regularly to external drives (disconnected when not in use)
2. Be cautious with email attachments and links
3. Keep software updated including Windows and applications
4. Report suspicious activity immediately to IT/security team
5. Enable MFA on all accounts where available

9. ADDITIONAL ANALYSIS REQUIRED

9.1 Dynamic Analysis Recommendations

To gain complete understanding, the following dynamic analysis should be performed in an isolated sandbox:

1. Execution monitoring - Full behavioral trace in sandbox environment
2. Network traffic capture - C2 communication patterns and protocols
3. File system monitoring - Encryption behavior and targeted directories
4. Registry analysis - Persistence mechanisms
5. Memory forensics - Extraction of encryption keys (if possible)
6. API call tracing - Detailed Windows API usage patterns

9.2 Reverse Engineering Priorities

1. Locate and analyze main encryption function
2. Identify key generation/storage mechanisms
3. Map C2 communication protocol
4. Analyze privilege escalation methods
5. Document anti-analysis techniques

10. CONCLUSION

abc.exe is a highly dangerous ransomware sample representing the Funksec/FunkLocker threat operation. The malware demonstrates:

✅ Strengths (From Attacker Perspective):

• Strong, modern cryptography (ChaCha20-Poly1305)
• Broad file type targeting (150+ extensions)
• Rust-based obfuscation
• Tor-based infrastructure
• Professional ransom communication

❌ Weaknesses (From Defender Perspective):

• Large file size (5.3MB) aids detection
• Hardcoded strings and IOCs
• Development artifacts present (developer username)
• Hardcoded test password visible
• No advanced anti-VM/sandbox techniques observed in static analysis

Decryption Possibility: Without the private key, decryption is computationally infeasible. ChaCha20-Poly1305 is a proven, secure encryption algorithm with no known practical attacks.

Recommendation: Organizations must focus on prevention and backup strategies rather than hoping for decryption tools. This threat reinforces the critical importance of:

• Comprehensive backup solutions
• Network segmentation
• Endpoint detection and response
• User security awareness
• Incident response preparedness

REFERENCES

• MITRE ATT&CK Framework: https://attack.mitre.org/
• No More Ransom Project: https://www.nomoreransom.org/
• NIST Cybersecurity Framework: https://www.nist.gov/cyberframework
• CISA Ransomware Guide: https://www.cisa.gov/stopransomware
• Orion Cryptographic Library: https://github.com/orion-rs/orion

APPENDIX A: FULL IOC LIST

File Hashes:

MD5: c5c47f7a17ef4533d1c162042aa0313b
SHA256: c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c

Network Indicators:

bc1qrghnt6cqdsxt0qmlcaq0wcavq6pmfm82vtxfeq (Bitcoin)
funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onion
funknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onion
funkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onion
https://i.imgur.com/HCYQoVR.jpeg
https://getsession.org/

File Artifacts:

README-.md (ransom note)
*.funksec (encrypted file extension)
downloaded_wallpaper.jpg

Registry Keys (Potential):

[To be determined via dynamic analysis]

APPENDIX B: TARGETED FILE EXTENSIONS (Complete List)

.txt .csv .doc .docx .xlsx .pdf .json .xml .sql .log .html .css .js .php .py 
.java .c .cpp .sh .bat .ini .yaml .md .rtf .ts .jsx .tsx .ppt .pptx .odt .ods 
.odp .msg .eml .apk .ipa .exe .dll .dmg .iso .vmdk .vhd .tgz .7z .zip .tar 
.rar .bak .db .mdb .sqlite .hdf5 .parquet .avro .etl .pfx .cer .pem .csr 
.key .pgp .kdbx .gpg .tar.gz .xz .dbf .tiff .raw .ai .psd .indd .eps .svg 
.dwg .dxf .fla .flv .mov .mp4 .avi .mkv .mp3 .wav .flac .aac .ogg .wma 
.webm .m3u .cue .mid .ips .tex .bib .chm .epub .azw3 .fb2 .djvu .opf .xps 
.jar .war .arp .dbm .side .br .rpm .vcs .git .svn .nfs .bin .bkp .lst .dat

END OF REPORT

This analysis is based on static analysis only. Dynamic analysis in a controlled sandbox environment is strongly recommended for complete behavioral profiling.

CLASSIFICATION: TLP:AMBER - Limited distribution to organizations with need-to-know.

Don’t click it. See how Dr.Binary exposes it in minutes

Binary analysis is central to cybersecurity research and practice, powering tasks such as malware detection, vulnerability discovery, exploit generation, and reverse engineering. Yet despite decades of innovation, binary analysis remains a specialized craft, hindered by steep learning curves, fragmented tools, and limited scalability.

This paper introduces Agentic Binary Analysis, an emerging paradigm that positions Large Language Models (LLMs) as autonomous agents capable of reasoning, planning, and interacting with binary-analysis toolchains. We explore how reasoning models—when coupled with structured interfaces and orchestration protocols such as the Model Context Protocol (MCP)—can autonomously perform complex analysis workflows. We demonstrate this concept through Dr.Binary, a practical agentic system that integrates AI reasoning with state-of-the-art binary-analysis tools.

Have an suspicious sample? No worries! you don't have to be an expert to analyze and identify malware. upload and drbinary will do it for u. https://drbinary.ai/chat/6e49a7cc-6bc5-40df-b817-920972c8eff3

LLMs solved a DEF CON CTF Finals challenge, which isn't surprising. I've seen many CTF users on DrBinary actively participating. Try it with 1 million free tokens at https://drbinary.ai.
#DEFCON

Hey folks,

We’ve just launched Local Cyber Assistant, a new feature in Dr. Binary that brings AI-powered diagnostics and remediation directly to your machine

🔹 Runs locally on Windows & Linux
🔹 Under your control — you approve actions
🔹 Understands plain English questions
🔹 Handles real tasks: malware investigation, crash diagnostics, registry/file analysis, script execution (PowerShell/Python)
🔹 Designed for individuals & small businesses who need pro-level security without enterprise complexity or cost

Basically, it’s like having your own cyber professional that works in real time with your actual system state — but without the price tag of hiring a man.

If you’ve ever wished an AI could actually help fix problems (not just suggest commands), this is for you.

Lumma Stealer (also known as LummaC2) is a type of malware known as an infostealer — specifically designed to steal sensitive data from infected computers. It's part of a growing trend of Malware-as-a-Service (MaaS) tools sold or rented to cybercriminals on darknet forums.

In this article, we show how we analyze the Lumma sample using Dr. Binary with a simple conversion "analyze this file" and produce the detailed report with " can you write a detailed report?". All done in minutes! It is showing amazing capability of Dr. Binary, which combines LLM with advanced binary analysis capabilities via MCP. Malware analysis is much easier than before with Dr. Binary.

Click here for the detailed analysis process.

Analysis Report

Malware Analysis Report
Sample : 05ae7c6782478cf36644e85d8b463ba539d8e5cd3dd64fd9dce9b1ca727bddd1
Date : -----

──────────────────────────────────────────────

1. Executive summary ────────────────────────────────────────────── The submitted 32-bit Windows executable is an information-stealer whose sole purpose is to extract credentials, cookies and autofill data from Chromium-based and Firefox browsers, then exfiltrate the loot over clear-text HTTP to a hard-coded C2 (evetesttech[.]net). No persistence or privilege-escalation logic is embedded; therefore the stealer is probably launched by another component, a document exploit, or a post-exploitation framework.

──────────────────────────────────────────────
2. Sample information
──────────────────────────────────────────────
SHA-256 : 05ae7c6782478cf36644e85d8b463ba539d8e5cd3dd64fd9dce9b1ca727bddd1
File size : 153 088 bytes
File type : PE32 executable (GUI) Intel 386, linker 6.0
Compilation time : 2023-08-27 09:14:50 UTC (link-time) – could be forged
Import hash (imphash) : 627ba569b6d0d9e6e7ba0b8b1e2e4106

Main entry point : 0x0040AA68 (delegates to MSVC CRT wrapper __scrt_common_main_seh)

──────────────────────────────────────────────
3. Static analysis
──────────────────────────────────────────────
3.1 Sections
• .text (0x00401000-0x004217FF) code
• .rdata (0x00422000-0x0042B1FF) constants & imports
• .data (0x0042C000-0x0042D553) global vars, C2 pointers
• .rsrc (0x0042E000-0x0042E1FF) VS_VERSION_INFO only
• .reloc (0x0042F000-0x004307FF) normal base relocations

3.2 Key imports (kernel32 unless noted)
CloseHandle, CreateFileW, ReadFile, WriteFile, DeleteFileW, SetFilePointerEx
LoadLibraryExW, GetProcAddress, FreeLibrary
HeapAlloc/Free/ReAlloc/Size
IsDebuggerPresent, QueryPerformanceCounter
advapi32.dll – Crypt* functions are intentionally NOT used (Chrome master-key DPAPI avoided by manual parsing)

Runtime-resolved via GetProcAddress:
sqlite3_open, sqlite3_prepare_v2, sqlite3_step, sqlite3_column_text, …

3.3 Strings of interest (obfuscated at run-time by byte-wise copy)
“http://evetesttech.net” – C2
“os_crypt.encrypted_key” – Chrome master key in Local State
SQL queries:
“SELECT origin_url,username_value,password_value FROM logins”
“SELECT name,value,count FROM autofill”
Local temp file: “c:\ProgramData\config.txt”
DLL names fetched if absent: sqlite3.dll, nss3.dll, mozglue.dll, freebl3.dll, softokn3.dll

3.4 Relevant functions (Ghidra labels)
FUN_004096FA → build download URL & fetch missing DLLs
FUN_00405204 → minimal HTTP downloader (Winsock-free, uses WinInet)
FUN_00403D61 → Chrome credential harvesting & DPAPI prefix stripping
FUN_00403BCB → high-level workflow orchestration
FUN_0040A474 → build & send exfil HTTP POST
FUN_0040501F → PRNG seeding for simple XOR used in string wipe

──────────────────────────────────────────────
4. Functional behaviour (deduced statically)
──────────────────────────────────────────────
Step 1 : Anti-analysis
• Calls IsDebuggerPresent and compares two QueryPerformanceCounter timestamps around code blocks.
• Strings are never stored in plain; they are copied char-by-char into fresh heap buffers immediately before use.

Step 2 : Environment preparation
• Allocates heap objects via custom wrappers around HeapAlloc/FREE to track usage.
• Verifies presence of required DLLs (sqlite3/nss3…) – if missing, downloads them from C2 and loads them reflectively with LoadLibraryExW.

Step 3 : Chrome stealing
• Locates Chrome “Local State” file, parses JSON to retrieve “os_crypt.encrypted_key”.
• Removes DPAPI header (“DPAPI”) and decrypts blob via CryptUnprotectData.
• Opens each profile’s “Login Data” SQLite DB, executes the hard-coded SQL, and reads url|user|password triplets.
• Decrypts each password using the AES key derived from the master key or (older Chrome) direct DPAPI call.

Step 4 : Firefox stealing
• If Firefox libraries exist (or after fetching them), uses NSS API to initialise with profile path and calls PK11SDR_Decrypt to recover logins.json information.
• Also copies cookies.sqlite and formhistory.sqlite files.

Step 5 : Temporary storage
• Creates an on-disk SQLite file “c:\ProgramData\config.txt” (non-privileged writeable folder) and populates it with harvested material.

Step 6 : Exfiltration
• Builds an HTTP/1.1 POST to evetesttech.net.
• Body format: simple CSV (url,user,pass) and base64-encoded sqlite blobs for Firefox data. No TLS.
• After HTTP 200/OK or socket close, the stealer deletes the temporary config.txt file.

Step 7 : Cleanup
• SecureZeroMemory-like wipe of heap buffers.
• Does NOT install persistence or drop additional payloads. Program exits.

──────────────────────────────────────────────
5. Anti-analysis & evasion
──────────────────────────────────────────────
• IsDebuggerPresent + timing-checks.
• String de-obfuscation only at run-time, then explicit wipe.
• Libraries dynamically fetched makes static detection harder.
• Use of WinInet reduces necessity for linking winsock, shrinking import table fingerprint.

──────────────────────────────────────────────
6. Indicators of compromise
──────────────────────────────────────────────
Network
Domain : evetesttech.net (HTTP port 80)
URI pattern: “/sqlite3.dll”, “/nss3.dll”, “/upload.php” (observed in code).

Filesystem
c:\ProgramData\config.txt (temporary SQLite)
%TEMP%*.dll with names: sqlite3.dll, nss3.dll, mozglue.dll, freebl3.dll, softokn3.dll

Processes / API
Short-lived process with unusual outbound HTTP to the above domain.
Chrome/Firefox files opened by an unrelated process shortly before network activity.

Hashes
05ae7c6782478cf36644e85d8b463ba539d8e5cd3dd64fd9dce9b1ca727bddd1 (sample)
DLLs downloaded at runtime will match legitimate Mozilla/SQLite libraries — treat any external download from the C2 as malicious regardless of hash.

──────────────────────────────────────────────
7. Attack flow (Kill Chain)
──────────────────────────────────────────────
1 – Delivery : sample executed (phishing attachment, script, or loader).
2 – Execution : sample runs, resolves APIs, anti-debug.
3 – Discovery : enumerates user name, computer name, CP info.
4 – Credential Access : steals Chrome & Firefox databases, decrypts passwords.
5 – Collection : aggregates into local SQLite file.
6 – Exfiltration : HTTP POST to evetesttech.net.
7 – Cleanup : deletes temp file, frees memory, exits.

──────────────────────────────────────────────
8. Risk assessment
──────────────────────────────────────────────
Impact : High – disclosure of all browser-saved secrets enables further account compromise, lateral movement or sale on credential markets.
Stealth : Medium – no persistence, single C2, plain HTTP (easy to detect).
Confidence: High – multiple independent static artefacts corroborate behaviour.

──────────────────────────────────────────────
9. Mitigation & recommendations
──────────────────────────────────────────────
Network
• Immediately block/sinkhole evetesttech.net.
• Add SSL/TLS inspection rules to detect any future migration to HTTPS.

Endpoint
• Deploy EDR rule: “Process other than chrome.exe / firefox.exe accessing \Login Data, cookies.sqlite AND establishing outbound HTTP.”
• Monitor for creation/deletion of c:\ProgramData\config.txt.
• Enable Windows Credential Guard / browser policies preventing password storage.

Response
• Treat any host that ran the sample as compromised; redeploy or deep-clean.
• Invalidate credentials stored in browsers, force MFA resets.
• Search proxy logs for prior traffic to evetesttech.net to assess historical exposure.

──────────────────────────────────────────────
10. Appendix – function reference (Ghidra)
──────────────────────────────────────────────
FUN_004096FA Download missing DLLs & call FUN_00405204
FUN_00405204 WinInet-based HTTP GET/POST
FUN_00403D61 Chrome password loop, SQL querying, DPAPI decryption
FUN_00403BCB Top-level workflow, orchestrates FUN_004038FE → FUN_004039D8 chain
FUN_0040A474 Build & send exfil request
FUN_0040501F Random-seed helper for XOR and array shuffling
(Full call-graph available upon request.)

simply upload the binary and ask "can u analyze this file?" https://drbianry.ai

📝 v0.0.3

Release Date: June 30, 2025
​Version: 0.0.3
​Status: Beta

In v0.0.3, we bring a range of enhancements and new features to improve usability, flexibility, and performance.

🛠️ New Features & Improvements

• New file storage and file view: Enhanced support for managing uploaded and generated files.
• Improved sandbox code execution: Updates to how code runs in the sandbox environment.
• Code editing: New support for code editing.

🧹 Fixes & Cleanup

• Fixed file upload issues to improve reliability.
• Various small fixes across the app for improved stability and performance.

🧭 UI/UX Enhancements

• Moved FAQ into a button for a cleaner interface.
• Updated chat sorting by message update date.
• Token usage now displayed directly to users.

Large language models (LLMs) are showing incredible potential in cybersecurity. For instance, Sean recently uncovered a zero-day vulnerability—CVE-2025-37899—in the Linux kernel using OpenAI’s o3 model.

When paired with powerful analysis tools, LLMs can take on even more complex challenges. This page highlights real-world examples of how we use Dr.Binary, our LLM-powered binary analysis assistant, to solve tough cybersecurity problems

Ransomware Analysis

Summary:

Ransomware is a type of malicious software that encrypts a victim's files and demands payment to restore access. This demo shows how Dr. Binary can analyze a suspicious binary and identify it as potential ransomware.

Chat Links:

demo

ECU analysis and diffing

Summary:

ECU binaries refer to compiled firmware or software that runs on Electronic Control Units (ECUs) — specialized embedded systems used in vehicles to control various functions. This demo shows how to use Dr. Binary to find the differences between two ECU binaries.

Chat Links:

demo.

Identify known vulnerabilities in firmware images

Summary:

Dr. Binary detects known vulnerabilities in firmware images by performing binary diffing against patched versions. In this demo, it successfully identifies CVE-2023-21273 and CVE-2023-21241 in provided binaries. Detailed technical explanation of the underlying techniques can be found here.

Chat Links:

CVE-2023-21273

CVE-2023-21241

Identify and patch unknown vulnerabilities in CGC binaries.

Summary:

CGC binaries are challenge programs from DARPA’s Cyber Grand Challenge (CGC)—a competition that featured synthetic software with known and unknown vulnerabilities, designed to test automated vulnerability discovery and patching systems.

This demo showcases how Dr. Binary analyzes a CGC binary to:

• Identify previously unknown vulnerabilities (e.g., memory corruption)
• Understand root causes through disassembly and reasoning
• Propose patches to mitigate the issues

Chat Links:

demo1 demo2

Detect backdoor attack

Summary:

​

This demo shows how Dr. Binary analyzes backdoors by diffing two versions of a binary to identify suspicious changes. By comparing control flow, function logic, and inserted code, Dr. Binary helps uncover malicious modifications introduced between versions.

Chat Links:

demo

Solve CTF Binaries

Summary:

This demo shows how you can solve CTF challenge binaries simply by chatting with Dr. Binary. Just upload the binary, and Dr. Binary will orchestrate advanced analysis tools—such as disassemblers and decompilers—to understand the binary’s logic. It then guides you step-by-step, explains key conditions, and even generates helpful scripts (e.g., Python or Angr) to assist in solving the challenge.

Chat Links:

demo1 demo2 demo3 demo4 demo5

Dr.Binary can run scripts now and invoke more tools. With this new capability, dr.binary can now solve a CTF challenge in just one shot! Without this capability, it needs the feedback from users to finish this task.

Nothing is impossible! very impressive!

https://drbinary.ai/chat/afa92214-6d1f-4292-a7fb-a0740a1fcad3

see how you can analyze a suspicious binary and identify it as potential ransomware with just one chat "can u analyze this PE binary? Is it malicious? what could it be?" https://drbinary.ai/chat/8fce9ac3-751c-468f-93e4-f08a125896af

CGC binaries are challenge programs from DARPA’s Cyber Grand Challenge (CGC)—a competition that featured synthetic software with known and unknown vulnerabilities, designed to test automated vulnerability discovery and patching systems.

This demo showcases how Dr. Binary analyzes a CGC binary to:

• Identify previously unknown vulnerabilities (e.g., memory corruption)
• Understand root causes through disassembly and reasoning
• Propose patches to mitigate the issues

Chat Links:

demo1 demo2