A new technique of malware on GitHub uses Payload slicing.

A new technique of malware was found on GitHub, using slicing Payload into multiple parts to bypass being detected.

Releasing malware or payload files to the victim's machine can be called a variety of ways, from downloading them straight down, hiding code in pictures, and this time another interesting technique.

According to a report by the Help Net Security website, Github's famous campaign to spread malware by impersonating a tool to focus attacks on developers, gamers, as well as a common group of people who find software to use it will release the image (Image) of the Docker software as part of the OpenClaw Assistant system. The composition of the Repo page of the fake software that the hackers behind it create is known to be created realistically, such as the README manual. Elaborately, more than 500 Contributor names have been packaged. There are more than 568 star-rated regular developers on GitHub. In addition, the Repo page itself has received a lot of stars.

When the research team looked deeper, it was discovered that many of the accounts that came to the star were created for this purpose, commonly known as Achole. These accounts, when they looked into it, found that apart from the stars, there was no activity on GitHub. And when they checked into the files for software installation, they found that there was a Trojan malware insert for data theft, or an Infostealer created on the basis of the LuaJIT language with a high ability to evade detection. The evasion strategy is also used by splitting Payload parts into 2 parts in a Component model consisting of

A file for running 1unc.exe that contains malware scripts in Lua.

The file for the Obfuscation detection system is named license.txt.

The research team revealed that when they analyzed two separate files, they would not find anything unusual. The two files would have to work together to make up a complete malware payload. After getting the complete malware, the malware would detect up to five different malware analytics as part of the Anti-Analysis system and use the Delayed Execution technique to evade confinement in the simulated environment (Sandbox). After that, the malware would start monitoring the area where the machine is located (Geolocation), saving the screen image on the machine. Screenshot, then send the data back to the control server (C2 or Command and Control) to wait for the next command.

In addition to the above capabilities, the research team also found that many of the same file formats appeared on other Repo, impersonating tools for developers of artificial intelligence tools, game cheating tools, bots for trading Kerrency scriptograms, etc. When examining many elements, the research team assumed that AI tools could be used to create or name fake files and create content on many of these Repo pages.

# Trending # Lemon 8 Howtoo # lemon 8 diary # github # freedomhack