The "SLOTAGENT" malware creates an analytical headache.

A new monitoring turbulence technique of "SLOTAGENT" malware has been detected, creating more analytical headaches than before.

The technique of deception, detection system, or Obfuscation, is usually a technique used by malware to survive the victim's system. This technique has a variety of techniques, and this time it will be a new technique that experts say is more insidious.

According to a report by the website, Cyber Press mentioned the results of a new remote access trojan malware analysis called SLOTAGENT. The malware came from the fact that the research team detected the font string value and the location of the file within the malware of the same name. This malware featured a feature to run malware files in Beacon Object Files. This technique is the same technique used by Cobalt Strike, resulting in malware that can spread into the network. This is because it is not necessary to create an Executable file on disk. In addition, the malware has the ability to evade being monitored with the Timestomping feature, which is a feature to change the timestamp, or Timestamp dynamically, which defuses the trail of malware on the system very well.

On the login side of the malware, hackers will trick the victim into downloading a zip compressed file. The internal file contains the WindowsOobeAppHost.AOT.exe file, which is a loader malware file used to download the real malware. By running the file, it will lead to an Export function called _ _ managed _ _ Main inside the WindowsOobeAppHost.AOT.dll file. Activating this function will lead to the search of the memory of the necessary Windows API functions, such as NtCreateFile. All this will lead to the loading and embedding of the SLOTAGENT malware while evading detection by static analytics. At the same time,

After the malware has embedded itself into the machine, the malware will immediately make contact with a control server (C2 or Command and Control) located on the IP number 43.156.59.110 via TCP port 699. This communication can be called complex. The malware has a custom protocol. The communication will start by sending a four-byte indicator (Byte), followed by a fake HTTP Path String (Pseudo-HTTP), such as as as / api / v1 / stream / data followed by a dash letter or Pipe Character. For core operations data, it is sent in Plain Text as a JSON file.

At this stage when the malware checks in with the C2 server, the malware sends a JSON file that indicates the details of the victim's machine, such as the unique Host Identifier, the computer name, the active Username, the local IP Address, the MAC Address number of the hardware on the machine, the version of the operating system on which the device is located, the Process Identification, and the Privilege level on which the malware is running, which after sending the data and checking in is done. Malware is waiting to receive orders on the uniform.

One of the hallmarks of this malware is Obfuscation to deceive the detection system to protect the operation of the sect iij internal mechanism by using the DJB2 Hashing Algorithm algorithm during Windows API Call. The internal Text String code is fully encrypted and can only be decrypted by a decoding tool running on memory during malware execution. This makes it difficult for Reverse Engineering to decode this set of code, making the analysis of malware analysts even more difficult.

# Trending # Lemon 8 Howtoo # lemon 8 diary # slotagent # freedomhack