Ransomware used to target Microsoft Exchange Servers.

Recently attackers of APT groups started-off targeting Microsoft Exchange Servers after the flaw( 0day ) in the Microsoft exchange servers was published on github. As the 0day exploit is being published on github attackers of APT groups started hacking on MS-Exchange servers by scanning the servers for the 0day vulnerability and ransom’ing servers with the DearCry ransomware. In this blog i will be walking you through the reverse engineering of DearCry ransom where you will be seeing me reversing DearCry ransom for Static and Dynamic Analysis.

Static Analysis (Basic)

Analysis of .Net Ransomware of “Ryzerlo” Malware Family.

Intezer Report: https://analyze.intezer.com/analyses/0762ca51-f301-4dc2-9f3c-786cffd0437a#ttp-section .

This blog is about analysis of Trojan packed in APT29 PolyGlot Duke.

It’s the follow-up blog on my previous blog on PolyGlot Duke in which i had unpacked the packed PolyGlot Duke. Here is the link to that blog.

Static and Dynamic Analysis

File Information

Unpacking, Static and Dynamic Analysis of PolyGlot Duke.

In this blog, i will be unpacking , static and dynamic analysis of trojan “PolyGlot Duke” from APT29. For this blog we only focus on Unpacking.


File Information

It’s a 64-bit malware. Which is basically a packed.

Advance Persistence Threats recent targeted espionage and collaboration.

In this particular we will see the matching patterns in malware targeted codes by APTs recently being observed in organised cyber crime activities.

APT-C-41, APT40, APT28, APT39, APT29,UNC2452, UNC2546, APT37 and APT38.

Starting off from StrongPity and Chinese APT tool SManager.

Entry function of both the malware from APT-C-41 and APT40 are quiet similar. Where StrongPity uses executable as backdoor on the other hand APT40 uses .dll for its cyber espionage tool for its targets.

Quick and Dirty way to unpacking SManager Chinese APT tool.

This blog is my last blog in series of Analysis of SManager. I had planned to write more blogs on unpacking for our infosec. community. Hope you like this one.

If you haven’t read my previous blogs on SManager Chinese APT Tool then go head and read them. I’m mentioning them in here.

It’s SManager Loader analysis:

It’s SManager analysis:

File Information:

Here look carefully, Entropy is high around 6.727. Its the 32bit malware loader which we have to hammer down to SManager executable.

Spyware targeting India & Pakistan with India-Pakistan Conflict Propaganda.

Recently research from the Lookout is being shown targeting of Indians and Pakistanis is been being done Pro-India APT group known as “Confucius”. More of the propaganda is being spread against Muslims by these APT group and targeting is also being to Muslims as ZDNET and Lookout Research. It’s a stealthy stealing malware moreover as like a spyware.

Static and Dynamic Analysis

File Information

Another Sophisticated .Net Malware from SolarWinds Hacks Internals

In this blog, is pretty much similar to the malware which i had reversed few days back is of the same trojanized bread of logic bomb planted on SolarWind Orion Software which acted as the backdooring the network traffic to the Russian Intelligence Agency APT29 command and control Servers. It’s here
the possibility that more APTs like Lazarus, StrongPity and APT40 is involved in this shady espionage operations. As we have been seeing now frequently the signs of involvement of collaboration of these groups in targeting U.S. and it’s allies.


It’s a…

Reversing Engineering Amadey Malware.


This particular blog is about the reversing “Amadey” stealthy information stealing malware of DPRK linked Thallium APT Group. This group is being seen collaborating with the other “cyber espionage” APT groups like APT-C-41 , APT41, APT28 , APT19 , APT-C-00 for targeting the Researchers performing research for nCoV-19 vaccine for stealing the research data of nCoV-19 from European countries, American countries and Asia’s countries.

Static and Dynamic Analysis

File Information

Tool of Turkish Espionage and Cyber Crime Group.

In this blog, i will be uncovering backdoor deployed by Turkish APT group APT-C-41(aka StrongPity) backdoor recently targeting Europe countries. APT-C-41 is known for conducting cyber crime and espionage operations against financial, industrial and educational sectors. Recent activities of APT-C-41 are caught since Nov of last year.

Static and Dynamic Analysis

File Information

Its 32bit malware.


aka Nikhil Rathor | Honey. Malware Analyst. I write blogs related to threat intelligence , malware analysis, APTs , network intrusions and incident responding.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store