Malware Utkonos

Friday I am giving a talk @BalCC0n on using an LLM to rewrite software from an older implementation to a modern language in a new implementation. The tail end of the talk is about various graphing algorithms that you can use to cluster malware samples. Talk will be recorded.

This is a wild clickfix-like phishing kit. The email lure is an email about a compensation update that requires your approval. The rendering looks strange here because this is a quarantine email reader. The lure wants you to click "Review and Approve".

🧵 on phishing kit 1/n

Phishing Email

Subject: RE: Q084 - May Supplier Waivers

Here is the lure body asking to download an attachment.

🧵1/n

uMsg, the input parameter variable is reused over in this other section of the function. What to do?

Phishing page

hxxps[://]rossieleictrics[.]us/web/