DoNex Ransomware Analysis
Malware Analysis with Malcore using DoNex ransomware as a sample. Using the malcore.io malware sandbox, I'll demonstrate how to efficiently perform malware analysis by leveraging both static and dynamic analysis features of Malcore.
❤️ Try Malcore For FREE : https://link.malcore.io/redirect/guidedhacking
👨💻 Buy Our Courses: https://guidedhacking.com/register/
❤️ Follow us on Social Media: https://linktr.ee/guidedhacking
I examine the malware's static properties with Malcore, analyzing file entropy imports & suspicious assembly code. The analysis reveals antidebugging imports & dynamic imports loaded at runtime, which are common techniques used by malware to evade static analysis. The string summary hints at the use of RSA encryption & typical ransomware behaviors such as deleting batch files to remove traces.
🐍 DoNex Ransomware Claims Lockbit 3.0
🧩 Malcore Detects Anti-Debug Techniques
🔑 Utilizes RSA And ChaCha20 Encryption
📨 Spreads Through Phishing And Bad Links
🔄 Employs Process Hollowing To Evade
🛡 Generates YARA Rules For Detection
🕸 Dynamic Imports Obfuscate Analysis
🌐 Extracts Ransom Note Via Tor Network
You can view the Malcore report here.
We analyze the process hollowing techniques employed by DoNex ransomware, by utilizing functions like "unmap view of file" & "create file mapping," the ransomware injects malicious code into legitimate Windows processes.Malcore's dynamic output feature logs the arguments of each function call, allowing for detailed observation of these suspicious activities. I also cover how the ransomware terminates security related processes, deletes shadow copies, & clears event logs to hinder recovery efforts.
Finally, I showcase how malcore.io's features can be used to understand & analyze malware like DoNex effectively. Whether you're using the free tier or a paid subscription, Malcore provides comprehensive tools for dynamic analysis. I encourage you to try out malcore for your own malware analysis needs.