Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Unboxing the Threat: How Malicious Python Scripts Use the BoxedApp SDK to Evade Detection

hunt.io | blog | #malware-analysis | #rat | #evasion | #boxedapp | #python-malware | #silverfox

Summary

Hunt.io dissects a sample set abusing the BoxedApp SDK: byte-compiled Python scripts and executables that run from virtualized memory to hide follow-on malware delivery, possibly tied to SilverFox.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Malicious VSCode Extension Launches Multi-Stage Attack Chain with Anivia Loader and OctoRAT
A fake 'prettier-vscode-plus' extension on the official VSCode Marketplace delivered the Anivia loader and OctoRAT—a RAT with 70+ commands—in a supply-chain attack that rotated payloads.
blog · hunt.io
Interview with Daniel Plohmann: Malpedia, Malware Analysis, and Research Insights
An interview with Daniel Plohmann: building Malpedia and MCRIT, his path from network simulation to malware research, collaboration in the field, and music as an outlet away from security.
blog · hunt.io
Server-Side Phishing: How Credential Theft Campaigns Are Hiding in Plain Sight
A phishing campaign targeting employee and member portals now validates stolen credentials server-side to hinder analysis; found via HuntSQL crawler data, plus a healthcare-themed page.
blog · hunt.io
Unmasking SparkRAT: Detection & macOS Campaign Insights
Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.
blog · hunt.io
Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies
Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.
blog · hunt.io
XenoRAT Adopts Excel XLL Files and ConfuserEx as Access Method
Hunt.io analyzes a XenoRAT sample delivered as a ConfuserEx-protected Excel XLL titled 'Payment Details'—a shift from the RAT's gaming fare toward enterprise targets and financial lures.
back