Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Echoes of Stargazer Goblin: Analyzing Shared TTPs from an Open Directory

hunt.io | blog | #malware-analysis | #shellcode | #ttps | #open-directories | #stargazer-goblin | #hta

Summary

Files in an open directory—camouflaged as a graphic-design book and full of obfuscated VBScript—echo the .hta/.bin and shellcode-injection TTPs of Stargazer Goblin, though attribution is unproven.
Published
Collected

original ↗

Related coverage

blog · blog.viettelcybersecurity.com
Phân tích mẫu mã độc khai thác lỗ hổng Microsoft Office Equation Editor.
Analysis of an RTF sample abusing Microsoft Office Equation Editor bugs CVE-2017-11882 and CVE-2018-0802: it drops adcache.dll, checks a killswitch and runs shellcode, traced with Qiling.
blog · hunt.io
The Complete Guide to Hunting Cobalt Strike – Part 1: Detecting in Open Directories
Part 1 of the Cobalt Strike series: using AttackCapture to mine open directories for PowerShell loaders and configs, then pivoting via SSL certificates and fingerprints to map live C2 servers.
blog · hunt.io
Interview with Daniel Plohmann: Malpedia, Malware Analysis, and Research Insights
An interview with Daniel Plohmann: building Malpedia and MCRIT, his path from network simulation to malware research, collaboration in the field, and music as an outlet away from security.
blog · hunt.io
Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies
Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.
blog · hunt.io
RunningRAT’s Next Move: From Remote Access to Crypto mining For Profit
Hunt.io spots RunningRAT—previously an access and data-theft tool linked to 2018 Olympics campaigns—now staging crypto-mining payloads via open directories and a separate staging VPS.
blog · hunt.io
Tricks, Treats, and Threats: Cobalt Strike & the Goblin Lurking in Plain Sight
A Halloween-themed open directory on a Hong Kong host exposed Cobalt Strike 4.2, exploit code, the BrowserGhost tool and a Goblin phishing kit aimed at Chinese-speaking education platforms.
back