4 ms·
Summary BLOODALCHEMY is a backdoor shellcode containing only original code(no statically linked libraries). This code appears to be crafted by experienced
by quesera 3y ago
Summary
BLOODALCHEMY is a backdoor shellcode containing only original code(no statically linked libraries).
This code appears to be crafted by experienced malware developers.
The backdoor contains modular capabilities based on its configuration. These capabilities include
multiple persistence, C2, and execution mechanisms.
While unconfirmed, the presence of so few effective commands indicates that the malware may be a
subfeature of a larger intrusion set or malware package, still in development, or an extremely focused
piece of malware for a specific tactical usage.
Omitted from summary: In Microsoft Windows
Omitted from entirety of article: Which versions of Windows. Maybe some readers care. I do not! :)
Omitted from entirety of article: Why it has such a silly name. I would cut them some slack if it exploited a lib named BLDLCM.DLL or something like that, but it seems the name is just more silliness for the sake of silliness?
- DiabloD3 3y agoNames crafted like ALLCAPSNOUNVERB are usually government issued internal names that are used once and are unambiguous while also giving no hint to what they refer to, in the case of information leaks. The author did not name it, but the state-sponsored actor did (either the one that wrote it, in cases of tool leaks, or the one that first identified it, in the cases of foreign tool identification).
- pizzalife 3y ago>The author did not name it, but the state-sponsored actor did (either the one that wrote it, in cases of tool leaks, or the one that first identified it, in the cases of foreign tool identification). From the article, there is no indication that the name comes from whoever authored the software. Sounds made up, and the way they obfuscate strings in the code makes me think it is not from a state-actor (definitely not one in the west).
- DiabloD3 3y agohttps://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set https://www.elastic.co/security-labs/introducing-the-ref5961... This contains language that leads me to believe they take contract work from state entities. So, either their sponsor names these, or they have internally taken to this style to better integrate into the state security apparatus.
- quesera 3y agoThat's reasonable enough. But ALCHEMY is not a verb.
- DiabloD3 3y agoThis is true. The verb would be Alchemise. There is no real hard rules on how to make these names, other than they have to be memorable, unique, and not actually describe the thing they're naming. Having a noun that can be verbed works well enough.
- quesera 3y agoThinking further though, I assume government project name generators have word lists, and I assume that BLOOD is not in those lists. The general proximity of both words to the retro previous-century hacker subculture conceit (guilty!) suggests to me that this name was chosen. I could be wrong, of course.
- albert_e 3y agoyeah; not explaining the main platform / device this impacts anywhere clearly is a bad miss. the author / reveiwer should fix.