Record · corpus.blog/posts/01a0ca8f-bf49-70cb-8edd-fb5333dd1067

VileRAT: DeathStalker’s continuous strike at foreign and cryptocurrency exchanges

Kaspersky Securelist · published 10 August 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at securelist.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 32
Words captured: 7,425

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

Lifting the veil on DeathStalker, a mercenary triumvirate Read at the source ↗

securelist.com

What did DeathStalker hide between two ferns? Read at the source ↗

securelist.com

https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/

welivesecurity.com

https://www.cybereason.com/blog/research/no-rest-for-the-wicked-evilnum-unleashes-pyvil-rat

cybereason.com

https://github.com/eset/malware-ioc/tree/master/evilnum

github.com

https://www.zscaler.com/blogs/security-research/return-evilnum-apt-updated-ttps-and-new-targets

zscaler.com

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/08/05135313/VileRAT_DeathStalkers_continuous_strike_01.png

media.kasperskycontenthub.com

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/08/05135347/VileRAT_DeathStalkers_continuous_strike_02.png

media.kasperskycontenthub.com

https://attack.mitre.org/techniques/T1564/007/

attack.mitre.org

https://github.com/bontchev/pcodedmp

github.com

http://www.decalage.info/python/oletools

decalage.info

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/08/05135421/VileRAT_DeathStalkers_continuous_strike_03.jpg

media.kasperskycontenthub.com

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/08/05135446/VileRAT_DeathStalkers_continuous_strike_04.png

media.kasperskycontenthub.com

https://docs.microsoft.com/en-us/windows/win32/wmisdk/creating-a-wmi-script

docs.microsoft.com

https://docs.microsoft.com/en-us/office/vba/language/reference/user-interface-help/textbox-control

docs.microsoft.com

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/08/05135520/VileRAT_DeathStalkers_continuous_strike_05.png

media.kasperskycontenthub.com

https://docs.microsoft.com/en-us/office/vba/api/word.shapes.addpicture

docs.microsoft.com

https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-

docs.microsoft.com

https://www.geoffchappell.com/studies/windows/win32/ntdll/api/index.htm

geoffchappell.com

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/08/05135659/VileRAT_DeathStalkers_continuous_strike_06.png

media.kasperskycontenthub.com

https://docs.microsoft.com/en-us/windows/win32/api/winternl/ns-winternl-peb

docs.microsoft.com

http://www.cse.yorku.ca/~oz/hash.html

cse.yorku.ca

https://www.7-zip.org/sdk.html

7-zip.org

https://docs.microsoft.com/en-us/windows/win32/shell/csidl

docs.microsoft.com

https://docs.microsoft.com/en-us/windows/win32/api/taskschd/nn-taskschd-itaskservice

docs.microsoft.com

https://www.py2exe.org/

py2exe.org

https://github.com/python/cpython/commit/0af9bef61afffbf128aba76a2e578059621b4f00

github.com

https://pypi.org/project/uncompyle6/

pypi.org

https://pypi.org/project/decompyle3/

pypi.org

https://github.com/andrew-tavera/unpyc37/

github.com

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/08/05135755/VileRAT_DeathStalkers_continuous_strike_07.png

media.kasperskycontenthub.com

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/08/05135846/VileRAT_DeathStalkers_continuous_strike_08.png

media.kasperskycontenthub.com