Malware Analysis Archives - Page 2 of 6

ACRStealer Exposed: How Cybercriminals Are Exploiting Google Docs for Malware Attacks

23 February 2025 by Krishna

What is ACRStealer?

ACRStealer is an **info stealer malware** designed to **extract sensitive information** from infected systems, including:

– **Antivirus identification** – determining which security solutions are present to evade detection.
– **Crypto wallet theft** – targeting stored cryptocurrency assets.
– **Login credentials theft** – stealing usernames and passwords for financial services, corporate accounts, and personal data.
– **Browser information extraction** – harvesting stored passwords, cookies, and browsing history.
– **File Transfer Protocol (FTP) credential theft** – compromising access to cloud and remote servers.
– **Text file harvesting** – reading and extracting information from text documents.

While information stealers are not new, **ACRStealer stands out** due to its **stealth tactics, sophisticated distribution, and abuse of legitimate cloud platforms**.

PHP Web Shells: A Comprehensive Analysis for Penetration Testers

24 January 2025 by Krishna

A PHP web shell is a script, written in PHP, that allows attackers to execute commands on a compromised web server remotely. These scripts act as a backdoor, providing attackers with access to sensitive data, server resources, and the capability to escalate their attack.

Multi-Stage Cyber Attacks: Understanding Their Sophistication and Building Robust Defences

20 January 2025 by Krishna

Cyber attacks have evolved into intricate operations, often executed in multiple stages to achieve maximum impact while evading detection. Multi-stage cyber attacks leverage complex execution chains to mislead victims, bypass traditional defences, and deliver devastating outcomes. For organisations and individuals alike, understanding the mechanics of these attacks is essential for crafting effective defence strategies.

Multi-stage cyber attacks are a formidable challenge, but with offensive security techniques, organisations can move from reactive to proactive defence. By adopting vulnerability assessments, penetration testing, cyber forensics, malware analysis, and reverse engineering, businesses can detect and neutralise threats before they escalate.

WordPress db Injection: A Comprehensive Guide for Pen Testers and C-Suite

14 January 2025 by Krishna

WordPress, which began as a simple blogging platform in 2003, has evolved into one of the most widely used content management systems (CMS) globally. Currently powering over 40% of websites, WordPress has become synonymous with digital publishing—ranging from small personal blogs to large-scale enterprise solutions. For many C-level executives, WordPress represents an agile, cost-effective solution to rapidly establish and manage an online presence.
However, with extensive adoption comes amplified risk. The same features that make WordPress easy to use—such as its vibrant plugin ecosystem and open-source nature—can also create ripe opportunities for attackers to exploit vulnerabilities. WordPress database injection, often referred to more broadly as SQL injection (SQLi), stands out as a critical concern. Attackers who successfully execute a database injection can gain unauthorised access to sensitive data, manipulate website content, or even pivot to other parts of the organisation’s network.
WordPress relies on a MySQL (or MariaDB) database to store content, user data, plugin settings, and other critical information. An SQL injection attack leverages insecure code or configurations to inject malicious SQL queries into the database, allowing attackers to read, modify, or even delete data, and in some extreme cases, compromise the server itself.

Emulation Detection Evasion: Safeguarding Against Evasive Malware Strategies

29 December 2024 by Krishna

Emulation detection evasion is a set of techniques employed by malware to detect analysis environments such as sandboxes or virtual machines and evade detection by altering their execution. By identifying the presence of emulation artifacts or behaviours, malware can stop executing or behave benignly, thereby avoiding detection and analysis.