HACKINGBY DOING. Security research by Dolev Aviv

Analyzing A Reverse Shell

By

Analysis of a reverse-shell RAT sample, tracing how it calls back to its operator and what it can do on an infected host.

In this post, I am going to analyze another RAT downloaded from the HuskyHacks GitHub page.

This is the information I have on the file before analyzing.

I have a message from the IR team telling me they found another sample that looks similar to the last one, and there is also a txt file with hashes.

I extracted strings using FLOSS but didn't find anything valuable.

After looking again with PEstudio it looks like there might be a socket capability.

Moving on to dynamic analysis.

Initial Detonation.

A record DNS: aaa...kadusus.local

Adding the address to the hosts file

Potential call out to specified DNS record on HTTPS port (443)

Reverse shell capabilities

Conclusion:

Seems like the file has reverse shell capabilities and I managed to run some commands to verify my conclusions.

Thank you for reading and I hope you found this post interesting.

  1. Malware Analysis

    Malware Analysis: Android Malware Disguised as GB WhatsApp

    An analysis of an Android APK from the Joker malware family that hides inside the GB WhatsApp mod to mask its malicious behavior.

  2. Malware Analysis

    Redline Stealer: A Technical Examination of Modern Malware Tactics

    A static and dynamic analysis of a Redline Stealer sample, showing how modern info-stealers harvest credentials, cookies, and system data.