Anyrun

In this article, ANY.RUN‘s analyst team will explore a malicious loader known as PSLoramyra. This advanced malware leverages PowerShell, VBS, and BAT scripts to inject malicious payloads into a system, execute them directly in memory, and establish persistent access.   Classified as a fileless loader, PSLoramyra bypasses traditional detection methods by loading its primary payload entirely […]

The post PSLoramyra: Technical Analysis of Fileless Malware Loader appeared first on ANY.RUN's Cybersecurity Blog.

TI Lookup from ANY.RUN is a versatile tool for gathering up-to-date intelligence on the latest cyber threats. The best way to demonstrate its effectiveness is to hear from actual security professionals about how they use the service in their daily work.   This time, we asked Jane_0sint, an accomplished network traffic analyst and the first ANY.RUN […]

The post Investigating Phishing Threats with TI Lookup: Use Cases from an Expert appeared first on ANY.RUN's Cybersecurity Blog.

Black Friday 2024 at ANY.RUN is here! As always, we’ve prepared time-limited deals to not only help you save on our tools but also improve collaboration with your colleagues.  Here’s what we have in store for you this time.  Hunter Plan: Two Subscriptions for the Price of One  Hunter plan is designed for individual users, […]

The post Black Friday 2024 at ANY.RUN appeared first on ANY.RUN's Cybersecurity Blog.

We’re excited to announce the latest update to Threat Intelligence (TI) Lookup. The enhanced home screen now integrates all techniques and tactics of the MITRE ATT&CK matrix, along with relevant malware samples and signatures.  Let’s dive into how these updates can transform your workflow and help you tackle threats with greater confidence.  Redesigned Threat Intelligence […]

The post Explore MITRE ATT&CK Techniques in Real-World Samples with TI Lookup appeared first on ANY.RUN's Cybersecurity Blog.

Persistence mechanisms are techniques used by attackers to keep malware active, even after log-offs, reboots, or restarts. In other words, they’re techniques that make malware tougher to detect and even harder to remove once it’s on a system.  Let’s dive into a few of the common mechanisms attackers use to keep their malware persistent, quietly […]

The post 6 Common Persistence Mechanisms in Malware appeared first on ANY.RUN's Cybersecurity Blog.

Last year, we introduced Automated Interactivity — a feature that simulates user behavior inside the ANY.RUN sandbox to automatically force cyber attack execution.  The first stage of Automated Interactivity focused on basic user interactions like clicking buttons and completing CAPTCHA challenges. This allowed many analysts to simplify their investigations and streamline the sandbox use via […]

The post Automated Interactivity: Stage 2 appeared first on ANY.RUN's Cybersecurity Blog.

Editor’s note: The current article is authored by the threat researcher Aaron Jornet Sales, also known as RexorVc0. You can find him on X and LinkedIn.  HawkEye, also known as PredatorPain (Predator Pain), is a malware categorized as a keylogger, but over the years, it has adopted new functionalities that align it with the capabilities of […]

The post HawkEye Malware: Technical Analysis appeared first on ANY.RUN's Cybersecurity Blog.

On October 23, we hosted a webinar “How to Improve Threat Investigations with TI Lookup”. The session was led by Dmitry Marinov, CTO at ANY.RUN, who showed the audience effective methods for collecting the latest threat intelligence.  You can check out the recording on our YouTube channel. Here is a quick rundown of the main […]

The post How to Improve Threat Investigations with TI Lookup: Webinar Recap  appeared first on ANY.RUN's Cybersecurity Blog.

Editor’s note: The current article is authored by RacWatchin8872, who is a threat intelligence analyst. You can find him on X.  This article covers two distinct methods used to infect systems with AsyncRAT via open directories. These techniques show how attackers are constantly adapting, finding new ways to use publicly accessible files to broaden AsyncRAT’s […]

The post AsyncRAT’s Infection Tactics <br>via Open Directories: Technical Analysis  appeared first on ANY.RUN's Cybersecurity Blog.

Welcome to ANY.RUN‘s monthly updates, where we share our latest achievements and improvements.  October has been another productive month here at ANY.RUN, filled with new features to enhance your cybersecurity toolkit. We’ve introduced TI Lookup Notifications for real-time threat updates, rolled out a newly improved Linux sandbox for smoother malware analysis, and added the ability to export STIX reports for seamless […]

The post Release Notes: TI Lookup Notifications, Upgraded Linux Sandbox, STIX Reports, <br>and More  appeared first on ANY.RUN's Cybersecurity Blog.

Dr. Jim Furstenberg is a distinguished faculty member in the Ferris State University Information Security and Intelligence program. Since joining the faculty in 2014, he has combined his extensive industry experience — including roles as Chief Information Officer, Cybersecurity Consultant, and Chief Operating Officer — with his passion for teaching.  With an information technology/security career […]

The post Expert Q&A: Dr. Jim Furstenberg on Cybersecurity Education and Practice  appeared first on ANY.RUN's Cybersecurity Blog.

Network traffic analysis provides critical insights into malware and phishing attacks. Doing it effectively requires using proper tools like ANY.RUN’s Interactive Sandbox. It simplifies the entire process, letting you investigate threats with ease and speed. Take a look at the key ways you can monitor and analyze network activity with the service. Connections  Examining network […]

The post How to Capture, Decrypt, and Analyze Malicious Network Traffic with ANY.RUN appeared first on ANY.RUN's Cybersecurity Blog.

In this article, we’ll explore the most common types of protectors—packers and crypters—along with simple ways to detect and remove them.   We’ll also introduce some useful tools to simplify the process and improve your malware analysis skills.  What Are Protectors and What Types Are There?  Protectors are tools designed to complicate code analysis, making […]

The post Packers and Crypters in Malware <br>and How to Remove Them appeared first on ANY.RUN's Cybersecurity Blog.

Using Threat Intelligence (TI) feeds in your cybersecurity strategy can significantly impact not only your organization’s security posture but also its business performance. Such an integration brings many benefits that directly and indirectly improve cost-efficiency, operational effectiveness, and strategic decision-making. Let’s explore these improvements in detail. Cost Savings and ROI Investing in TI feeds can […]

The post How TI Feeds Support Organizational Performance appeared first on ANY.RUN's Cybersecurity Blog.

Identifying new cyber threats is no simple task. They’re always evolving, adapting, and finding new ways to slip through the defenses.   But no stress—ANY.RUN has you covered!  Our team of researchers are always on the lookout, analyzing the latest attacks to keep you informed.   In this article, we’re sharing some of the most recent threats […]

The post Recent Cyber Attacks Discovered by ANY.RUN: October 2024 appeared first on ANY.RUN's Cybersecurity Blog.

We are thrilled to announce a significant enhancement to Threat Intelligence Lookup — Notifications. The new functionality allows users to subscribe to real-time notifications for new results related to their specified queries. Tracking emerging and evolving cyber threats has never been easier. What Are Lookup Notifications?  Lookup Notifications enable users to receive timely updates on […]

The post Notifications in Threat Intelligence Lookup  appeared first on ANY.RUN's Cybersecurity Blog.

Editor’s note: The current article is authored by Mostafa ElSheimy, a malware reverse engineer and threat intelligence analyst. You can find Mostafa on X and LinkedIn.  In this malware analysis report, we take an in-depth look at how the Remote Access Trojan (RAT) DarkComet has been used by attackers to remotely control systems, steal sensitive […]

The post DarkComet RAT: <br>Technical Analysis of Attack Chain appeared first on ANY.RUN's Cybersecurity Blog.

We’re excited to share ANY.RUN‘s latest malware trends analysis for Q3 2024. Our quarterly update provides insights into the most widely deployed malware families, types, and TTPs we saw during the last 3 months of the year. Summary In Q3 2024, ANY.RUN users ran 1,090,457 public interactive analysis sessions, which is a 23.7% increase from […]

The post Malware Trends Report: Q3, 2024 appeared first on ANY.RUN's Cybersecurity Blog.

Editor’s note: The current article was originally published on August 16, 2022, and updated on October 21, 2024. Malware analysis is a challenge as it is. But after your hard work on cracking a new sample, it is important to present all your results to the company and colleagues. And today, we will talk about how […]

The post Malware Analysis Report in One Click appeared first on ANY.RUN's Cybersecurity Blog.

To stay safe from cyber attacks, organizations need effective ways to gather information about threats before they cause irreparable damage. Let’s look at several methods for gathering threat intelligence (TI) to see how they can help you gain a better view of the current threat landscape.  Why is Threat Intelligence Important?  Threat intelligence is important […]

The post Cyber Information Gathering: Techniques <br>and Tools for Effective Threat Research  appeared first on ANY.RUN's Cybersecurity Blog.