ANY.RUN๐จ Update Your Detection Rules: New In-Memory Loader
We caught a highly evasive #HanGhost loader, designed to bypass traditional detection through layered obfuscation and in-memory execution. This activity targets corporate users handling payments, logistics, and contract workflows, expanding exposure across critical operations.
โ ๏ธ The delivery chain combines obfuscated JavaScript, hidden PowerShell execution, and environment-variable staging.
In the second stage, the loader retrieves an image file and extracts an encrypted payload embedded at the end of the file, combining steganography with in-memory loading and making detection significantly harder โ๏ธ
๐พ The loader is used to deliver multiple malware families: #PureHVNC, #XWorm, #Meduza, #AgentTesla, and #Phantom, with some chains also deploying #UltraVNC, extending the impact from initial access to persistent remote control.
โก๏ธ#ANYRUN Sandbox allows analysts to reconstruct the full execution chain, helping confirm complex multi-stage activity earlier and reduce MTTR.
๐ JavaScript-to-Payload execution chain:
JS โก๏ธ PowerShell โก๏ธ in-memory .NET assembly โก๏ธ PNG payload โก๏ธ Malware
๐ The campaign shows wave-based activity, indicating ongoing development and scaling:
March 26 โ early cluster
April 1โ2 โ first large multi-family wave
April 3 โ focused wave (PureHVNC / AgentTesla / Phantom)
April 6 โ PureHVNC-heavy activity
April 7 โ new peak with split between PureHVNC and XWorm/Meduza clusters
April 8 โ multi-family wave (PureHVNC / Phantom / AgentTesla)
April 9โ13 โ more focused wave dominated by PureHVNC, with Phantom, DarkCloud, Formbook, and Meduza also present
๐จโ๐ป See the analysis session and collect #IOCs to speed up detection and response: https://app.any.run/tasks/cc26155e-e8e9-442b-b000-8d1a1435e7db?utm_source=mastodon&utm_medium=post&utm_campaign=hanghost&utm_content=linktoservice&utm_term=130426
๐ Use this TI Lookup query to pivot from IOCs, review related activity, and validate your detection coverage: https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=hanghost&utm_content=linktotilookup&utm_term=130426#%7B%2522query%2522:%2522commandLine:%255C%2522bYPaSS%2520-Command%2520*iex%2520$env:%255C%2522%2522,%2522dateRange%2522:180%7D%20
๐จโ๐ป Equip your SOC with faster decisions and lower workload. See how #ANYRUN fits your workflows: https://any.run/enterprise/?utm_source=mastodon&utm_medium=post&utm_campaign=hanghost&utm_content=linktoenterprise&utm_term=130426
James_inthe_box
๐ฝ๐ด๐๐๐ด๐๐ด๐ฒ