Found an interesting new malware loader which creates a fake Windows lock screen to phish the user's system login password. The fully-modular loader also bridges multitude different programming languages, including: Python, C#, C++, and PowerShell.

This extensive use of cross-language components, along with shipping an entire runtime environment, lead to us dubbing it SynkLoader (Sink Loader), because it brings everything but the kitchen sink.

While the original loader runs all of its modules in memory only, we were able to collect them by reverse engineering the command-and-control protocol, then building our own version of the loader which logs everything to disk.

Additionally, we were able to to lure the operator into thinking they had a reverse shell on our honeypot system. This allowed us to watch as they attempted to execute PowerShell commands, which were being printed to our system's console instead of being run.

Full analysis: https://expel.com/blog/synkloader-when-you-throw-in-everything-but-the-kitchen-sink/

@malwaretech man behind the keyboard?
This looks interesting thanks for sharing.

@malwaretech does it use the customized (or customised) lock screen or does it present the default one?

@malwaretech isn't this shit the whole reason they did the CTRL-ALT-DEL to login thing?

Guess they probably should have kept that...

@malwaretech I’m kind of pissed I didn’t think of that, honestly

@hacks4pancakes @malwaretech same. It’s so good.

@malwaretech
It's like there was a reason for the secure attention key

@malwaretech was involved in a forensics case in the UK ~2009 where a kid in college had written a fake Windows XP login screen that caught creds and passed them through to target his teachers- he used Delphi to write it. Was genius, completely undetectable to users.

We tried to hire him but never did.

@hacks4pancakes @malwaretech

In high school computer class around 1990, we put a fake logon screen on every system where it would send your user name and password to the one networked printer, print a fake error message to the screen and loop until you rebooted at which point you'd get the real logon screen.

Written in Turbo Pascal.

@malwaretech I know a guy who is a provost at Cornell who wrote one of those at University of Richmond once...in the '80s

@malwaretech
So 1975 (and probably earlier).

@malwaretech
I remember when Windows required Ctrl-Alt-Del to be able to log in.

@wdormann @malwaretech See, this removes friction! We should be thankful.

@wdormann @malwaretech we still have a few groups with that implemented, and I still do it by reflex… not as much protection as I’d like, because folks aren’t conditioned to it now, and if they had to do Ctrl+Alt+Del every time and they saw this instead, they wouldn’t question the fact it was easier this time.

@wdormann @malwaretech the real kicker is when my brain does Cmd+Opt+Fn+Del on my Mac.

@draeath @malwaretech thats a setting you can (and should) enable

@ineemio @draeath @malwaretech ha, I still hit ctrl+alt+del and I don't think it is enabled