decoded.avast.io Open in urlscan Pro
34.111.249.39  Public Scan

Form analysis
2 forms found in the DOM

GET https://decoded.avast.io/

<form class="search-form" action="https://decoded.avast.io/" method="get">
  <input name="s" type="text" value="" placeholder="Type here to search...">
  <button type="submit">Search</button>
</form>

GET https://decoded.avast.io/

<form class="search-form" action="https://decoded.avast.io/" method="get">
  <input name="s" type="text" value="" placeholder="Type here to search...">
  <button type="submit">Search</button>
</form>

Text Content

 * Mobile
 * Network
 * PC
 * IoT
 * Careers

 * Menu

 * Search

 * Menu


THREAT LABS

Notes from the life of the reverse engineering wizards

PC


NEW DIAMORPHINE ROOTKIT VARIANT SEEN UNDETECTED IN THE WILD

June 18, 2024by David Álvarez

Introduction Code reuse is very frequent in malware, especially for those parts
of the sample that are complex to develop or hard to write with an essentially
different alternative code. By tracking both source code and object code, we
efficiently detect new malware and track the evolution of...

MobilePCReports


AVAST Q1/2024 THREAT REPORT

May 14, 2024by Threat Research Team

Nearly 90% of Threats Blocked are Social Engineering, Revealing a Huge Surge of
Scams, and Discovery of the Lazarus APT Campaign

PC


GUPTIMINER: HIJACKING ANTIVIRUS UPDATES FOR DISTRIBUTING BACKDOORS AND CASUAL
MINING

April 23, 2024by Jan Rubín and Milánek

Avast discovered and analyzed GuptiMiner, a malware campaign hijacking an eScan
antivirus update mechanism to distribute backdoors and coinminers.

PCUncategorized


FROM BYOVD TO A 0-DAY: UNVEILING ADVANCED EXPLOITS IN CYBER RECRUITING SCAMS

April 18, 2024by Luigino Camastra

Key Points Avast discovered a new campaign targeting specific individuals
through fabricated job offers.  Avast uncovered a full attack chain from
infection vector to deploying “FudModule 2.0” rootkit with 0-day Admin -> Kernel
exploit.  Avast found a previously undocumented Kaolin...

PC


LAZARUS AND THE FUDMODULE ROOTKIT: BEYOND BYOVD WITH AN ADMIN-TO-KERNEL ZERO-DAY

February 28, 2024by Jan Vojtěšek

The Lazarus Group is back with an upgraded variant of their FudModule rootkit,
this time enabled by a zero-day admin-to-kernel vulnerability for
CVE-2024-21338. Read this blog for a detailed analysis of this rootkit variant
and learn more about several new techniques, including a handle table entry...

PC


DECRYPTED: HOMUWITCH RANSOMWARE

February 20, 2024by Threat Research Team

HomuWitch is a ransomware strain that initially emerged in July 2023. Unlike the
majority of current ransomware strains, HomuWitch targets end-users -
individuals - rather than institutions and companies.

PC


DECRYPTED: RHYSIDA RANSOMWARE

February 13, 2024by Threat Research Team

The team at Avast has developed a decryptor for the Rhysida ransomware and
released it for public download. The Rhysida ransomware has been active since
May 2023. As of Feb 2024, their TOR site lists 78 attacked companies, including
IT (Information Technology) sector, healthcare, universities, and...

MobilePCReports


AVAST Q4/2023 THREAT REPORT

February 7, 2024by Threat Research Team

10 Billion Attacks Blocked in 2023, Qakbot's Resurrection, and Google API Abused

PC


AVAST UPDATES BABUK RANSOMWARE DECRYPTOR IN COOPERATION WITH CISCO TALOS AND
DUTCH POLICE

January 9, 2024by Threat Research Team

In cooperation with Cisco Talos and Dutch Police, Avast is releasing an updated
version of the Avast Babuk decryption tool, capable of restoring files encrypted
by the Babuk variant called Tortilla.

Load More


2024 Copyright © Avast Software s.r.o.



MENU

 * Mobile
 * Network
 * PC
 * IoT
 * Careers

 * Search

CATEGORIES

 * Events
 * IoT
 * Mobile
 * Network
 * Other/Research
 * PC
 * Reports
 * Uncategorized

TAGS

analysis Android APT backdoor botnet brazil cryptocurrency cryptomining csrf
ddos decryptor decryptors desktop DirtyMoe dns hijack dropper exploit fake-app
ghostdns Google Play Store HW iot malware mobile obfuscation P-Code phishing
ransomware rat report Research reversing risk rootkit router security series
spyware stealer takedown threat-intel threats VB vulnerability worm

RECENT POSTS

 * New Diamorphine rootkit variant seen undetected in the wild
 * Avast Q1/2024 Threat Report
 * GuptiMiner: Hijacking Antivirus Updates for Distributing Backdoors and Casual
   Mining
 * From BYOVD to a 0-day: Unveiling Advanced Exploits in Cyber Recruiting Scams
 * Lazarus and the FudModule Rootkit: Beyond BYOVD with an Admin-to-Kernel
   Zero-Day

ARCHIVE

 * June 2024
 * May 2024
 * April 2024
 * February 2024
 * January 2024
 * December 2023
 * November 2023
 * October 2023
 * September 2023
 * August 2023
 * July 2023
 * June 2023
 * May 2023
 * April 2023
 * February 2023
 * January 2023
 * December 2022
 * November 2022
 * October 2022
 * September 2022
 * August 2022
 * July 2022
 * June 2022
 * May 2022
 * April 2022
 * March 2022
 * February 2022
 * January 2022
 * December 2021
 * November 2021
 * October 2021
 * September 2021
 * August 2021
 * July 2021
 * June 2021
 * May 2021
 * April 2021
 * March 2021
 * February 2021
 * December 2020
 * November 2020
 * October 2020
 * September 2020
 * August 2020
 * June 2020
 * May 2020
 * April 2020
 * December 2019
 * September 2019
 * August 2019
 * July 2019
 * April 2019
 * March 2019
 * February 2019
 * January 2019
 * August 2018
 * January 2018
 * October 2017

META

 * Log in
 * Entries feed
 * Comments feed
 * WordPress.org