Home - h4ckers-news

Claude has an Android app! So, how is it?

Tech

andreasc

-

July 16, 2024

Claude has an Android app! So, how is it?

[ad_1]

When talking about the best AI chatbots on the market, we typically mention ChatGPT and Gemini. However, we often forget about Anthropic AI’s flagship chatbot named Claude. This is also a powerful chatbot powered by a powerful model. Well, Google and Amazon-backed Anthropic just released the Claude app on Android. Here’s a rundown of what this app is all about and what it has to offer.

Download Claude for Android

The Claude app is now available for Android users!

Why should Gemini and ChatGPT users have all the fun? If you choose to use Claude, then using the app will be much more convenient. It’s available to download today from the Google Play Store. It’s free to download, and you can use it with any Anthropic plan, even if you’re a free user.

When you get the app, all you have to do is sign into your account. If you’re making a new account then and there, then you’ll need a valid phone number to sign up. Once you make your account, you’ll give Claude your name and agree to all of the terms of service.

Using the Claude app

Once you’re in, you’ll see a very familiar sight. The Claude app has a layout similar to the ChatGPT and Gemini apps. At the very bottom of the screen, you’ll see the text field. The text field will show you which specific model you’re using. Free users will be using Claude 3.5 Sonnet by default. Above that, you’ll see a message letting you know that your free plan is limited.

Up top, above the “Welcome” message, you’ll see the profile button. It will be the circle with the first letter of your name. Tapping on that will bring you to the Settings. Here, you’ll be able to upgrade your plan, view your email address, and change your name. That’s pretty straightforward.

Back to the home screen, the majority of the screen is empty space. As you have conversations with Claude, you’ll see this empty space fill up with a feed of your conversations. The app will generate a title for them that’s straightforward and related to the conversation.

If you don’t like what Claude called one of the conversations, or if you just want to make your own title, you can simply tap and hold on a conversation. You’ll see a little dropdown menu show up with the option to rename it or delete it.

What you can do with Claude

Using the Claude app is just like using the website. It’s hard to list exactly what you can ask Claude, as it’s designed to be an “Everything chatbot” just like ChatGPT and Gemini. You can ask it to summarize content, retrieve information for you, create written content, etc. You can use it for just about anything.

Another great feature of the app is the real-time translation. If you need to talk to a person who speaks another language you can use the app as an interpreter.

Different inputs

As you can tell, Claude takes text as an input, but that’s not all. Claude is multi-modal, which means that it can accept other forms of input like images and documents.

Look at the text field, and you’ll see the paperclip icon. Tapping on that will bring up a panel from the bottom. This will give you the option to take a photo with your camera, upload an image from your gallery, or upload a document.

Taking a picture is pretty straightforward. Just take the picture of the object that you want Claude to look at. If you want to upload an image, you’ll be taken to your system’s photo picker. When you add the picture, you’ll see a small preview of it in the text field. Next, ask the question about the image that you want.

The same thing goes for uploading documents. You’re able to upload DOC files, PDFs, and more.

You can also access the upload options by tapping on the text field and tapping on one of the icons that appear under the placeholder text.

When you’re in a conversation with an uploaded file, you’ll see that file at the very top of the interface. Tapping on the file won’t do anything. That’s a bit unfortunate, as it’d be nice to see an expanded view of the images you took to double-check what the app says about it. However, that’s not a bit deal.

Sidenote

The app doesn’t ask for permission to access your camera or files when you choose these options for the first time. There’s a chance that you grant the app permission when you agree to the terms of service at the beginning. That’s something to keep in mind. So, before you actually enter the app, you might have already given the app access to your files. If that’s not something that you want, you may need to reconsider getting the app.

Cross-platform

Anthropic Claude is a cross-platform chatbot. This means that all of your conversations will transfer no matter what platform you’re using. So, if you start a bunch of conversations on the Claude website, then you’ll be able to access them using the Android and the iOS app. So, you can log in on the website and pick up where you left off with the conversations that you started on the app.

You don’t need to take any extra steps or transfer your conversations. They’re readily available on the Claude app, whether it be for iOS or Android.

App performance

After using the app for a bit, there aren’t any bugs or hiccups evident throughout the app. Everything’s fast and responsive. Since it’s a new app, you can’t rule out the occasional bug here and there. However, in our experience, it was perfectly smooth.

Upgrading

If you’ve reached the limit of what you can do with the free plan, you might want to consider upgrading to Claude Pro. This is a $20/month plan that gives you access to 5x the usage, so you’ll be able to send 5x as many queries as with the free plan.

Along with that, you’ll be able to use the Claude 3 Opus and Haiku models. These are more powerful models than Sonnet, so you’ll have access to smarter AI.

Next, you’ll gain priority access during high-traffic times. During times in the day when more people are using Claude, free users might be put on a waiting list until the usage goes down. Well, Claude Pro users won’t need to wait.

Lastly, Pro users gain early access to new features. If you upgrade on the app, you’ll gain all of these features throughout every platform you use Claude on.

All in all, the Claude app for Android is a great and convenient way to access one of the best chatbots on the planet.

[ad_2]
Source link

The iRobot Roomba Combo i3+ drops to its Lowest Price Ever

Android

andreasc

-

July 16, 2024

0

The iRobot Roomba Combo i3+ drops to its Lowest Price Ever

[ad_1]

Amazon’s Prime Day brings the iRobot Roomba Combo i3+ down to its lowest price ever. It’s now priced at just $329, which is going to save you $270 off of its regular price. Making this a really great time to grab a new robot vacuum.

The iRobot Roomba Combo i3+ is a robot vacuum and mop, all-in-one. Since this is the plus model, we also have the auto-empty dock included here. So it can clean your home by vacuuming and mopping all at the same time. Which is really convenient.

Since this is one of the cheaper Roomba Combo models, it means that you will need to swap out the dustbin and the dustbin with mopping pad. It’s not that big of an issue, but this is done so that it doesn’t get your carpets wet. iRobot has included some really good suction power on this robot vacuum, along with its rubber brushes which will keep hair from getting tangled around the brush. That’s pretty important as the bristle brushes can get tangled up very quickly.

This is a really impressive robot vacuum and mop that you can pick up during Prime Day for only $329.

Buy at Amazon

[ad_2]
Source link

Google’s Pixel Buds Pro drop to $119 for Prime Day

Tech

andreasc

-

July 16, 2024

0

Google’s Pixel Buds Pro drop to $119 for Prime Day

[ad_1]

Amazon has just marked down the Google Pixel Buds Pro, making them very affordable once again. They are now just $119.99. This brings the Pixel Buds Pro back down to an all-time low.

Pixel Buds Pro is the first “pro” pair of earbuds from Google, giving you better battery life and, more importantly, ANC. So, with this pair of earbuds, you can get up to 11 hours of continuous playback and up to 31 hours with the included carrying case. That carrying case isn’t super bulky, either. It’s about the same size as the older Pixel Buds, which is really more of an egg size.

Google made the Pixel Buds Pro to fit comfortably in your ears. They were designed for a comfortable, secure fit with sensors that help to reduce the plugged-ear feeling.

You can make and take calls on the Pixel Buds Pro. Thanks to the beamforming mics, you’re going to get crystal clear calls, even in noisy settings, as they are able to block out the background noise. Like with AirPods, the Pixel Buds Pro can easily switch between your devices. So, you can go from using them with your phone to using them on your tablet or your laptop. That’s thanks to Google’s Fast Pair feature.

Finally, the Pixel Buds Prom is also water resistant. So you can wear them in the rain or to the gym and not worry about them getting damaged at all. That’s a big deal if you’re looking for a pair of earbuds to wear at the gym to work with. Not to mention, they sound incredible when used at the gym or anywhere else.

You can pick up the Google Pixel Buds Pro from Amazon today at the link below.

Buy at Amazon

[ad_2]
Source link

AI device Rabbit r1 logged user interactions without an option to erase them before selling

Malware

andreasc

-

July 16, 2024

0

[ad_1]

Rabbit, the manufacturer of the Artificial Intelligence (AI) assistant r1 has issued a security advisory telling users it’s found a potential security risk. If a user loses or sells their device, a person in possession of the r1 could potentially jailbreak the device and gain access to files that contain logging information, chats, and photos.

To tackle the potential problem with sensitive data being left behind on the r1, Rabbit has taken the following measures:

A factory reset option is now available in the settings menu that lets you erase all data from the r1 prior to transferring ownership.
Pairing data is no longer logged to the device.
The amount of log data that gets stored on the device has been reduced.
Pairing data can no longer be used to read from the user’s Rabbithole journal section. It can only trigger actions.

Rabbit also says it is performing a full review of device logging practices to check whether additional technical controls are needed.

If you have an r1, you don’t need to do anything as the fix will be downloaded and installed automatically. While most updates to the r1 do not require any action of the user, updates that require you to accept them, including new features and more supported apps, will happen via over-the-air updates. For these, follow the prompt on your r1, make sure you’re connected to WiFi and a power source, and wait for it to update.

For those not familiar with the concept, the Rabbit r1 is an AI-powered gadget that can manage the use of your apps for you. It’s a standalone gadget with a 2.88-inch touchscreen, a rotating camera for taking photos and videos, and a scroll wheel/button designed to navigate the menu or allow you to talk to the built-in AI.

The Rabbithole mentioned earlier is an all-in-one web portal to manage the relationship with rabbit OS, and the device that you pair the r1 to. The Rabbit r1 uses a Large Action Model (LAM) to translate the user’s voice into actions on the device it’s paired with, whether that’s a handheld device, like a phone, or a desktop computer.

It’s still pretty much a project under development. Right now, the Rabbit r1 can answer questions, call an Uber, order DoorDash, play music on Spotify, translate speech, generate images on Midjourney, identify nearby objects with its camera and record voice memos. Nothing your phone can’t do, but Rabbit promises more options on the horizon and claims that all these actions are easier to accomplish when you’re using the r1.

The journal section of the Rabbithole web portal shows any visual searches you’ve conducted using the r1’s camera and voice memos you’ve recorded.

Rabbit says there’s no indication that pairing data has been abused to retrieve Rabbithole journal data belonging to a former device owner. Yet the possibility exists, and it’s good that users now have the ability to erase all data before selling the device. However, this doesn’t solve the issue if the r1 is stolen or lost.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

Summer mega sale

Go into your vacation knowing you’re much more secure: This summer you can get a huge 50% off a Malwarebytes Standard subscription or Malwarebytes Identity bundle. Run, don’t walk!

[ad_2]
Source link

Another Pixel 9 Pro leak shows the camera’s zoom range

Android

andreasc

-

July 16, 2024

0

Another Pixel 9 Pro leak shows the camera’s zoom range

[ad_1]

Google’s been a big leaky faucet this year, as we’ve seen several leaks of the Pixel 9 Pro. Someone got their hands on working units and they’re literally taking them out and taking pictures with them. Thanks to another leak, we see just how far the Pixel 9 Pro can zoom.

It looks like, in its attempts to shove AI down our throats, Google has forgotten about safeguarding its phones. We’ve seen some pretty massive Pixel 9 Pro leaks over the past couple of weeks. People have been able to get their hands on several handsets and show them off in videos and social media posts.

For example, we just saw videos showing off several of the Pixel 9 models, comparing them to the Galaxy S24 Ultra, and comparing them to the iPhone 14 Pro Max. They all look legit, so there’s very little left to the imagination.

A new leak shows how far the Pixel 9 Pro can zoom

In recent years, the Pixel Pro phones have come with periscopic zoom cameras, and those helped boost their reach. The last few Pixel Pro phones could reach up to 30x with a combination of optical and software zoom.

Well, a TikTok user just posted a new video showing the Pixel 9 Pro in all its glory. In the video, we see that this phone could max out at 30x zoom just like the previous models. 30x zoom seems to be the sweet spot. It’s far enough to give you some decent reach but not too far as to create blurry and ugly results.

In the video, we see that the text is in Russian. Also, we see that the phone is running the old Pixel Camera UI. Late last year, Google started replacing the UI on its phones to make the interface a bit cleaner. It moved the saturation, brightness, and contrast sliders below the viewfinder with the update.

So, we’re not sure why it has the older design. It’s possible that the Pixel 9 was in testing before the update, and the user in the video, Pixo_unpacking, is using an early unit that was in testing before the camera app was updated.

In any case, we see that the zooming isn’t quite smooth. You can tell when the camera switches between sensors. We can see the quality and color temperature change. It’s not smooth at all, but let’s hope that the company can iron this out before the official launch.

[ad_2]
Source link

New case leak confirms Sony Xperia 5 VI is in the works

Android

andreasc

-

July 16, 2024

0

New case leak confirms Sony Xperia 5 VI is in the works

[ad_1]

Recent reports that Sony plans to discontinue the Xperia 5 series may not be true. A fresh leak suggests the Xperia 5 VI is very much in the company’s pipeline. A third-party accessory maker is already selling a rugged case for the unannounced Android phone, hinting at a nearing launch. The leaked case images reveal a few design details.

Sony is readying the Xperia 5 VI, new leak reveals

Sony’s smartphone lineup consists of three models. The Xperia 10 series is its entry-level or budget offering, while the Xperia 1 series is a flagship. The Xperia 5 slots in between the two, closer to the latter. It’s a mix of premium-ness and affordability. Last year, Sony launched the Xperia 10 V and Xperia 1 V in May and followed up with the Xperia 5 V in September. The Xperia 10 VI and Xperia 1 VI debuted in May too, and we were expecting the Xperia 5 VI around September.

However, a tipster last month claimed that Sony won’t launch an Xperia 5 series phone this year. The source even said that the Japanese company plans to entirely discontinue the lineup, keeping only two models. While the tipster didn’t have an excellent track record of leaks, it did seem to be a logical decision. People wanting a high-end Sony phone are more likely to buy the Xperia 1 model than the Xperia 5, which costs a little less and comes with some compromises.

It appears the information was inaccurate. A German retailer recently listed an alleged Spigen Rugged Armor case for the Xperia 5 VI in Matte Black. The accompanying images show a slight redesign of the camera housing, suggesting a new phone rather than a fake listing. Instead of a circular LED flash unit next to a microphone hole between the two rear cameras, the device has a rectangular dual-LED solution placed centrally with the microphone hole sitting slightly under it.

The device may lack a dedicated camera shutter button

This leak reveals a few more design details of the Xperia 5 VI. Well, we can see a 3.5mm headphone jack and a microphone hole at the top, but their positions are unchanged from the Xperia 5 V. The button placement is also the same, with the power button doubling up as a fingerprint scanner. The upcoming model seemingly lacks a dedicated camera shutter button. Or maybe this leaked case doesn’t accurately depict its design. If the Xperia 5 VI exists in Sony’s pipeline, expect more leaks in the coming weeks.

[ad_2]
Source link

MirrorFace Attacking Organizations Exploiting Vulnerabilities

Hacking

andreasc

-

July 16, 2024

0

MirrorFace Attacking Organizations Exploiting Vulnerabilities

[ad_1]

MirrorFace threat actors have been targeting media, political organizations, and academic institutions since 2022, shifting focus to manufacturers and research institutions in 2023.

The attack method evolved from spear phishing to exploiting vulnerabilities in external assets, specifically in Array AG and FortiGate products, while the actors deploy NOOPDOOR malware and use various tools to exfiltrate data, including file listing and content review, after gaining network access.

NOOPDOOR, a shellcode, injects itself into legitimate applications through two methods, where Type1 utilizes an XML file containing obfuscated C# code, which is compiled using MSBuild and executed by NOOPLDR.

NOOPDOOR launched by an XML file (Type1)

Type2 employs a DLL file, loading NOOPLDR into a legitimate application via DLL side-loading. Both types retrieve encrypted data from specific files or registry entries, decrypt using AES-CBC based on system information, and inject the code into a target application.

After the code has been executed, it is encrypted and then saved in a specific registry location so that it can be used during subsequent operations.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files

NOOPLDR Samples Exhibit Diverse Characteristics:

NOOPLDR samples manifest in XML and DLL formats, leveraging various Windows processes for injection. XML-based NOOPLDRs primarily use legitimate services for execution and store encrypted payloads in specific registry locations.

DLL variants exhibit more complex behaviors, including service installation and potential hiding, employing registry keys for payload storage.

According to JPCERT/CC, some samples utilize `wuauclt.exe` for both XML and DLL injection, while others rely on processes like `lsass.exe`, `svchost.exe`, and `vdsldr.exe`.

Type 2 employs Control Flow Flattening (CFF) to obfuscate its code, making analysis difficult. While tools like D810 can partially deobfuscate CFF, JPCERT/CC offers a dedicated Python script (Deob_NOOPLDR.py) on GitHub for further deobfuscation.

CFF obfuscated function (Left) and deobfuscated function (Right)

It can communicate over port 443 using a Domain Generation Algorithm (DGA) and receive commands via port 47000.

Beyond standard malware actions like file transfer and execution, NOOPDOOR can manipulate file timestamps, potentially hindering forensic investigations.

Threat actors are actively trying to get Windows network credentials by looking for them in the memory dumps of processes that are running Lsass, the NTDS.dit database for the domain controller, and sensitive registry hives (SYSTEM, SAM, SECURITY) that allow access to the SAM database.

The activities, indicative of credential theft, may be detectable through security solutions like Microsoft Defender and EDR products, while access to NTDS.dit is explicitly logged and analyzed by external resources.

Attackers leveraged Windows network admin privileges to spread malware via SMB and scheduled tasks, targeting file servers, AD, and anti-virus management servers, which were logged as Event IDs 4698 and 5145.

Post-intrusion, attackers conducted reconnaissance using uncommon commands like auditpol, bitsadmin, and dfsutil by exfiltrating data using WinRAR and SFTP after enumerating files with dir /s and commands targeting OneDrive, Teams, IIS, and other locations.

“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo

[ad_2]
Source link

Here’s why you need to buy the Eureka E10s this Prime Day

Android

andreasc

-

July 16, 2024

0

Here’s why you need to buy the Eureka E10s this Prime Day

[ad_1]

The Eureka E10s, a top-selling robot vacuum on Amazon, is now more affordable than ever thanks to a Prime Day discount. With a whopping 50% off its regular price, the E10s is currently available for just $349, making it a smart and cost-effective investment for your home.

The E10s is not just a robot vacuum; it’s a unique and innovative cleaning solution. Its dock, with a bagless design, automatically empties the dirt and dust from the robot vacuum, a feature that sets it apart from other robot vacuums. This unique design is sure to pique your interest and make cleaning a breeze.

Eureka is leveraging advanced technology usually found in premium vacuums

Eureka also uses Multi-Cyclonic Separation Technology to efficiently separate dust and fine particles from the air that enters the collection station. This technology helps to ensure strong and consistent suction power. In contrast, traditional dust collection systems lose suction power over time as dust accumulates on the filter and eventually clogs it. This is why some docks aren’t able to empty the dustbin in the robot vacuum fully. An added benefit of Eureka’s Multi-Cyclonic Separation Technology is the prolonged life of the filter.

The Eureka E10s not only features a convenient self-emptying dock but also boasts impressive cleaning capabilities. Its powerful 4,000Pa suction easily removes the most stubborn debris from floors. Additionally, the E10s includes a mop lifting feature that raises the mop 10mm to prevent carpets from getting wet during cleaning. This versatile robot vacuum can even vacuum and mop simultaneously, providing efficient and thorough cleaning in one pass.

Why should you buy the Eureka E10s? Simply put, robot vacuums can be expensive to maintain. Not only do you have the initial purchase price, but also the ongoing cost of replacement parts. Eureka eliminates one of those recurring costs: dust bags. If you typically empty your dust bag monthly, you’re spending around $6 per bag, which comes out to around $70 per year. The E10s does away with that expense entirely.

Eureka is offering major discounts on other products for Amazon Prime Day

Eureka’s Prime Day deals extend beyond the E10s robot vacuum. The popular NEW400 wet-dry vacuum will be available for $129, while the Eureka RapidWash, offering extended runtime and superior suction, will be discounted to $229.

If you’re in the market for a new upright vacuum, Eureka has you covered this Prime Day as well. The Eureka OmniVerse is going to be on sale for $199. The OmniVerse does feature tangle-free technology, making it an excellent purchase for pet owners.

The popular Eureka Spot Cleaner is also on sale for Prime Day, with a price of $89.99, bringing it down to an all-time low price. This is a great vacuum for cleaning upholstery, spot cleaning, and so much more.

And last but not least, the Eureka RapidClean Pro is on sale for $109. This is a cordless stick vacuum that is perfect for complementing a robot vacuum like the E10s.

[ad_2]
Source link

HardBit Ransomware Using Passphrase Protection To Evade Detection

Hacking

andreasc

-

July 16, 2024

0

HardBit Ransomware Using Passphrase Protection To Evade Detection

[ad_1]

In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware doesn’t use leak sites or double extortion.

Their tactics include data theft, encryption, and ransom requests with threats of other attacks.

Cybersecurity researchers at Cybereason identified that HardBit ransomware has been actively using Passphrase protection to evade security measures.

HardBit Ransomware & Passphrase Protection

They talk through TOX which is a peer-to-peer messaging system. Although it is unknown what their initial infection method is, they seem to resemble LockBit Ransomware in some ways.

Their observed TTPs consist of RDP and SMB brute-forcing, credential theft utilizing Mimikatz NLBrute, and possible utilization LaZagne NirSoft tools.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files

They were known to download programs from picofile[.]com, a Farsi file-sharing site.

Open Ports Detected On The Brute Forcing Server (Source – Cybereason)

The threat actors used network discovery tools such as Advanced Port Scanner and KPortScan 3.0 to move through RDP, reads Cyberreason report.

They installed HardBit ransomware bundled with the Neshta virus, a tool that corrupts files and maintains the infection for a long time.

HardBit Packed Neshta Execution Flow (Source – Cybereason)

HardBit ransomware necessitates the input of an authorization ID and encryption key. It also turns off Windows Defender, stops services, and prevents system recovery by using BCDEdit, Vssadmin, WBAdmin, and WMIC in advance of file encryption.

HardBit Ransomware Execution Procedure (Source – Cybereason)

Binary unpacking is part of the complex ransomware process that includes file infection as well as manipulation of systems to ensure successful execution and prevent recovery.

HardBit ransomware selectively encrypts files, updates infected machines, and uses encrypted email contacts. It’s obfuscated with Ryan-_-Borland_Protector Cracked v1.0, a modified ConfuserEx.

The GUI version offers ransom and wiper modes, with wiper mode requiring additional authorization. Configuration file hard.txt can enable wiper mode.

HardBit has evolved through versions 2.0, 3.0, and 4.0, with increasing sophistication in functionality and obfuscation techniques.

Recommendations

Here below we have mentioned all the recommendations:-

Enable Application Control to block execution of malicious files.
Activate Predictive Ransomware Protection.
If Predictive Ransomware Protection is unavailable, enable Anti-Ransomware.
Enable Variant Payload Prevention on your security solution with Prevent mode.

“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo

[ad_2]
Source link

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

Hacking

andreasc

-

July 16, 2024

0

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

[ad_1]

X-Labs identified basic ransomware targeting Turkish businesses, delivered via PDF attachments in suspicious emails from the internet[.]ru domain.

PDF links trigger exe payload downloads, which encrypt files with the “.shadowroot” extension, which is actively compromising various global organizations, including healthcare and e-commerce sectors.

A PDF attachment containing a malicious URL linking to a compromised GitHub account has been identified as the initial access vector, which downloads an executable payload named “PDF.FaturaDetay_202407.exe,” suggesting potential malware delivery and subsequent system compromise.

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files

The analyzed 32-bit Borland Delphi 4.0 executable deploys secondary payloads, RootDesign.exe, Uninstall.exe, and Uninstall.ini, to the “C:\TheDream” directory.

RootDesign.exe uses randomized class names, special characters, and obfuscated function names protected by DotNet Confuser Core 1.6 obfuscation to avoid detection.

The primary executable utilizes PowerShell to stealthily execute RootDesign.exe, which indicates possible malicious activity.

The command executes a hidden PowerShell script from “C:\TheDream\RootDesign.exe”, spawning multiple child processes and creating mutexes “Local\ZonesCacheCounterMutex”, “Local\ZonesLockedCacheCounterMutex”, and “_SHuassist.mtx”.

These processes use memory to replicate themselves recursively, consuming an increasing amount of system resources.

Simultaneously, they encrypt various non-PE and office files, replacing their extensions with “.ShadowRoot” and logging their actions in “C:\TheDream\log.txt” with the marker “ApproveExit.dot.”.

Encrypted files with the ShadowRoot extension

According to ForcePoint, the ransomware employs the.NET AES cryptographic library for file encryption, repeatedly encrypting files via recursive self-propagation using RootDesign.exe, leading to excessive resource consumption and multiple encrypted file copies.

It displays ransom notes in Turkish, demands cryptocurrency payment through an email-based contact mechanism, and exfiltrates system information to a command-and-control server via SMTP on smtp[.]mail[.]ru, port 587, using a compromised email account.

A novice attacker targets Turkish businesses with a rudimentary ransomware campaign, where the malicious PDF invoices with links prompt the download of a Delphi payload and the execution of a dotnet confuser-obfuscated binary.

The ransomware encrypts files with the “.ShadowRoot” extension and communicates with a Russian SMTP server, suggesting limited capabilities and potential inexperience.

Threat actors are distributing malware via email using the email addresses Kurumsal[.]tasilat[@]internet[.]ru, ran_master_som[@]proton[.]me, and lasmuruk[@]mailfence[.]com.

The malware payload, with hashes CD8FBF0DCDD429C06C80B124CAF574334504E99A and 1C9629AEB0E6DBE48F9965D87C64A7B8750BBF93, is hosted on hxxps://raw[.]githubusercontent[.]com/kurumsaltahsilat/detayfatura/main/PDF.FaturaDetay_202407.exe.

“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo

[ad_2]
Source link