> For the complete documentation index, see [llms.txt](https://malwaresourcecode.com/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://malwaresourcecode.com/home/my-projects/write-ups/part-i-malware-4-noobs-version-0.1-expanded.md). # Part I - Malware 4 Noobs (version 0.1 (expanded) I have no idea how much I'll actually write, I hate writing, I also hate using AI to write, so I'm doing this the old fashioned way: pain and suffering. I get asked all the time what a good introduction to malware development, or malware reverse engineering, is. I truthfully don't know. I learned malware accidentally from wanting to know C, and I learned a long time ago (like, 2007-ish, I think?), so I've been doing malware stuff a long time. I'll share little tidbits of my knowledge and maybe it'll help someone. This will be discussing ONLY Windows malware. That's all I know. I love it. Let's just jump straight into it ### Differences in malware Not everyone who writes malware is a criminal. It is not illegal to write malware. Many people write malware for fun because they enjoy the challenge of writing evasive code. Other times, people enjoying writing malware because it gives them a reason to explore Operating System internals or security product internals. However, it is illegal to knowingly distribute malware with the intent of financial gain or harm. Furthermore, it is also illegal to knowingly aid and abet an individual who intends on distributing malware for financial gain or harm. Intent is what matters with malware. I have written and published hundreds of malware snippets and proof-of-concepts online. I have received thanks from researchers (offensively and defensively) and educators (universities, higher education institutes), and I have never faced legal issues. The importance here is that while what I am writing is malicious, it is not being used *maliciously*. This distinction is paramount and this distinction is what will lead us into describing malware authors who write malware with malicious intent. Threat Actors (malware writers with malicious intent) can be divided into two different categories with only a little bit of nuance. You have Financially Motivated Threat Actors and State-Sponsored Threat Actors. The nuance here is that there is technically some individuals who do not fit neatly into either category, these individuals are either politically motivated (hacktivism) or a rogue bad actor driven by emotional needs (revenge, frustration, depression, etc). Financially Motivated Threat Actors are individuals, or sometimes groups of individuals, who write malware with the intent of making money. State-Sponsored Threat Actors are individuals, often times military divisions or externally funded groups of individuals, who write malware to aid their government. This malware differs from Financially Motivated Threat Actors because their objective is often times espionage. State-Sponsored Threat Actors historically have been labeled "APTs" (Advanced Persistent Threat). The name is misleading and is important we note this; while the acronym APT contains the word "Advanced", not all APTs are "advanced". The name implies they're "advanced" in their persistence. In simpler language, an APT means a Threat Actor (or Threat Group) may persist despite requests for extradition, infrastructure seizure, asset seizure, sanctions, or individuals being apprehended. Financially Motivated Threat Actors do not have the sort of immunity state-sponsored groups have. To expand on this idea, we can use this opportunity to discuss APT Transparent Tribe. APT Transparent Tribe has long suspected to be a State-Sponsored Threat Group performing espionage campaigns on behalf of the Pakistan government. Indeed APT Transparent Tribe is an "APT", Transparent Tribe is not nearly as "advanced" as Financially Motivated Threat Actors behind Pinkslipbot or Rhadamanthys stealer. Financially Motivated malware and State-Sponsored malware also differ in their TTPs (*Tactics, Techniques, and Procedures*). Financially Motivated malware often times (**but not always**) is a smash and grab operation. The malware is designed to exfiltrate sensitive information off the machine, retrieve what is valuable, and then stop. Furthermore, Financially Motivated Threat Actors spray their malware into the wild, the more machines they infect the higher probability to success. Financially Motivated Threat Actors also have been seen partnering with other Financially Motivated Threat Actors for strategic reasons, most notably (as you could assume) to enhance profit. Financially Motivated Threat Actors often times (but again, not always) act as MaaS (Malware-as-a-Service). MaaS is when a malware author creates a malware and sells it as a product. A Threat Actor can pay a monthly fee to another Threat Actor and get access to their product (the malware). This may sound counterintuitive; why would someone want to pay for monthly access to malware when they could create their own? The reasoning is simple: Financially Motivated Threat Actors lack the immunity a State-Sponsored Threat Actor has. If they are committing crime, they're doing it under the umbrella of the MaaS, not their own unique malware. They can hide themselves easier. This aids malware authors (the individuals selling the MaaS) too because they no longer need to be concerned about spreading their malware, they can focus exclusively on development while the people leasing the malware can do as they please. Examples of some common MaaS: 1. StealC 2. Rhadamanthys 3. Amatera 4. Raccoon 5. Vidar 6. Mars 7. MetaStealer 8. RisePro 9. AMOS 10. RedLine As we see more MaaS appear, we see "friendships" blossom too (or rather, an alliance) whereas you may find MaaS authors forming strategic "friendships" with data "traffers" (individuals who specialize in spreading malware, short for trafficking), or individuals who specialize in infrastructure ("bulletproof hosting"). Within the MaaS ecosystem there is a subset of MaaS called RaaS (Ransomware-as-a-Service). Although ransomware is indeed malware, this malware service is unlike a traditional MaaS and thus is granted it's own unique name. Unlike a MaaS, which typically is a monthly fee, a RaaS takes a percentage of money earned from extortion. Additionally, RaaS offers internal services such as "negotiators" which may aid in the extortion campaign although this usually costs extra. RaaS charges substantially more (a percentage of income rather a monthly fee) because of the risk associated with ransomware. Ransomware attracts significant attention from Law Enforcement and the developers of ransomware are often a top priority internationally. This increased danger is their justification for taking a percentage. Examples of RaaS: 1. Conti 2. Lockbit 3. ALPHV (DarkSide, BlackMatter) 4. Babuk 5. RansomHub 6. DragonForce 7. REvil Outside of MaaS and RaaS you can encounter other types of Financially Motivated Threat Actors, they're basically a "private" malware campaign rather than a "public" malware campaign. These non-MaaS malware campaigns are less common now, but they still exist. It is important to note that with Financially Motivated Threat Actors it is difficult to fit everything into neat categories and nuance always exist. State-Sponsored Threat Actors are a unique beast and totally unlike Financially Motivated Threat Actors. State-Sponsored Threat Actors are often times military operations, hence their objective can change dramatically from week-to-week, month-to-month, or year-to-year. Conversely, some State-Sponsored Threat Actors may have the same objective for years (spanning decades) with the goal of gathering intelligence. Paying attention to State-Sponsored Threat Actors requires researchers and anti-virus companies to pay close attention to geopolitics. Most cybersecurity companies have people assigned to regions across the globe (North America, Latin America, Europe, Middle East, CIS (Commonwealth of Independent States, ex-Soviet Countries), Oceania, and Asia, and often times employ individuals familiar with the culture or language of the region. What is defined as state-sponsored activity is difficult to gauge because not all state-sponsored malware campaigns target foreign governments, sometimes the government will develop malware which targets its own citizens. This has been documented in the United States with the United States government purchasing specialized malware from Israel to target individuals who oppose ICE. Similar activity has been spotted in China with the Chinese government spying on Uyghur Muslims, or various governments in Africa spying on journalists and political dissidents. The malware I'm describing is labeled "Mercenary Spyware" because this type of malware is primarily designed to target mobile devices, is primarily purchased (or developed) by governments, and has been subject to heavy scrutiny by activists because it is believed to be tied to assassinations. The most infamous Mercenary Spyware software suite was developed by Israeli firm NSO Group and their product named "Pegasus". While Pegasus and NSO Group was bad, they are by all means not the only Mercenary Spyware vendor on the market. NSO Group has several competitors and the Mercenary Spyware business is thriving. The United States currently uses Graphite from Israeli firm Paragon Solutions. Spying on political dissidents and minorities aside, governments do indeed target other governments. Historically the most aggressive countries for state-sponsored activity is Russia, China, North Korea, Iran, Pakistan, Israel, and the United States. However, it is important to note that each country listed will vehemently deny any assertion they're operating military-aligned malware campaigns and say it is propaganda designed to undermine the state. It should also be noted that while these countries listed above often times are the most aggressive, virtually every single government on the planet has been spotted performing some sort of state-sponsored malware campaigns. ### Stagers, file formats, and living off the land There is a general misconception that malware is delivered directly as a singular executable file (.exe). That is wrong. Maybe in the 90's malware was a .exe delivered straight to your machine, but that isn't very common now. Delivering a .exe to someone to run is a poor decision when writing malware because it is very easy to flag, detect, and kill (we'll talk about that later). Malware now goes in *stages* before it delivers the final *payload*. {% code overflow="wrap" %} ``` Terminology explained: Payload, in regards to malware, is the executable delivered which performs the malicious task. To make a comparison, when a military force shoots a missile, the missile is composed of several parts, notably the propulsion system (engine), guidance system, fuel, and then the actual explosive part is the payload. Likewise, in malware we may have several different components (stagers) which eventually deliver a payload (the metaphorical explosive). ``` {% endcode %} Sometimes people call it stagers, or staging, or initial access files. Sometimes people call it chaining, it all kind of means the same thing. To be crystal clear however, each step taken toward delivering the payload is a stage. The act of moving between stages is chaining. Unlike a malware payload, a stager has different goals. A stager is typically used for *environmental keying*. In other words, the stager is responsible for identifying what is happening on the machine that is running the stager. A stager will typically do the following: 1. Determine if it's running in a Virtual Machine 2. Determine the approximate geographical location (IP address) 3. Determine what (if any) security products are installed 4. Determine what version of Windows is running 5. Determine what software is installed If the stager determines the malware is running inside of a Virtual Machine, the chain should self-terminate and the secondary payload (or stager, depending on how the malware author developed their malware campaign) should not be delivered. If the stager determines the computer is running an anti-virus, the stager may determine it is best to download and execute a stager which is responsible for killing anti-virus software prior to delivering the actual payload. Unfortunately, malware is never straight forward and not all malware campaigns follow the same formula. It is not uncommon for an initial access stager to simply download and execute a secondary stager which will subsequently pull a tertiary stager which will then be responsible for environmental keying. Stagers are extremely important to an actual malware campaign because they make malware delivery substantially easier to maintain. In the event an anti-virus company detects the payload, and the payload is successfully flagged, it requires a substantial amount of time to refactor the payload to avoid detection again. Hence, if a stager can (metaphorically) ensure the coast is clear and it is an ideal environment for a payload to be executed, this saves a malware author time and a headache. Additionally, if in the event an anti-virus vendor flags a malware stager, this isn't concerning either. A malware stager is relatively easy to develop (especially in the age of AI) and can be refactored with ease. A stager is disposable. The payload is not. Stagers are flexible, and they often come in all sorts of shapes and sizes. Sometimes they're Powershell scripts (.ps1). Sometimes they're batch files (.bat). Sometimes it is masqueraded binaries. Before we discuss binary masquerading, for the painfully curious, here is a non-exhaustive list of possible file types which can be used for malware staging 1. .ps1 (Powershell) 2. .cmd (Command script) 3. .bat (Batch file) 4. .vbs (Visual Basic Script) 5. .js (Javascript) 6. .hta (HTML application) 7. .doc, .docx, .docm, .xls, .xlsm, .ppt, .ppt (Microsoft Office suite) 8. .lnk (Windows Shortcut) 9. .csproj (Microsoft Visual Studio project) 10. .sh (Shell Script) Any hypothetical file type can be abused for malware. The file types listed above are common, but there are many, many, many more. Masquerading, or a masqueraded binary, is a straight forward concept. It is a malicious file which lies about it's intention. Many people discovered this type of malware (as either a stager, or an actual payload) from P2P sharing software Limewire. You would encounter "Linkin Park - In The End.mp3.exe". The user would see .mp3, but not the .exe segment. A common method of file masquerading today is fake e-mail invitations or fake video game mods. You will see tons of stagers being sent via e-mail. The e-mail will say it is an invite to a Zoom meeting, but it is actually a malicious file. Another popular masquerading technique is creating a fake website for a real product. You may accidentally stumble across a video game mod discussed on Steam, find a website dedicated to the mod, but it actually is a malicious domain operated by a malware author designed to trick you into executing their masqueraded binary. When you download the binary it appears to be the mod, but it is actually a stager. Currently many stagers operate as ["LOLBINs", or living-off-the-land binaries](https://lolbas-project.github.io/). LOLBINs are programs that come pre-installed on Windows and can be abused for malware to act as stagers or avoid security products. LOLBINs are valuable because they can be abused without having to install external third party libraries or softwares. Threat Actors, or Red Teamers, may abuse a LOLBIN on Windows that allows an executable to be ran, or a file to be downloaded from a remote host (website, server, etc). While this may sound absurd at first; why do you need to use a pre-installed program to execute another program, or use a pre-installed program to download something else? The reasoning is that Windows, as well as a majority of cybersecurity products, block, audit, or sandbox unknown binaries being executed on a machine. However, pre-installed binaries have already been reviewed, they're marked as safe, making them ideal for abuse. Malware abusing LOLBINs is sometimes referred to as "fileless" malware. It is called "fileless" malware because the malware payload (typically a stager) doesn't require a binary to be on the machine, the stager is abusing applications which are already on the machine to perform environmental keying or chaining. The abuse of LOLBINs (Living off the Land binaries) is a heavily researched field offensively and defensively. I recommend reviewing the LOLBAS (Living Off The Land Binaries, Scripts and Libraries) project on GitHub. It is actively maintained by some of my colleagues. They do an excellent job. LOLBINs, stagers, and masquerading often go hand-in-hand and malware authors get extremely creative in their methods to deliver their payload safely. In the 2020's, malware researcher Mr.d0x (owner of MalDevAcademy) published a paper on a malware concept he had. He dubbed it "ClickFix". ClickFix is a creative idea, it is a combination of masquerading, fileless malware (as a LOLBIN), which delivers a stager.
This is an image of ClickFix which was documented in [one of their Threat Intelligence reports](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/). When a user visits the website it gives the illusion of needing to verify they're human (masquerading as a CAPTCHA), and automatically copies a LOLBIN stager to the Windows Clipboard. {% code overflow="wrap" %} ``` The Windows Clipboard is the internal mechanism which allows users to copy and paste ``` {% endcode %} When the staging payload is copied to the victims Clipboard they're instructed "verify themselves" by opening Windows Run (Windows key + R), pasting the staging LOLBIN into it (Control + V) and hitting enter to execute the LOLBIN. This is one example out of hundreds, possibly thousands, of different variants of ClickFix. While they may appear different, they all follow the same formula: automatically insert a LOLBIN payload into the users Clipboard and try to convince them to execute the LOLBIN.