Accelerating Analysis When It Matters
Summary: Unit 42 described using Advanced WildFire's Malware Configuration Extraction (MCE) system to triage malware samples in minutes, identifying families and pulling embedded C2 addresses and other IoCs without manual reverse engineering. From one sample tied to attacks on Ukrainian targets using Quasar RAT, analysts pivoted to a Bitbucket repository hosting 10 additional samples - none then on VirusTotal - and identified them as Lumma Stealer, Remcos RAT, Quasar RAT, Redline Stealer and Vidar Stealer, with some sharing .pw C2 domains and common C2 IP addresses.
Bottom line: Ten samples from a single Bitbucket repository were invisible to VirusTotal at the time of analysis, and their configurations were AES-encrypted and Base64-encoded on top of obfuscated code - meaning the C2 infrastructure only surfaced through automated memory parsing, not signature lookups.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026