Unit 42 Technical Analysis: Seaduke
Summary: Unit 42 analyzed a sample it labels Trojan.Win32.Seadask, part of the 'Duke' malware family that Symantec described in a blog post mentioning a function named 'forkmeiamfamous'. After removing the UPX packer, Unit 42 found the sample was built with PyInstaller from Python, and its obfuscated code hides a base64- and ZLIB-encoded JSON configuration plus HTTP/HTTPS command traffic encrypted with RC4 using a SHA1-derived key.
Bottom line: Seaduke chains each session's RC4 key to the random string from the previous session, so no single captured HTTP session can be decrypted without the one before it - a design that defeats analysts who only have a partial packet capture.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026