Found an interesting new malware loader which creates a fake Windows lock screen to phish the user's system login password. The fully-modular loader also bridges multitude different programming languages, including: Python, C#, C++, and PowerShell.
This extensive use of cross-language components, along with shipping an entire runtime environment, lead to us dubbing it SynkLoader (Sink Loader), because it brings everything but the kitchen sink.
While the original loader runs all of its modules in memory only, we were able to collect them by reverse engineering the command-and-control protocol, then building our own version of the loader which logs everything to disk.
Additionally, we were able to to lure the operator into thinking they had a reverse shell on our honeypot system. This allowed us to watch as they attempted to execute PowerShell commands, which were being printed to our system's console instead of being run.
Full analysis: https://expel.com/blog/synkloader-when-you-throw-in-everything-but-the-kitchen-sink/
