Hello and welcome to the Tuesday, July 8, 2025 edition of the Sands and then at Storm Centers.

Stormcast, my name is Johannes Ulrich, and this episode brought you by the Sands.edu undergraduate certificate program in cybersecurity fundamentals is recorded in Jacksonville, Florida.

At hackers have a pretty impressive arsenal in tools and tricks that they're using to figure

out if Malver they wrote is running in some kind of artificial environment used to

analyze that Malbert.

One trick that Xavier is talking about is, well, detecting whether or not the

binary was renamed. Quite often when analysts are running malicious code in some kind of

sandbox, a virtual machine or the like, they're renaming it. I actually often recommend

you rename it in order to accidentally run it on a real system.

So quite often it's being renamed into something like sample.ex or malware.ex. Well, Xavier is

talking today about how an attacker may detect if their script was renamed in particular on Windows. Windows offers a specific

API for this, the get module file name. If you leave the first of the three parameters set to

null, then it will return the name of the current program.

And that, of course, can easily then be compared to a block list, or, well, maybe attackers

like sometimes allow lists to, and will only allow the software to run if it has a very

specific name that the attacker assigned it.

Of course, this could again lead to false positives

where a user just renamed the file into something slightly different

and then it wouldn't run.

And talking about Malvary, we do have news for macOS users.

Moonlock Labs did find a new version of the atomic stealer atomic stealer

well known has been around for a few years it well was an info stealer as the name implies

...