Botconf Author Listing

Nirmal Singh

Last known affiliation: Zscaler Inc.
Bio: Nirmal Singh is Director for the security research team at Zscaler ThreatLabZ located at Chandigarh, India. Nirmal has a Ph.D. in computer science and has been working in the threat research and analysis field for the past 14 years. He oversees malware research, detection and innovation at Zscaler. Prior to Zscaler, he worked with Norman as a manager for the threat response team.
Date: 2023-04-12
RAT as a Ransomware – An Hybrid Approach
Nirmal Singh 🗣 | Avinash Kumar 🗣 | Niraj Shivtarkar

Abstract (click to view)

In the last few years we have seen a substantial growth in the Malware-as-a-Service (MaaS) market, this revenue model generates a high income revenue stream for the malware developers and also makes it easier for the malicious actors with less technical capabilities to carry out sophisticated attacks and earn multi-million-dollars by targeting large-scale enterprises and government entities. During the last few years, we have observed a MaaS Group selling a sophisticated modular Remote Access Trojan with various features and pricing plans. The most distinctive feature of this RAT is – Ransomware Module – which encrypts the files and demands for a ransom payment in order to decrypt them. The presence of those features in the RAT leads us to believe that the Threat Actors, involved, are attempting to improve their financial gain by using Ransomware.

Slides Icon
Date: 2018-12-06
Stagecraft of Malicious Office Documents – A Look at Recent Campaigns
Nirmal Singh 🗣 | Deepen Desai 🗣 | Tarun Dewan 🗣

Abstract (click to view)

Malicious office documents have become a favorite malware delivery tool for malware authors. We have observed an increase in use of malicious documents over past 4 years. 30% of the malware blocked by Zscaler Cloud Sandbox since 2017 are malicious office documents. Malicious office documents are used for the delivery of crimeware payloads and are also often involved in Advanced Persistent Threats (APT) attacks. Over the time, these malicious office documents have used various obfuscation, encryption and evasion techniques to prevent detection. In this paper, we will provide a detailed analysis of different obfuscation, encryption, exploits and evasion techniques used in these malicious documents. We have analyzed over one thousand malicious documents from fifty different campaigns for this study. This research paper also lists the different malware samples delivered by these malicious documents and the use of powershell as well as other scripting languages.

Slides Icon
Scroll to Top