Collaborate Disseminate
Yesterday, Apple released patches across all of its operating systems. A standalone patch for Safari was released to address WebKit problems in older macOS versions. Apple does not provide CVSS scores or severity ratings. The ratings below are based on my reading of the impact. However, the information isn’t always sufficient to accurately assign a rating.
Continue reading Apple Patches Everything. July 2024 Edition, (Tue, Jul 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, July 30th, 2024 https://isc.sans.edu/podcastdetail/9074, (Tue, Jul 30th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, July 29th, 2024 https://isc.sans.edu/podcastdetail/9072, (Mon, Jul 29th)
I found a malicious Word document with VBA code using the CrowdStrike outage for social engineering purposes. It&#;x26;#;39;s an .ASD file (AutoRecover file). My tool oledump.py can analyze it:
Continue reading CrowdStrike Outage Themed Maldoc, (Mon, Jul 29th)
When Johannes talked about my diary entry “Protected OOXML Spreadsheets” on his StormCast podcast, he mentioned that I privately shared data on the power consumption of my desktop with a NVIDIA GeForce RTX 3080 GPU when running Hashcat.
Continue reading Quickie: Password Cracking & Energy, (Sun, Jul 28th)
With all the Blue Screen Of Death screenshots we saw lately, I got the idea to write about Sysinternals&#;x26;#;39; tool NotMyFault.
Continue reading Create Your Own BSOD: NotMyFault, (Sat, Jul 27th)
Some simple PowerShell scripts might deliver nasty content if executed by the target. I found a very simple one (with a low VT score of 8/65):
Continue reading ExelaStealer Delivered “From Russia With Love”, (Fri, Jul 26th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, July 26th, 2024 https://isc.sans.edu/podcastdetail/9070, (Fri, Jul 26th)
XWorm is not a brand-new malware family&#;x26;#;x5b;1&#;x26;#;x5d;. It&#;x26;#;39;s a common RAT (Remote Access Tool) re-use regularly in new campaigns. Yesterday, I found a sample that behaves like a dropper and runs the malware using the Process Hollowing technique&#;x26;#;x5b;2&#;x26;#;x5d;. The sample is called “@Norman_is_back_RPE_v1.exe” (SHA256: dc406d626a9aac5bb918abf0799fa91ba6239fc426324fd8c063cc0fcb3b5428). It&#;x26;#;39;s a .Net executable that is, strangely, not obfuscated. It&#;x26;#;39;s possible to disassemble it with ilspycmd:
Continue reading XWorm Hidden With Process Hollowing, (Thu, Jul 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, July 25th, 2024 https://isc.sans.edu/podcastdetail/9068, (Thu, Jul 25th)