Author Archives: SANS Internet Storm Center, InfoCON: green

Malware samples have plenty of techniques to detect if they are running in a “safe” environment. By safe, I mean a normal computer with a user between the keyboard and the chair, programs running, etc. These techniques are based on checking the presence of specific processes, registry keys, or files. The hardware can also be a good indicator (are some devices present or not?)

Continue reading Simple Anti-Sandbox Technique: Where’s The Mouse?, (Fri, Feb 23rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, February 23rd, 2024 https://isc.sans.edu/podcastdetail/8866, (Fri, Feb 23rd)→

[UPDATE] As of 11:30am ET, AT&T states that about 75% of its network is operational, and they are recovering the rest. Several news sources noted that Verizon and T-Mobile may also have outages. This is likely due to a misinterpretation of “Downdetector”, a website monitoring various websites for user complaints about outages. Other carriers are also often mentioned, leading to them showing up in Downdetector. For example, Apple Support is also showing problems, according to Downdetector. This may likely be due to AT&T customers calling Apple, suspecting the phone is broken after being unable to connect to the cellular network. Some 911 systems are reporting increased call volume due to the outage.

Continue reading Large AT&T Wireless Network Outage #att #outage, (Thu, Feb 22nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, February 22nd, 2024 https://isc.sans.edu/podcastdetail/8866, (Thu, Feb 22nd)→

[This is a Guest Diary by Rachel Downs, an ISC intern as part of the SANS.edu Bachelor's Degree in Applied Cybersecurity (BACS) program [1].

Continue reading [Guest Diary] Friend, foe or something in between? The grey area of ‘security research’, (Thu, Feb 22nd)→

The Internet Archive is a well-known and much-admired institution, devoted to creating a “digital library of Internet sites and other cultural artifacts in digital form”[1]. On its “WayBackMachine” website, which is hosted on https://archive.org/, one can view archived historical web pages from as far back as 1996. The Internet Archive basically functions as a memory for the web, and currently holds over 800 billion web pages as well as millions of books, audio and video recordings and other content… Unfortunately, since it allows for uploading of files by users, it is also used by threat actors to host malicious content from time to time[2,3].

Continue reading Phishing pages hosted on archive.org, (Wed, Feb 21st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 21st, 2024 https://isc.sans.edu/podcastdetail/8864, (Wed, Feb 21st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, February 21st, 2024 https://isc.sans.edu/podcastdetail/8862, (Wed, Feb 21st)→

Infostealers written in Python are not new. They also onboard a lot of sandbox detection mechanisms to prevent being executed (and probably detected) by automatic analysis. Last week, I found one that uses the same approach but in a different way. Usually, the scripts have a list of “bad stuff” to check like MAC addresses, usernames, processes, etc. These are common ways to detect simple sandboxes that are not well-hardened. This time, the “IOD” (Indicators Of Detection) list is stored online on a Pastebin-like site, allowing the indicators to be updated for all scripts already deployed. It&#;x26;#;39;s also a way to disclose less interesting information in the script.

Continue reading Python InfoStealer With Dynamic Sandbox Detection, (Tue, Feb 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, February 20th, 2024 https://isc.sans.edu/podcastdetail/8860, (Tue, Feb 20th)→