Collaborate Disseminate
For modern malware, having access to its C2 (Command and control) is a crucial point. There are many ways to connect to a C2 server using tons of protocols, but today, HTTP remains very common because HTTP is allowed on most networks…
Continue reading Python Malware Using Postgresql for C2 Communications, (Fri, Aug 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, August 25th, 2023 https://isc.sans.edu/podcastdetail/8632, (Fri, Aug 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, August 24th, 2023 https://isc.sans.edu/podcastdetail/8630, (Thu, Aug 24th)
[This is a Guest Diary by John Grant, an ISC intern as part of the SANS.edu BACS program]
Excel is an excellent target for attackers. The Microsoft Office suite is installed on millions of computers, and people trust these files. If we have the classic xls, xls, xlsm file extensions, Excel supports many others! Just check your local registry:
Continue reading More Exotic Excel Files Dropping AgentTesla, (Wed, Aug 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, August 23rd, 2023 https://isc.sans.edu/podcastdetail/8628, (Wed, Aug 23rd)
In cryptography, there is a gold rule that states to not develop your own algorithm because… it will be probably weak and broken! They are strong algorithms (like AES) that do a great job so why reinvent the wheel? However, there are projects that try to develop new algorithms. One of them is Fernet[1], described like this:
Continue reading Have You Ever Heard of the Fernet Encryption Algorithm?, (Tue, Aug 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 22nd, 2023 https://isc.sans.edu/podcastdetail/8626, (Tue, Aug 22nd)
When you handle a lot of malicious files, you must have a process and tools in place to speedup the analysis. It&#;x26;#;39;s impossible to investigate all files and a key point is to find interesting files that deserve more attention. In my malware analysis lab, I use a repository called my “Malware Zoo” where I put all the files. This repository is shared across different hosts (my computer, REMnux and Windows virtual machines). This helps me to keep all the “dangerous files” in a central location and avoid spreading dangerous stuff everywhere. When you analyze a malware, you&#;x26;#;39;ll quickly generate more files: You extract shellcodes, configurations, DLLs, more executables and those files should also be analyzed. To perform a quick triage with basic operations, I rely on the Inotify[1] suite.
Continue reading Quick Malware Triage With Inotify Tools, (Mon, Aug 21st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, August 21st, 2023 https://isc.sans.edu/podcastdetail/8624, (Mon, Aug 21st)