Collaborate Disseminate
In the past, I already found some script-based ransomware samples written in Python or Powershell[1]. The last one I found was only a âproof-of-conceptâ (my guess) but it demonstrates how easy such malware can be developed and how they remain undetected by most antivirus products.
Continue reading Another Script-Based Ransomware, (Wed, Nov 9th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, November 9th, 2022 https://isc.sans.edu/podcastdetail.html?id=8250, (Wed, Nov 9th)
This month we got patches for 68 vulnerabilities. Of these, 10 are critical, 1 was previously disclosed, and 4 are already being exploited, according to Microsoft.
Continue reading Microsoft November 2022 Patch Tuesday, (Tue, Nov 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, November 8th, 2022 https://isc.sans.edu/podcastdetail.html?id=8248, (Tue, Nov 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, November 8th, 2022 https://isc.sans.edu/podcastdetail.html?id=8248, (Tue, Nov 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, November 7th, 2022 https://isc.sans.edu/podcastdetail.html?id=8246, (Mon, Nov 7th)
A reader asked for help with this maldoc. Not with the analysis itself, but how to understand where the URL is pointing to.
Continue reading IPv4 Address Representations, (Sun, Nov 6th)
Windows 10 supports various virtual drives natively and can recognize and use ISO, VHD and VHDX files. The file included as an attachment with this email, when extracted appears in the email as a PDF but is is in fact a VHD file.
Continue reading Windows Malware with VHD Extension, (Sat, Nov 5th)
I spotted a malicious RAR archive that contained a VBS script. It was called âUnidad judicial citacion pendiente Fiscalia.rarâ and protected with a simple 4-numbers password to defeat automatic scanning. Inside, the VBS script has the same name. Both are unknown to VT.
Continue reading Remcos Downloader with Unicode Obfuscation, (Fri, Nov 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, November 4th, 2022 https://isc.sans.edu/podcastdetail.html?id=8244, (Fri, Nov 4th)