Python Obfuscation for Dummies, (Tue, Oct 18th)
Recently, I found several malicious Python scripts that looked the same. They all contained the same strings at the end:
Continue reading Python Obfuscation for Dummies, (Tue, Oct 18th)
Author Archives: SANS Internet Storm Center, InfoCON: green
ISC Stormcast For Tuesday, October 18th, 2022 https://isc.sans.edu/podcastdetail.html?id=8218, (Tue, Oct 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, October 18th, 2022 https://isc.sans.edu/podcastdetail.html?id=8218, (Tue, Oct 18th)
Fileless Powershell Dropper, (Mon, Oct 17th)
I found an interesting Powershell script that drops a malware on the victim&#;x26;#;39;s computer. The dropped malware is not new (It&#;x26;#;39;s kinda old, though) but the dropper has a very low Virustotal score. The script was detected by one of my hunting rules on VT. It is called “autopowershell.ps1” and has only a score of 3/61 (SHA256:3750576978bfd204c5ac42ee70fb5c21841899878bacc37151370d23e750f8c4)[1]. By “fileless”, it means that the malware tries to reduce at the minimum interactions with the file system. But, to achieve persistence, it must write something on the disk. Most of the time, it&#;x26;#;39;s done through registry keys. That&#;x26;#;39;s what happens with this sample:
Continue reading Fileless Powershell Dropper, (Mon, Oct 17th)
ISC Stormcast For Monday, October 17th, 2022 https://isc.sans.edu/podcastdetail.html?id=8216, (Mon, Oct 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, October 17th, 2022 https://isc.sans.edu/podcastdetail.html?id=8216, (Mon, Oct 17th)
Video: Analysis of a Malicious HTML File (QBot), (Sun, Oct 16th)
Malware – Covid Vaccination Supplier Declaration, (Sat, Oct 15th)
This week&#;x26;#;39;s email is all about Covid for all suppliers to declare their vaccination status, but the date is almost 1 year old.
Continue reading Malware – Covid Vaccination Supplier Declaration, (Sat, Oct 15th)
ISC Stormcast For Friday, October 14th, 2022 https://isc.sans.edu/podcastdetail.html?id=8214, (Fri, Oct 14th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, October 14th, 2022 https://isc.sans.edu/podcastdetail.html?id=8214, (Fri, Oct 14th)
Analysis of a Malicious HTML File (QBot), (Thu, Oct 13th)
Reader Eric submitted a malicious HTML page that contains BASE64 images with malware.
Continue reading Analysis of a Malicious HTML File (QBot), (Thu, Oct 13th)
ISC Stormcast For Thursday, October 13th, 2022 https://isc.sans.edu/podcastdetail.html?id=8212, (Thu, Oct 13th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, October 13th, 2022 https://isc.sans.edu/podcastdetail.html?id=8212, (Thu, Oct 13th)
Scans for old Fortigate Vulnerability: Building Target Lists?, (Wed, Oct 12th)
This last few days, I saw a few requests associated with an older Fortigate vulnerability hitting our honeypots:
Continue reading Scans for old Fortigate Vulnerability: Building Target Lists?, (Wed, Oct 12th)