Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 29th, 2022 https://isc.sans.edu/podcastdetail.html?id=8068, (Wed, Jun 29th)
HiBy is a brand of portable music players built around the Android operating system. Probably a bit comparable to the now-defunct iPod touch, the device does use a close to “stock” version of Android and adds its own “HiByMusic” application as a music player. The hardware includes a Snapdragon ARM CPU standard on Android devices and attempts to distinguish itself with DACs claimed to be better than those found in other devices.
Continue reading Possible Scans for HiByMusic Devices, (Tue, Jun 28th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 28th, 2022 https://isc.sans.edu/podcastdetail.html?id=8066, (Tue, Jun 28th)
The first payload sent by a TLS client to a TLS server is a “Client Hello.” It includes several parameters supported by the client, such as available cipher suites, to start negotiating a compatible set of TLS parameters with the server.
Continue reading Encrypted Client Hello: Anybody Using it Yet?, (Mon, Jun 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 27th, 2022 https://isc.sans.edu/podcastdetail.html?id=8064, (Mon, Jun 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 27th, 2022 https://isc.sans.edu/podcastdetail.html?id=8064, (Mon, Jun 27th)
The clip command that Xavier mentions is not only used by malware authors. I often use it, to copy the output of a command-line to the clipboard and then paste it inside a GUI application, like an hexadecimal editor.
I received several reactions to my diary entry “Decoding Obfuscated BASE64 Statistically” and accompanying video.
Another day, another malicious script was found! Today, the script is a Windows bat file that executes malicious PowerShell code but the way it works is interesting. The script has a VT score of 16/54 ( )[1]. The script uses the Windows command-line tool “clip.exe” which is often unknown to people:
Continue reading Malicious Code Passed to PowerShell via the Clipboard, (Sat, Jun 25th)
A quick diary to wrap-up the week with a nice Python script that interacts with the victim. Most malicious scripts try to remain below the radar to perform their nasty tasks. I found a Python script that has some interesting features. The file has a VT score of 10/55 (SHA256:e21f6c09fb1658397d0996751f4c79114f50a0853668227c1c589fb716b31603)[1]. The core feature is this script is to implement a keylogger but it has interesting capabilities.
Continue reading Python (ab)using The Windows GUI, (Fri, Jun 24th)