Author Archives: SANS Internet Storm Center, InfoCON: green

When you have to deal with malware in your day job, for research purposes, or just for fun, one of the key points is to have a lab ready to be launched. Your sandbox must be properly protected and isolated to detonate your samples in a safe way but it must also be fulfilled with tools, and scripts.&#;x26;#;xc2;&#;x26;#;xa0;This toolbox is yours and will be based on your preferred tools but starting from zero is hard, that&#;x26;#;39;s why there are specific Linux distributions built for this purpose. The one that I use in FOR610 and for my daily investigations is REMnux[1], created and maintained by Lenny Zeltser[2]. This environment offers tons of tools that help to perform all the malware analysis steps from static analysis up to code reversing and debugging.

Continue reading FLOSS 2.0 Has Been Released, (Thu, Jun 23rd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 23rd, 2022 https://isc.sans.edu/podcastdetail.html?id=8062, (Thu, Jun 23rd)→

While hunting, I found an interesting PowerShell script. After a quick check, my first conclusion was that it is again a simple info stealer. After reading the code more carefully, the conclusion was different: It targets crypto-currency browser apps or extensions. The script has a very low score on VT: 1/53[1].

Continue reading Malicious PowerShell Targeting Cryptocurrency Browser Extensions, (Wed, Jun 22nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 22nd, 2022 https://isc.sans.edu/podcastdetail.html?id=8060, (Wed, Jun 22nd)→

One of our goals is to provide data to “color your logs” (or “Augment” them, as vendors may say). I have been experimenting with various ways to get simplified access to “domain age” data for a while now. This means not just data about new domains but how old a particular domain is. It may be an interesting parameter to add to when investigating.

Continue reading Experimental New Domain / Domain Age API, (Tue, Jun 21st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, June 21st, 2022 https://isc.sans.edu/podcastdetail.html?id=8058, (Tue, Jun 21st)→

TCP Fast Open (TFO) is a relatively new TCP feature. The corresponding RFC7413 was published in 2014 and labeled “Experimental” [1]. The feature has been showing up in browsers and operating systems in the last couple of years. In particular, together with TLS 1.3, it can significantly decrease the time it takes to set up a connection.

Continue reading Odd TCP Fast Open Packets. Anybody understands why?, (Mon, Jun 20th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 20th, 2022 https://isc.sans.edu/podcastdetail.html?id=8056, (Mon, Jun 20th)→

I recorded a video for my diary entry “Decoding Obfuscated BASE64 Statistically “.

Continue reading Video: Decoding Obfuscated BASE64 Statistically, (Sun, Jun 19th)→

Wireshark version 3.6.6 was released.

Continue reading Wireshark 3.6.6 Released, (Sun, Jun 19th)→