Collaborate Disseminate
In diary entry “Houdini is Back Delivered Through a JavaScript Dropper“, Xavier mentions that he had to deal with an obfuscated BASE64 string.
Continue reading Decoding Obfuscated BASE64 Statistically, (Sat, Jun 18th)
Splunk published an advisory about a critical security vulnerability in deployment server, which is a component that comes installed (but not fully used) with every Splunk Enterprise installation. However, due to it being very useful, almost every organization I’ve seen (and I’m a Splunk person really) uses it â which makes this even more dangerous.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 17th, 2022 https://isc.sans.edu/podcastdetail.html?id=8054, (Fri, Jun 17th)
Houdini is a very old RAT that was discovered years ago. The first mention I found back is from 2013! Houdini is a simple remote access tool written in Visual Basic Script. The script is not very interesting because it is non-obfuscated and has just been adapted to use a new C2 server (%%ip:194.5.97.17%%:4040).
Continue reading Houdini is Back Delivered Through a JavaScript Dropper, (Thu, Jun 16th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 16th, 2022 https://isc.sans.edu/podcastdetail.html?id=8052, (Thu, Jun 16th)
This is a bit different than our usual format. Instead of a blog post, we have a video presentation today: Dustin Lee, another SANS.edu undergraduate intern, put together a brief presentation about terraforming honeypots. In particular, Dustin explains how to install our honeypot with different cloud providers.
Continue reading Terraforming Honeypots. Installing DShield Sensors in the Cloud, (Wed, Jun 15th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, June 15th, 2022 https://isc.sans.edu/podcastdetail.html?id=8050, (Wed, Jun 15th)