Author Archives: SANS Internet Storm Center, InfoCON: green

TShark (Wireshark&#;x26;#;39;s command-line version) can output JSON data, as shown in diary entry “Quicktip: TShark&#;x26;#;39;s Options -e and -T“.

Continue reading TShark & jq, (Sat, Jan 8th)→

This week I already wrote a diary about “code reuse” in the malware landscape&#;x26;#;x5b;1&#;x26;#;x5d; but attackers also have plenty of tools to generate new samples on the fly. When you received a malicious Word documents, it has not been prepared by hand, it has been for sure automatically generated. Except if you&#;x26;#;39;re a “nice” target for attackers and victim of some kind of “APT”. The keyword here is “automation”. If defenders try to automate as much as possible, attackers too!

Continue reading Custom Python RAT Builder, (Fri, Jan 7th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, January 7th, 2022 https://isc.sans.edu/podcastdetail.html?id=7826, (Fri, Jan 7th)→

This week I found a lot of interesting scripts as this is my fourth diary in a row! I spotted a Python script that targets Chinese people. The script has a very low VT score (2/56) (SHA256:aaec7f4829445c89237694a654a731ee5a52fae9486b1d2bce5767d1ec30c7fb). How attackers can restricts their surface attack to some regions, countries or people?

Continue reading Malicious Python Script Targeting Chinese People, (Thu, Jan 6th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, January 6th, 2022 https://isc.sans.edu/podcastdetail.html?id=7824, (Thu, Jan 6th)→

Code re-use is classic behavior for many developers and this looks legit: Why reinvent the wheel if you can find some pieces of code that do what you are trying to achieve&#;x26;#;x3f; If you publish a nice piece of code on platforms like GitHub, there are chances that your project will be used and sometimes forked by other developers who will add features, fix issues, etc. That&#;x26;#;39;s the magic of the Internet. But attackers are also looking for interesting code to borrow on GitHub. A few weeks ago, I wrote a diary about Excel Add-In&#;x26;#;39;s[1] used to distribute malware.

Continue reading Code Reuse In the Malware Landscape, (Wed, Jan 5th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, January 5th, 2022 https://isc.sans.edu/podcastdetail.html?id=7822, (Wed, Jan 5th)→

I found another script that performs malicious actions. It’s a simple batch file (.bat) that is not obfuscated but it has a very low VT score (1/53). The file hash is cc8ae359b629bc40ec6151ddffae21ec8cbfbcf7ca7bda9b3d9687ca05b1d584. The file is detected by only one antivirus that triggered on the “shutdown.exe” located at the end of the script! Why is this script annoying people? Because it uses the BlockInput() API call through a PowerShell one-liner:

Continue reading A Simple Batch File That Blocks People, (Tue, Jan 4th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, January 4th, 2022 https://isc.sans.edu/podcastdetail.html?id=7820, (Tue, Jan 4th)→

I spotted this interesting phishing campaign that (ab)uses the McAfee antivirus to make people scared. It starts with a classic email that notifies the targeted user that a McAfee subscription expired:

Continue reading McAfee Phishing Campaign with a Nice Fake Scan, (Mon, Jan 3rd)→