Collaborate Disseminate
Phishing campaigns are a real plague on the Internet. Every day our mailboxes are flooded via fake emails pretending to be from common online services like Paypal, DHL, Netflix, and many more. Microsoft Office365 is also a good candidate for phishing campaigns.
Continue reading Nicely Crafted indeed.com Login Page, (Thu, Dec 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, December 23rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7808, (Thu, Dec 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7806, (Wed, Dec 22nd)
Last week, I published&#;x26;#;xc2;&#;x26;#;xa0;a diary&#;x26;#;x5b;1&#;x26;#;x5d; about a PowerShell backdoor running below the radar with a VT score of 0&#;x26;#;x21; This time,&#;x26;#;xc2;&#;x26;#;xa0;it&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;s a dropper with multiple obfuscation techniques in place. It is also important&#;x26;#;xc2;&#;x26;#;xa0;to mention that&#;x26;#;xc2;&#;x26;#;xa0;the injection technique used is&#;x26;#;xc2;&#;x26;#;xa0;similar to Jan&#;x26;#;39;s diary posted yesterday&#;x26;#;x5b;2&#;x26;#;x5d; but I decided to review it because it has, here&#;x26;#;xc2;&#;x26;#;xa0;again, a null VT store&#;x26;#;x5b;3&#;x26;#;x5d;&#;x26;#;x21;
Continue reading More Undetected PowerShell Dropper, (Tue, Dec 21st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 21st, 2021 https://isc.sans.edu/podcastdetail.html?id=7804, (Tue, Dec 21st)
Since any Office document that may contains macros can potentially be used by malware authors with similar result as the usual Excel spreadsheet with macros, threat actors have most probably utilized all of the available macro-enabled Office formats for attacks at some point. However, since most users would probably view PowerPoint slideshow asking them to enable macros with a not insignificant level suspicion, most attackers tend not to use any of PowerPoint file formats at all.
Continue reading PowerPoint attachments, Agent Tesla and code reuse in malware, (Mon, Dec 20th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 20th, 2021 https://isc.sans.edu/podcastdetail.html?id=7802, (Mon, Dec 20th)
2 years ago, in diary entry “VBA Office Document: Which Version?“, I listed all internal VBA project version numbers for the Office versions I had access to.
Continue reading Office 2021: VBA Project Version, (Sun, Dec 19th)
———–
Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu