Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, November 23rd, 2021 https://isc.sans.edu/podcastdetail.html?id=7768, (Tue, Nov 23rd)
In diary entry “Extra Tip For Triage Of MALWARE Bazaar&#;x26;#;39;s Daily Malware Batches” I shared 2 simple YARA rules to triage Office documents with VBA code.
Continue reading Simple YARA Rules for Office Maldocs, (Mon, Nov 22nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, November 22nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7766, (Mon, Nov 22nd)
Xavier&#;x26;#;39;s diary entry “(Ab)Using Security Tools &#;x26; Controls for the Bad” on PAM, reminded me of a script to backdoor pam_unix.so: linux-pam-backdoor.
These probes appear to be related to a remote code execution (RCE) vulnerability (CVE-2021-36260) impacting Hikvision&#;x26;#;39;s popular Internet of things (IoT) security camera. If exploited by unauthenticated malicious actors, it could lead to full control over targeted devices and possibly internal networks. Shodan statistics have identified over 3.2 million camera on the internet.
At the Internet Storm Center, we like to show how exotic extensions can be used to make victims feel confident to open malicious files. There is &#;x26;#;xc2;&#;x26;#;xa0;an interesting webpage that maintains a list of dangerous extensions used by attackers: filesec.io&#;x26;#;x5b;1&#;x26;#;x5d;. The list is regularly updated&#;x26;#;xc2;&#;x26;#;xa0;and here is an example of malicious file that is currently not listed: “XLL”. It&#;x26;#;39;s not a typo, it&#;x26;#;39;s not a “DLL” but close to!
Continue reading Downloader Disguised as Excel Add-In (XLL), (Fri, Nov 19th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, November 19th, 2021 https://isc.sans.edu/podcastdetail.html?id=7764, (Fri, Nov 19th)
Yesterday I spotted a piece of JavaScript script that delivers Agent Tesla[1]. New waves of this information stealer trojan are regularly spread to victims. PE files are delivered through downloader scripts attached to phishing emails. Those scripts are regularly updated and the one I found yesterday was interesting. The file was delivered as a 7z archive pretending to content a product catalog. Inside the archive, there was a JavaScript called “Product Specification #87305.js” (SHA256:2c15a96371122649e0c47c4e1af2eff14860a7d8fafc6f71267ea5035d5d4201). The file has a current VT score of 15/55[2].
Continue reading JavaScript Downloader Delivers Agent Tesla Trojan, (Thu, Nov 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, November 18th, 2021 https://isc.sans.edu/podcastdetail.html?id=7762, (Thu, Nov 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, November 17th, 2021 https://isc.sans.edu/podcastdetail.html?id=7760, (Wed, Nov 17th)