Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 9th, 2021 https://isc.sans.edu/podcastdetail.html?id=7450, (Fri, Apr 9th)
If some ransomware families are based on PE files with complex features, it&#;x26;#;39;s easy to write quick-and-dirty ransomware in other languages like Powershell. I found this sample while hunting. I&#;x26;#;39;m pretty confident that this script is a proof-of-concept or still under development because it does not contain all the required components and includes some debugging information.
Continue reading Simple Powershell Ransomware Creating a 7Z Archive of your Files, (Thu, Apr 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 8th, 2021 https://isc.sans.edu/podcastdetail.html?id=7448, (Thu, Apr 8th)
I recently came across “nzyme” [1], a WiFi Intrusion Detection System (IDS). Nzyme does focus on WiFi-specific attacks, so it does not care about payload but inspects the 802.11 headers that escape traditional, wired IDSs. It was not terribly hard to get it running on a Raspberry Pi using a Panda USB WiFi adapter.
Continue reading WiFi IDS and Private MAC Addresses, (Wed, Apr 7th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, April 7th, 2021 https://isc.sans.edu/podcastdetail.html?id=7446, (Wed, Apr 7th)
Couple of weeks ago, my phishing/spam trap caught an interesting e-mail carrying what turned out to be a sample of the Lokibot Infostealer.
At first glance, the e-mail appeared to be a run of the mill malspam message.
Continue reading Malspam with Lokibot vs. Outlook and RFCs, (Tue, Apr 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, April 6th, 2021 https://isc.sans.edu/podcastdetail.html?id=7444, (Tue, Apr 6th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, April 5th, 2021 https://isc.sans.edu/podcastdetail.html?id=7442, (Mon, Apr 5th)
When processing the result of “unzip” in CyberChef, for example with YARA rules, all files contained inside the ZIP file, are concatenated together.
In diary entry “YARA and CyberChef“, I explain how to use YARA rules together with CyberChef.