Author Archives: SANS Internet Storm Center, InfoCON: green

In my last diary[1], I mentioned that I was able to access screenshots exfiltrated by the malware sample. During the first analysis, there were approximately 460 JPEG files available. I continued to keep an eye on the host and the number slightly increased but not so much. My diary conclusion was that the malware looks popular seeing the number of screenshots but wait… Are we sure that all those screenshots are real victims? I executed the malware in my sandbox and probably other automated analysis tools were used to detonate the malware in a sandbox. This question popped up in my mind: How do have an idea about the ratio of automated tools VS. real victims?

Continue reading C2 Activity: Sandboxes or Real Victims?, (Fri, Apr 2nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, April 2nd, 2021 https://isc.sans.edu/podcastdetail.html?id=7440, (Fri, Apr 2nd)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, April 1st, 2021 https://isc.sans.edu/podcastdetail.html?id=7438, (Thu, Apr 1st)→

2021-04-01 21:41 UTC – UPDATE: The domain for the AD environment used in this quiz has been changed to clockwater.net. We will still accept the original domain listed in the answers from any of the submissions. We already have 10 submission as I write this. Thanks to everyone who has participated or will still take part in this quiz!

Continue reading April 2021 Forensic Quiz, (Thu, Apr 1st)→

This morning, an interesting phishing email landed in my spam trap. The mail was redacted in Spanish and, as usual, asked the recipient to urgently process the attached document. The filename was “AVISO.001” (This extension is used by multi-volume archives). The archive contained a PE file with a very long name: AVISO11504122921827776385010767000154304736120425314155656824545860211706529881523930427.exe (SHA256:ff834f404b977a475ef56f1fa81cf91f0ac7e07b8d44e0c224861a3287f47c8c). The file is unknown on VT at this time so I did a quick analysis.

Continue reading Quick Analysis of a Modular InfoStealer, (Wed, Mar 31st)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, March 31st, 2021 https://isc.sans.edu/podcastdetail.html?id=7436, (Wed, Mar 31st)→

With the recent official deprecation of TLS 1.0 and TLS 1.1 by RFC 8996[1], a step, which has long been in preparation and which was preceded by many recommendations to discontinue the use of both protocols (as well as by the removal of support for them from all mainstream web browsers[2]), one might assume that the use of old TLS versions on the internet would have significantly decreased over the last few months. This has however not been the case.

Continue reading Old TLS versions – gone, but not forgotten… well, not really “gone” either, (Tue, Mar 30th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, March 30th, 2021 https://isc.sans.edu/podcastdetail.html?id=7434, (Tue, Mar 30th)→

Malware analysis is exciting because you never know what you will find.&#;x26;#;xc2;&#;x26;#;xa0;In previous diaries&#;x26;#;x5b;1&#;x26;#;x5d;, I already explained why it&#;x26;#;39;s important to have a look at groups of interesting Windows API call to detect some behaviors. The classic example is code injection. Usually, it is based on something like this:

Continue reading Jumping into Shellcode, (Mon, Mar 29th)→

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, March 29th, 2021 https://isc.sans.edu/podcastdetail.html?id=7432, (Mon, Mar 29th)→