SANS Internet Storm Center, InfoCON: green – Page 315

Spotting the Red Team on VirusTotal!, (Sat, Mar 6th)

Posted on March 6, 2021 by SANS Internet Storm Center, InfoCON: green

Many security researchers&#;x26;#;xc2;&#;x26;#;xa0;like to use the&#;x26;#;xc2;&#;x26;#;xa0;VirusTotal platform. The provided services are amazing: You can immediately have a clear overview of the dangerousness level of a file but…&#;x26;#;xc2;&#;x26;#;xa0;VirusTotal remains a cloud service.&#;x26;#;xc2;&#;x26;#;xa0;It means that, once you uploaded a file to scan it, you have to consider it as “lost” and available to a lot of (good or bad) people&#;x26;#;x21; In the SANS FOR610 training (“Reverse Engineering&#;x26;#;xc2;&#;x26;#;xa0;Malware”), we insist on the fact that you should avoid uploading a file to VT&#;x26;#;x21; &#;x26;#;xc2;&#;x26;#;xa0;The best practice is to compute the file hash then&#;x26;#;xc2;&#;x26;#;xa0;search for it to see if someone else already uploaded the same sample. If you&#;x26;#;39;re the first to upload a file, its creator can be notified about the upload and learn that he has been detected. Don&#;x26;#;39;t be fooled: attackers have also access to VirusTotal and monitor activity around their malware&#;x26;#;x21; Note that I mention VirusTotal because it is very popular but is not the only service providing repositories of malicious files, they are plenty of alternative services to scan and store malicious files.

Continue reading Spotting the Red Team on VirusTotal!, (Sat, Mar 6th)→

ISC Stormcast For Friday, March 5th, 2021 https://isc.sans.edu/podcastdetail.html?id=7400, (Fri, Mar 5th)

Posted on March 5, 2021 by SANS Internet Storm Center, InfoCON: green

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, March 5th, 2021 https://isc.sans.edu/podcastdetail.html?id=7400, (Fri, Mar 5th)→

Spam Farm Spotted in the Wild, (Fri, Mar 5th)

Posted on March 5, 2021 by SANS Internet Storm Center, InfoCON: green

If there is a place where you can always find juicy information, it&#;x26;#;39;s your spam folder! Yes, I like spam and I don&#;x26;#;39;t delete my spam before having a look at it for hunting purposes. Besides emails flagged as spam, NDR or “Non-Delivery Receipt” messages also deserve some attention. One of our readers (thanks to him!) reported yesterday how he found a “spam farm” based on bounced emails. By default, SMTP is a completely open protocol. Everybody can send an email pretending to be Elon Musk or Joe Biden! That&#;x26;#;39;s why security control like SPF[1] or DKIM[2] can be implemented to prevent spoofed emails to be sent from anywhere. If not these controls are not implemented, you may be the victim of spam campaigns that abuse your domain name or identity. The “good” point (if we can say this) is that all NDR messages will bounce to the official mail server that you manage. That&#;x26;#;39;s what happened with our reader, he saw many bounced messages for unknown email addresses. Here is an example:

Continue reading Spam Farm Spotted in the Wild, (Fri, Mar 5th)→

From VBS, PowerShell, C Sharp, Process Hollowing to RAT, (Thu, Mar 4th)

Posted on March 4, 2021 by SANS Internet Storm Center, InfoCON: green

VBS files are interesting to deliver malicious content to a victim&#;x26;#;39;s computer because they look like simple text files. I found an interesting sample that behaves like a dropper. But it looks also like Russian dolls seeing all the techniques used to drop a RAT at the end. The file hash is 8697dc74d7c07583f24488926fc6e117975f8a9f014972073d19a5e62d248ead and has a VT score of 12/59[1]. It was delivered by email under the name “Procurement – Attached RFQ 202102.vbs”. If you filter attachments based on the MIME type, this file won&#;x26;#;39;t be detected as suspicious:

Continue reading From VBS, PowerShell, C Sharp, Process Hollowing to RAT, (Thu, Mar 4th)→