Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 30th 2020 https://isc.sans.edu/podcastdetail.html?id=7310, (Wed, Dec 30th)
Back in February, I wrote a diary about a small vulnerability in Windows, which allows users to brute-force names of files in folders, which they don’t have permission to open/list[1]. While thinking on the topic, it occurred to me that a somewhat-complete list of files placed in a folder one can’t access due to lack of permissions might potentially be obtained by scanning the folder with an anti-malware solution, which displays files which are currently being scanned.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 29th 2020 https://isc.sans.edu/podcastdetail.html?id=7308, (Tue, Dec 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, December 28th 2020 https://isc.sans.edu/podcastdetail.html?id=7306, (Mon, Dec 28th)
As promised in diary entry “Corrupt BASE64 Strings: Detection and Decoding“, I explain here how to shift bits with my translate.py tool:
Continue reading Quickie: Bit Shifting With translate.py, (Sun, Dec 27th)
I explained to a friend that my tool base64dump.py, despite its name, does support many other encodings than BASE64. For example, it can detect and decode hexadecimal strings too.
Continue reading base64dump.py Supported Encodings, (Sat, Dec 26th)
Yesterday, Xavier showed how to start analyzing a malicious Word document with my oledump.py tool.
Continue reading Quickie: String Analysis & Maldocs, (Fri, Dec 25th)
Here is an interesting malicious Word document that I spotted yesterday. This time, it does not contain a macro but two embedded objects that the victim must “activate” (click on one of them) to perform the malicious activities. The document (SHA256:ba6cc16770dc67c1af1a3e103c3fd19a854193e7cd1fecbb11ca11c2c47cdf04) has a VT score of 20/62[1]:
Continue reading Malicious Word Document Delivering an Octopus Backdoor, (Thu, Dec 24th)
A couple of weeks ago, I assisted Xavier when he taught FOR610 in (virtual) Frankfurt. Last week, one of our students (Nicklas Keijser) sent us this analysis that we decided to share as a guest diary.
Continue reading Analysis Dridex Dropper, IoC extraction (guest diary), (Wed, Dec 23rd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 23rd 2020 https://isc.sans.edu/podcastdetail.html?id=7304, (Wed, Dec 23rd)