Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 8th 2020 https://isc.sans.edu/podcastdetail.html?id=7156, (Tue, Sep 8th)
A reader asked if a particular Emotet sample was a malformed ZIP file. It is not, and I will explain why you might think it is in this diary entry.
Continue reading Office: About OLE and ZIP Files, (Mon, Sep 7th)
While going over what my e-mail malware quarantine caught during this week, I found a message which made me feel rather nostalgic. Among the usual maldocs, ZIPs and ACEs, there was also an e mail carrying an XXE file in its attachment.
Continue reading A blast from the past – XXEncoded VB6.0 Trojan, (Fri, Sep 4th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, September 4th 2020 https://isc.sans.edu/podcastdetail.html?id=7154, (Fri, Sep 4th)
I&#;x26;#;39;m still hunting for interesting (read: “malicious”) Python samples. By reading my previous diaries, you know that I like to find how attackers implement obfuscation and evasion techniques. Like yesterday, I found a Python sample that creates a thread to run a malicious shellcode[1]. But before processing the shellcode, it performs suspicious network traffic:
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, September 3rd 2020 https://isc.sans.edu/podcastdetail.html?id=7152, (Thu, Sep 3rd)
The Windows API is full of calls that are usually good indicators to guess the behavior of a script. In a previous diary, I wrote about some examples of “API call groups” that are clearly used together to achieve malicious activities&#;x26;#;x5b;1&#;x26;#;x5d;. If it is often used in PowerShell scripts, here is an interesting sample in Python that uses the same technique. It calls directly Windows API though &#;x26;#;39;ctypes&#;x26;#;39;.
Continue reading Python and Risky Windows API Calls, (Wed, Sep 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, September 2nd 2020 https://isc.sans.edu/podcastdetail.html?id=7150, (Wed, Sep 2nd)
LDAP, like many UDP based protocols, has the ability to send responses that are larger than the request. With UDP not requiring any handshake before data is sent, these protocols make ideal amplifiers for reflective distributed denial of service attacks. Most commonly, these attacks abuse DNS and we have talked about this in the past. But LDAP is another protocol that is often abused.
Continue reading Exposed Windows Domain Controllers Used in CLDAP DDoS Attacks, (Tue, Sep 1st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, September 1st 2020 https://isc.sans.edu/podcastdetail.html?id=7148, (Tue, Sep 1st)