Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, August 20th 2020 https://isc.sans.edu/podcastdetail.html?id=7132, (Thu, Aug 20th)
Qakbot&#;x26;#;x5b;1&#;x26;#;x5d; is back on stage at the moment&#;x26;#;x21;&#;x26;#;xc2;&#;x26;#;xa0;Many security companies already reported some peaks of activity around this malware. On my side,&#;x26;#;xc2;&#;x26;#;xa0;I also spotted several samples. The&#;x26;#;xc2;&#;x26;#;xa0;one that I&#;x26;#;39;ll cover today&#;x26;#;xc2;&#;x26;#;xa0;has been reported by one of our readers (thanks to him) and deserves a quick analysis of the obfuscation used by the attackers. It is not available on VT at this time (SHA256:507312fe58352d75db057aee454dafcdce2cdac59c0317255e30a43bfa5dffbc)
Continue reading Example of Word Document Delivering Qakbot, (Wed, Aug 19th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, August 19th 2020 https://isc.sans.edu/podcastdetail.html?id=7130, (Wed, Aug 19th)
For a few days, I&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;m keeping an eye on suspicious Python code posted on VT. We all know that VBA, JavaScript, Powershell, etc are&#;x26;#;xc2;&#;x26;#;xa0;attacker&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;s best friends but Python is also a good candidate to perform malicious activities on a computer. Even if Python isn&#;x26;#;39;t installed by default, it&#;x26;#;xe2;&#;x26;#;x80;&#;x26;#;x99;s easy to &#;x26;#;xe2;&#;x26;#;x80;compile&#;x26;#;xe2;&#;x26;#;x80; a Python script to make it portable via a PE file. There exists multiple tools to achieve this, my favorite being &#;x26;#;39;pyinstaller&#;x26;#;39;:
Continue reading Using API’s to Track Attackers, (Tue, Aug 18th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, August 18th 2020 https://isc.sans.edu/podcastdetail.html?id=7128, (Tue, Aug 18th)
This morning at the ISC was a bit more interesting than usual. As I was skimming through the emails I found the usual great submissions from readers, but what got my attention was an email from Iztok, and others, indicating that the ISC was inaccessible because the ISC site was placed on a blocklist by Cisco Talos.
Over the weekend the Canada Revenue Agency (CRA), the Canadian equivalent of the U.S. IRS, shut down their online accounts due to account compromises which began at least a couple of weeks. Once the bad guys had access to the accounts they would change the users email address and banking information and attempt to apply for or redirect COVID-19 benefits.
Continue reading Password Reuse Strikes Again!, (Mon, Aug 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, August 17th 2020 https://isc.sans.edu/podcastdetail.html?id=7126, (Mon, Aug 17th)
In the solution I presented last weekend for “Small Challenge: A Simple Word Maldoc“, I forgot to address one point when converting and decoding the numbers in the VBA code with my tool numbers-to-string.py, you can see it here:
Continue reading Small Challenge: A Simple Word Maldoc – Part 3, (Sun, Aug 16th)
Wireshark version 3.2.6 was released.