Collaborate Disseminate
An intresting phishing run started over the weekend. At first glance it looks pretty typical…a clumsy email with an attachment with some vital and useful information. Although I have already seen several different message bodies, this is one sample:
— Rick Wanner MSISE – rwanner at isc dot sans dot edu – http://namedeplume.blogspot.com/ – Twitter:namedeplume (Protected)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, June 15th 2020 https://isc.sans.edu/podcastdetail.html?id=7038, (Mon, Jun 15th)
Since YARA version 4.0.0, Victor added support for detecting BASE64 encoded strings.
This past week, I noticed new activity from the Mirai botnet in my honeypot. The sample log with the IP and file associated with the first log appears to have been taken down (96.30.193.26) which appeared multiple times this week including today. However, the last two logs from today are still active which is using a Bash script to download multiple exploits targeting various device types (MIPS, ARM4-7, MPSL, x86, PPC, M68k). Something else of interest is the User-Agent: XTC and the name viktor which appear to be linked to XTC IRC Botnet, aka Hoaxcalls.
Macros in Office documents are so common today that my honeypots and hunting scripts catch a lot of them daily. I try to keep an eye on them because sometimes you can spot an interesting one (read: “using a less common techniqueâ€). Yesterday, I found such a sample that deserve a quick diary!
Continue reading Malicious Excel Delivering Fileless Payload, (Fri, Jun 12th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, June 12th 2020 https://isc.sans.edu/podcastdetail.html?id=7036, (Fri, Jun 12th)
For developers who write malicious programs, itâ;€;™;s important to make their code not easy to be read and executed in a sandbox. Like most languages, there are many ways to make the life of malware analysts mode difficult (or more exciting, depending on the side of the table youâ;€;™;re sitting ;-).
Continue reading Anti-Debugging JavaScript Techniques, (Thu, Jun 11th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, June 11th 2020 https://isc.sans.edu/podcastdetail.html?id=7034, (Thu, Jun 11th)