Collaborate Disseminate
A few days ago, I wrote a diary[1] about a link file that abused the ssh.exe tool present in modern versions of Microsoft Windows. At the end, I mentioned that I will hunt for more SSH-related files/scripts. Guess what? I already found another one.
My last investigation is a file called âAlbertsons_payment.GZâ, received via email. The file looks like an archive but is identified as a picture by TrID:
Continue reading Modiloader From Obfuscated Batch File, (Mon, Dec 23rd)
Christmas is at our doors and Attackers use the holiday season to deliver always more and more gifts into our mailboxes&#;x26;#;x21; I found this interesting file this morning: “christmas&#;x26;#;x5f;slab.pdf.lnk”&#;x26;#;x5b;1&#;x26;#;x5d;. Link files (.lnk) are a classic way to execute something malicious on the victim&#;x26;#;39;s computer but the technique used here is interesting.
Continue reading Christmas “Gift” Delivered Through SSH, (Fri, Dec 20th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, December 20th, 2024 https://isc.sans.edu/podcastdetail/9264, (Fri, Dec 20th)
[This is a Guest Diary by Sahil Shaikh, an ISC intern as part of the SANS.edu BACS program]
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, December 19th, 2024 https://isc.sans.edu/podcastdetail/9262, (Thu, Dec 19th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, December 18th, 2024 https://isc.sans.edu/podcastdetail/9260, (Wed, Dec 18th)
[This is a Guest Diary by James Levija, an ISC intern as part of the SANS.edu Bachelor's Degree in Applied Cybersecurity (BACS) program [1].]
Continue reading [Guest Diary] A Deep Dive into TeamTNT and Spinning YARN, (Wed, Dec 18th)
RATs or âRemote Access Toolsâ are very popular these days. From an attacker’s point of view, it’s a great way to search and exfiltrate interesting data but also to pivot internally in the network. Besides malicious RATs, they are legit tools that are used in many organisations to perform âremote administrationâ. Well-known tools are: VNC, TeamViewer, AnyDesk and much more!
Continue reading Python Delivering AnyDesk Client as RAT, (Tue, Dec 17th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, December 17th, 2024 https://isc.sans.edu/podcastdetail/9258, (Tue, Dec 17th)