Author Archives: Xavier

[SANS ISC] The Crypto Miners Fight For CPU Cycles

Posted on by

I published the following diary on isc.sans.org: “The Crypto Miners Fight For CPU Cycles“: I found an interesting piece of Powershell code yesterday. The purpose is to download and execute a crypto miner but the code also implements a detection mechanism to find other miners, security tools or greedy processes

[The post [SANS ISC] The Crypto Miners Fight For CPU Cycles has been first published on /dev/random]

Continue reading [SANS ISC] The Crypto Miners Fight For CPU Cycles→

[SANS ISC] Reminder: Beware of the “Cloud”

Posted on by

I published the following diary on isc.sans.org: “Beware of the “Cloud”“: Today, when you buy a product, there are chances that it will be “connected” and use cloud services for, at least, one of its features. I’d like to tell you a bad story that I had this week. Just

[The post [SANS ISC] Reminder: Beware of the “Cloud” has been first published on /dev/random]

Continue reading [SANS ISC] Reminder: Beware of the “Cloud”→

[SANS ISC] Common Patterns Used in Phishing Campaigns Files

Posted on by

I published the following diary on isc.sans.org: “Common Patterns Used in Phishing Campaigns Files“: Phishing campaigns remain a common way to infect computers. Every day, I’m receiving plenty of malicious documents pretending to be sent from banks, suppliers, major Internet actors, etc. All those emails and their payloads are indexed

[The post [SANS ISC] Common Patterns Used in Phishing Campaigns Files has been first published on /dev/random]

Continue reading [SANS ISC] Common Patterns Used in Phishing Campaigns Files→

[SANS ISC] Malware Delivered via Windows Installer Files

Posted on by

I published the following diary on isc.sans.org: “Malware Delivered via Windows Installer Files“: For some days, I collected a few samples of malicious MSI files. MSI files are Windows installer files that users can execute to install software on a Microsoft Windows system. Of course, you can replace “software” with “malware”. MSI

[The post [SANS ISC] Malware Delivered via Windows Installer Files has been first published on /dev/random]

Continue reading [SANS ISC] Malware Delivered via Windows Installer Files→

Imap2TheHive: Support of Attachments

Posted on by

I just published a quick update of my imap2thehive tool. Files attached to an email can now be processed and uploaded as an observable attached to a case. It is possible to specify which MIME types to process via the configuration file. The example below will process PDF & EML

[The post Imap2TheHive: Support of Attachments has been first published on /dev/random]

Continue reading Imap2TheHive: Support of Attachments→

Viper and ReversingLabs A1000 Integration

Posted on by

A quick blog post about a module that I wrote to interconnect the malware analysis framework Viper and the malware analysis platform A1000 from ReversingLabs. The module can perform two actions at the moment: to submit a new sample for analysis and to retrieve the analysis results (categorization): viper sample.exe

[The post Viper and ReversingLabs A1000 Integration has been first published on /dev/random]

Continue reading Viper and ReversingLabs A1000 Integration→

Feeding TheHive with Emails

Posted on by

TheHive is a great incident response platform which has the wind in its sails for a while. More and more organization are already using it or are strongly considering to deploy it in a near future. TheHive is tightly integrated with MISP to push/pull IOC’s. Such tool must be fed with

[The post Feeding TheHive with Emails has been first published on /dev/random]

Continue reading Feeding TheHive with Emails→

Example of Ransomware As A Service

Posted on by

A few days ago, I wrote a diary for the SANS ISC about a ransomware as a service found on the Darknet. Today, I found an occurrence of “RaaSberry” which is a known platform. It is available in the wild for a few months. The service is available through Tor and looks professional.

[The post Example of Ransomware As A Service has been first published on /dev/random]

Continue reading Example of Ransomware As A Service→

[SANS ISC] Adaptive Phishing Kit

Posted on by

I published the following diary on isc.sans.org: “Adaptive Phishing Kit“: Phishing kits are everywhere! If your server is compromised today, they are chances that it will be used to mine cryptocurrency, to deliver malware payloads or to host a phishing kit. Phishing remains a common attack scenario to collect valid

[The post [SANS ISC] Adaptive Phishing Kit has been first published on /dev/random]

Continue reading [SANS ISC] Adaptive Phishing Kit→

[SANS ISC] Investigating Microsoft BITS Activity

Posted on by

I published the following diary on isc.sans.org: “Investigating Microsoft BITS Activity“: Microsoft BITS (“Background Intelligent Transfer Service”) is a tool present[1] in all modern Microsoft Windows operating systems. As the name says, you can see it as a “curl” or “wget” tool for Windows. It helps to transfer files between

[The post [SANS ISC] Investigating Microsoft BITS Activity has been first published on /dev/random]

Continue reading [SANS ISC] Investigating Microsoft BITS Activity→