Tag: SANS Internet Storm Center, InfoCON: green

Modiloader From Obfuscated Batch File, (Mon, Dec 23rd)

My last investigation is a file called “Albertsons_payment.GZ”, received via email. The file looks like an archive but is identified as a picture by TrID: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original…

Christmas “Gift” Delivered Through SSH, (Fri, Dec 20th)

Christmas is at our doors and Attackers use the holiday season to deliver always more and more gifts into our mailboxes! I found this interesting file this morning: “christmas_slab.pdf.lnk”[1]. Link files (.lnk) are a classic way to execute something malicious…

Python Delivering AnyDesk Client as RAT, (Tue, Dec 17th)

RATs or “Remote Access Tools” are very popular these days. From an attacker&#x27s point of view, it&#x27s a great way to search and exfiltrate interesting data but also to pivot internally in the network. Besides malicious RATs, they are legit…

Microsoft Patch Tuesday: December 2024, (Tue, Dec 10th)

Microsoft today released patches for 71 vulnerabilities. 16 of these vulnerabilities are considered critical. One vulnerability (CVE-2024-49138) has already been exploited, and details were made public before today's patch release. This article has been indexed from SANS Internet Storm Center,…

CURLing for Crypto on Honeypots, (Mon, Dec 9th)

I get a daily report from my honeypots for Cowrie activity [1], which includes telnet and SSH sessions attempted on the honyepot. One indicator I use to find sessions of interest is the number of commands run. Most of the…

[Guest Diary] Business Email Compromise, (Thu, Dec 5th)

[This is a Guest Diary by Chris Kobee, an ISC intern as part of the SANS.edu Bachelor's Degree in Applied Cybersecurity (BACS) program [1]. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

Microsoft November 2024 Patch Tuesday, (Tue, Nov 12th)

This month, Microsoft is addressing a total of 83 vulnerabilities. Among these, 3 are classified as critical, 2 have been exploited in the wild, and another 2 have been disclosed prior to Patch Tuesday. Organizations are encouraged to prioritize these…

PDF Object Streams, (Mon, Nov 11th)

The first thing to do, when analyzing a potentially malicious PDF, is to look for the /Encrypt name as explained in diary entry Analyzing an Encrypted Phishing PDF. This article has been indexed from SANS Internet Storm Center, InfoCON: green…


zipdump & PKZIP Records, (Sun, Nov 10th)

In yesterday's diary entry “zipdump & Evasive ZIP Concatenation” I showed how one can inspect the PKZIP records that make up a ZIP file. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…


zipdump & Evasive ZIP Concatenation, (Sat, Nov 9th)

On Friday's Stormcast, Johannes talks about Evasive ZIP Concatenation, a technique where 2 (or more) ZIP files are concatenated together to evade detection. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: 
zipdump…

zipdump & PKZIP Records, (Sun, Nov 10th)

In yesterday's diary entry “zipdump & Evasive ZIP Concatenation” I showed how one can inspect the PKZIP records that make up a ZIP file. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

zipdump & Evasive ZIP Concatenation, (Sat, Nov 9th)

On Friday's Stormcast, Johannes talks about Evasive ZIP Concatenation, a technique where 2 (or more) ZIP files are concatenated together to evade detection. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: zipdump…

Steam Account Checker Poisoned with Infostealer, (Thu, Nov 7th)

I found an interesting script targeting Steam users. Steam[1] is a popular digital distribution platform for purchasing, downloading, and playing video games on personal computers. The script is called “steam-account-checker” and is available in Github[2]. Its description is: This article…

[Guest Diary] Insights from August Web Traffic Surge, (Wed, Nov 6th)

[This is a Guest Diary by Trevor Coleman, an ISC intern as part of the SANS.edu Bachelor's Degree in Applied Cybersecurity (BACS) program [1]. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article:…

Python RAT with a Nice Screensharing Feature, (Tue, Nov 5th)

While hunting, I found another interesting Python RAT in the wild. This is not brand new because the script was released two years ago[1]. The script I found is based on the same tool and still has a low VT score:…

Analyzing an Encrypted Phishing PDF, (Mon, Nov 4th)

Once in a while, I get a question about my pdf-parser.py tool, not able to decode strings and streams from a PDF document. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Analyzing…

qpdf: Extracting PDF Streams, (Sat, Nov 2nd)

In diary entry “Analyzing PDF Streams” I answer a question asked by a student of Xavier: “how can you export all streams of a PDF?”. I explained how to do this with my pdf-parser.py tool. This article has been indexed…

Scans for RDP Gateways, (Wed, Oct 30th)

RDP is one of the most prominent entry points into networks. Ransomware actors have taken down many large networks after initially entering via RDP. Credentials for RDP access are often traded by “initial access brokers”. This article has been indexed…

Apple Updates Everything, (Mon, Oct 28th)

Today, Apple released updates for all of its operating systems. These updates include new AI features. For iOS 18 users, the only upgrade path is iOS 18.1, which includes the AI features. Same for users of macOS 15 Sequoia. For…

Wireshark 4.4.1 Released, (Sun, Oct 13th)

Wireshark release 4.4.1 fixes 2 vulnerabilities and 27 bugs. One of these bugfixes is for the missing IP address plugin on Windows, see “Wireshark 4.4's IP Address Functions”. This article has been indexed from SANS Internet Storm Center, InfoCON: green…

From Perfctl to InfoStealer, (Wed, Oct 9th)

A few days ago, a new stealthy malware targeting Linux hosts made a lot of noise: perfctl[1]. The malware has been pretty well analyzed and I won&#x27t repeat what has been already disclosed. I found a copy of the “httpd”…

Microsoft Patch Tuesday – October 2024, (Tue, Oct 8th)

Microsoft today released patches for 117 vulnerabilities. Three additional vulnerabilities apply to Chromium/Edge. Another three vulnerabilities are rated critical. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Microsoft Patch Tuesday – October…

macOS Sequoia: System/Network Admins, Hold On!, (Mon, Oct 7th)

It's always tempting to install the latest releases of your preferred software and operating systems. After all, that's the message we pass to our beloved users: “Patch, patch, and patch again!”. Last week, I was teaching for SANS and decided…

Survey of CUPS exploit attempts, (Fri, Oct 4th)

It is about a week since the release of the four CUPS remote code execution vulnerabilities. After the vulnerabilities became known, I configured one of our honeypots that watches a larger set of IPs to specifically collect UDP packets to…

Security related Docker containers, (Wed, Oct 2nd)

Over the last 9 months or so, I've been putting together some docker containers that I find useful in my day-to-day malware analysis and forensicating. I have been putting them up on hub.docker.com and decided, I might as well let…

Tool update: mac-robber.py and le-hex-to-ip.py, (Mon, Sep 30th)

One of the problems I've had since I originally wrote mac-robber.py [1][2][3] seven years ago is that because of the underlying os.stat python library we couldn't get file creation times (B-times). Since the release of GNU coreutils 8.32 (or so),…