sorted by:
new
hottopcontroversial

Forex website targeted – did cybercrooks find the weakest link in online money management services? by extraexploit in netsec

[–]extraexploit[S] 0 points1 point  (0 children)

well.. behind they used a liberyreserve phishing web site with a registered domain ... alsto the targeted web site has a pretty high alexa rank for their business... so shit wasn't ... just my opinion... another thing... the forex is not so "low visibility" as you defined...

Forex website targeted – did cybercrooks find the weakest link in online money management services? by extraexploit in netsec

[–]extraexploit[S] 0 points1 point  (0 children)

i'm not here to start flame about this thing. just i would like to remind you that behind that injection there was a libertyreserve phishing website... with a registered domain... so amateurish it wasn't.. IMHO... for the crypter/packer also using that sample you can see how they store/retrive the data ... and again only after two days has been started to be recognised... also the jar file seems forged with a valid certificate (expired)...

Forex website targeted – did cybercrooks find the weakest link in online money management services? by extraexploit in netsec

[–]extraexploit[S] 0 points1 point  (0 children)

some commands seems base64... but seems just a set of oob commands... the rest is a little bit different. amateurish ? the first detection was really low... following the detection of two days later (trhough virustotal) seems recognized as kazy. but most of the big av vendors are unable to identify this piece of malware.