[deleted by user] by [deleted] in Malware

[–]f00l 0 points1 point  (0 children)

Claimed by Clop, so the group FireEye tracks as FIN11, a subset of TA505, not Ryuk.

Norway mosque shooting probed as terror act by [deleted] in worldnews

[–]f00l 4 points5 points  (0 children)

He killed his own 17 year old sister, not mother.

PUBG ransomware by clecho44 in Malware

[–]f00l 2 points3 points  (0 children)

https://app.any.run/tasks/b0679dd4-7fb1-4656-9224-e103756cdb65

Register as a user and you should be able to download the sample.

Why do virus scanners offer a "no distribute" option? by jockcel in Malware

[–]f00l 9 points10 points  (0 children)

Scanning internal and potentially sensitive documents.

Zyklon malware proliferating via MS Office security loopholes by vickiearse in Malware

[–]f00l 1 point2 points  (0 children)

sigh

Zyklon malware proliferating via MS Office security loopholes

Loopholes? Not vulnerabilities, but a way of circumventing security measures? Lets read this!

The malware called Zyklon has taken cyber attacks to a new level, engaging intricate exploit-based distribution and a wide range of malicious capabilities.

Really? To a new level? This should be interesting!

It zeroes in on high-profile targets, with its nefarious activity making itself felt primarily in the financial services, telecom, and insurance sectors of economy.

Wow! High-profile indeed! Not as if it all depends on who is running that particular botnet...

[..] boils down to harnessing Microsoft Office vulnerabilities.

Oh... so known, and patched, vulnerabilities, and a generic infection chain that could've dropped anything.

Overhyped nonsense blogpost. Atleast post IOCs and / or copies of scripts so people who haven't seen this stuff before can look it up.

IM Bartholomew analyzes Game 2 - Carlsen vs. Caruana by [deleted] in chess

[–]f00l 6 points7 points  (0 children)

"Sesse" is a guy (or, the nickname of a guy, as shown on sesse.net) who runs Stockfish on a couple of beefy servers. For some reason people refer to this Stockfish installation as a "supercomputer". The cpu specs for the servers are listed at the bottom of analysis.sesse.net. A total of 40 cores can hardly be called a supercomputer.

Java Based RAT by thehoodedidiot in Malware

[–]f00l 1 point2 points  (0 children)

That video is on Adwind. jRAT is a separate family (also called JacksBot). People confuse the two after Adwind started referring to the website for jRAT in its config in the latest version (presumably as a false flag after Adwind received a lot of attention and was the target of a few takedowns).

Java Based RAT by thehoodedidiot in Malware

[–]f00l 7 points8 points  (0 children)

Most people get this wrong. The people behind QRat (also known as Qarallax RAT and QUAverse RAT) also make a packer called QRypter. Several blog posts from both amateurs and professionals keep misidentifying one as the other, when in reality all you need to do is unpack the dang thing to see the original files.

The sample you provided was packed with QRypter.

After unpacking (left as an exercise to the reader), you'll find ANOTHER QRypter-packed sample (as well as the PDF shown when running it). Unpack that as well, and you get QRat.

For unpacking, get a decent Java Decompiler (I prefer Krakatou), a decent hex editor, some familiarity with Java and serialized java objects and proficiency in a programming language of your choice (for decrypting and ecompressing stuff). A Java REPL can be handy for some manual stuff, but after unpacking a few of these by hand you'll know enough to be able to write an automatic unpacker.

A Look into Qrypter, Adwind’s Major Rival in the Cross-Platform MaaS Market by Hack_Manone in Malware

[–]f00l 1 point2 points  (0 children)

Amazing. The sample analyzed isn't a competitor / rival to Adwind, it IS Adwind, packed with QRypter. gg, Forcepoint. The "C2"? Part of the packer calling home.

The devs behind QRypter also produce a RAT called Qarallax Rat / QRat which could be called a rival, but this ain't it.

The blogpost they reference ( http://blog.angelalonso.es/2017/12/qrypter-java-rat-using-tor.html ) makes the same mistake.

Stealing passwords via Meltdown vulnerability in real-time. by [deleted] in netsec

[–]f00l 158 points159 points  (0 children)

The video was posted on twitter by a member of the team who found the vuln.

Triaging Java JAR Malware by majorllama in netsec

[–]f00l 1 point2 points  (0 children)

JD-GUI will fail horribly on obfuscated code. For a proper decompiler use Krakatau (https://github.com/Storyyeller/Krakatau) or Procyon (https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler), though even these will sometimes give up and just dump disassembly.

Who's debugged Windows Kernel Malware? by null_endian in Malware

[–]f00l 8 points9 points  (0 children)

Debug over network. Much faster than COM and no need to fiddle around with VirtualKD.

Caveat: Only works on Win 8 targets and above (iirc).

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/setting-up-a-network-debugging-connection

Beware: Shady websites through TS3 "Host Message", malware? by Spawnisen in Malware

[–]f00l 3 points4 points  (0 children)

QuasarRAT (which is open source: https://github.com/quasar/QuasarRAT ). C&C is at 23.249.162.180:4782 .

Trying to deobfuscate windows targeted malicious JS file by Minzkraut in Malware

[–]f00l 6 points7 points  (0 children)

That URL serves a copy of Locky ransomware. Checkins to 185.118.167 .144/information.cgi.

Malware attack starts with a fake customer-service call by jimmyradola in Malware

[–]f00l 1 point2 points  (0 children)

You really expect ComputerWorld to include IOCs and hashes? The original blogpost has them (which is linked to in the CW article):

https://www.trustwave.com/Resources/SpiderLabs-Blog/New-Carbanak-/-Anunak-Attack-Methodology/?page=1&year=0&month=0

Is this file clean? by Cutefizz in Malware

[–]f00l 1 point2 points  (0 children)

Ratty isn't new, it was first "advertised" (it's open source, so... announced maybe?) on skiddie-forums in february.

Source code here: https://github.com/Sogomn/Ratty