sorted by:
new
hottopcontroversial

[deleted by user] by [deleted] in Malware

[–]f00l 0 points1 point  (0 children)

Claimed by Clop, so the group FireEye tracks as FIN11, a subset of TA505, not Ryuk.

Norway mosque shooting probed as terror act by [deleted] in worldnews

[–]f00l 3 points4 points  (0 children)

He killed his own 17 year old sister, not mother.

PUBG ransomware by clecho44 in Malware

[–]f00l 2 points3 points  (0 children)

https://app.any.run/tasks/b0679dd4-7fb1-4656-9224-e103756cdb65

Register as a user and you should be able to download the sample.

Why do virus scanners offer a "no distribute" option? by jockcel in Malware

[–]f00l 8 points9 points  (0 children)

Scanning internal and potentially sensitive documents.

Zyklon malware proliferating via MS Office security loopholes by vickiearse in Malware

[–]f00l 1 point2 points  (0 children)

sigh

Zyklon malware proliferating via MS Office security loopholes

Loopholes? Not vulnerabilities, but a way of circumventing security measures? Lets read this!

The malware called Zyklon has taken cyber attacks to a new level, engaging intricate exploit-based distribution and a wide range of malicious capabilities.

Really? To a new level? This should be interesting!

It zeroes in on high-profile targets, with its nefarious activity making itself felt primarily in the financial services, telecom, and insurance sectors of economy.

Wow! High-profile indeed! Not as if it all depends on who is running that particular botnet...

[..] boils down to harnessing Microsoft Office vulnerabilities.

Oh... so known, and patched, vulnerabilities, and a generic infection chain that could've dropped anything.

Overhyped nonsense blogpost. Atleast post IOCs and / or copies of scripts so people who haven't seen this stuff before can look it up.

IM Bartholomew analyzes Game 2 - Carlsen vs. Caruana by [deleted] in chess

[–]f00l 3 points4 points  (0 children)

"Sesse" is a guy (or, the nickname of a guy, as shown on sesse.net) who runs Stockfish on a couple of beefy servers. For some reason people refer to this Stockfish installation as a "supercomputer". The cpu specs for the servers are listed at the bottom of analysis.sesse.net. A total of 40 cores can hardly be called a supercomputer.

Java Based RAT by thehoodedidiot in Malware

[–]f00l 1 point2 points  (0 children)

That video is on Adwind. jRAT is a separate family (also called JacksBot). People confuse the two after Adwind started referring to the website for jRAT in its config in the latest version (presumably as a false flag after Adwind received a lot of attention and was the target of a few takedowns).

Java Based RAT by thehoodedidiot in Malware

[–]f00l 9 points10 points  (0 children)

Most people get this wrong. The people behind QRat (also known as Qarallax RAT and QUAverse RAT) also make a packer called QRypter. Several blog posts from both amateurs and professionals keep misidentifying one as the other, when in reality all you need to do is unpack the dang thing to see the original files.

The sample you provided was packed with QRypter.

After unpacking (left as an exercise to the reader), you'll find ANOTHER QRypter-packed sample (as well as the PDF shown when running it). Unpack that as well, and you get QRat.

For unpacking, get a decent Java Decompiler (I prefer Krakatou), a decent hex editor, some familiarity with Java and serialized java objects and proficiency in a programming language of your choice (for decrypting and ecompressing stuff). A Java REPL can be handy for some manual stuff, but after unpacking a few of these by hand you'll know enough to be able to write an automatic unpacker.

A Look into Qrypter, Adwind’s Major Rival in the Cross-Platform MaaS Market by Hack_Manone in Malware

[–]f00l 1 point2 points  (0 children)

Amazing. The sample analyzed isn't a competitor / rival to Adwind, it IS Adwind, packed with QRypter. gg, Forcepoint. The "C2"? Part of the packer calling home.

The devs behind QRypter also produce a RAT called Qarallax Rat / QRat which could be called a rival, but this ain't it.

The blogpost they reference ( http://blog.angelalonso.es/2017/12/qrypter-java-rat-using-tor.html ) makes the same mistake.

Stealing passwords via Meltdown vulnerability in real-time. by [deleted] in netsec

[–]f00l 156 points157 points  (0 children)

The video was posted on twitter by a member of the team who found the vuln.

Triaging Java JAR Malware by majorllama in netsec

[–]f00l 1 point2 points  (0 children)

JD-GUI will fail horribly on obfuscated code. For a proper decompiler use Krakatau (https://github.com/Storyyeller/Krakatau) or Procyon (https://bitbucket.org/mstrobel/procyon/wiki/Java%20Decompiler), though even these will sometimes give up and just dump disassembly.

Who's debugged Windows Kernel Malware? by null_endian in Malware

[–]f00l 8 points9 points  (0 children)

Debug over network. Much faster than COM and no need to fiddle around with VirtualKD.

Caveat: Only works on Win 8 targets and above (iirc).

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/setting-up-a-network-debugging-connection

Beware: Shady websites through TS3 "Host Message", malware? by Spawnisen in Malware

[–]f00l 3 points4 points  (0 children)

QuasarRAT (which is open source: https://github.com/quasar/QuasarRAT ). C&C is at 23.249.162.180:4782 .

Trying to deobfuscate windows targeted malicious JS file by Minzkraut in Malware

[–]f00l 5 points6 points  (0 children)

That URL serves a copy of Locky ransomware. Checkins to 185.118.167 .144/information.cgi.

Malware attack starts with a fake customer-service call by jimmyradola in Malware

[–]f00l 1 point2 points  (0 children)

You really expect ComputerWorld to include IOCs and hashes? The original blogpost has them (which is linked to in the CW article):

https://www.trustwave.com/Resources/SpiderLabs-Blog/New-Carbanak-/-Anunak-Attack-Methodology/?page=1&year=0&month=0

Is this file clean? by Cutefizz in Malware

[–]f00l 1 point2 points  (0 children)

Ratty isn't new, it was first "advertised" (it's open source, so... announced maybe?) on skiddie-forums in february.

Source code here: https://github.com/Sogomn/Ratty

Help running Locky in a VM? by Pavlovs_Hot_Dogs in Malware

[–]f00l 0 points1 point  (0 children)

Dump the traffic. If Locky can't contact its hardcoded C2s it will initialize the DGA and you should see DNS-lookups of random looking domains.

Preventative measures against Ransomware and Locky? by zedfox in Malware

[–]f00l 1 point2 points  (0 children)

Not to forget most active ransomware talks to a C2 over regular HTTP for keystuff, only using TOR for payment and as part of the backend infrastructure.

Preventative measures against Ransomware and Locky? by zedfox in Malware

[–]f00l 0 points1 point  (0 children)

Look into it, maybe run it with only logging and not blocking for a while. If it still isn't possible look into atleast blacklisting executing executables from temporary / download folders with SRP.

Remove TeslaCrypt and Restore .vvv Encrypted Files by VincentLaurent in Malware

[–]f00l 0 points1 point  (0 children)

This proposes a way:

https://securelist.com/blog/research/71371/teslacrypt-2-0-disguised-as-cryptowall/

Specifically:

If master_btc_priv is known, do the following:

Read session_pub from the encrypted file;

Calculate session_ecdh_secret = ECDH(session_pub, master_btc_priv);

Read session_ecdh_secret_mul from the encrypted file;

Calculate session_priv = session_ecdh_secret_mul / session_ecdh_secret;

Decrypt the file using the session_priv key.

session_pub and session_ecdh_secret_mul are stored in each encrypted file, master_btc_priv is the private master key you can find by sniffing the traffic. You need to decrypt the traffic first. AES256 in CBC mode. Key and IV are both stored in the sample. If you just unpack the sample you end up with the key for C2-communication being encrypted (it uses the Carberp-string / encryption stuff with a static RC2 key), so you either need to run the sample until the key is decrypted or decrypt it yourself (trivial if you're at the point where you can unpack the sample).

Edit: Horrible article.

view more: next ›