Brian Stadnicki
Phishing emails rely on many methods, such as sending exploit documents or executables. Thankfully, companies have figured out that this is common and implemented file attachment extension blockers, such as preventing external .pdf files and all .exe files. Above is an example from the ACSC. Bypass So how do you bypass this? Commonly you add a link or some javascript, but what if you just put your…
Remcos RAT is known for being very feature rich, with a lite version to test. They even provide an option to disable the TLS, making it very easy to reverse engineer the protocol. I’m not aware if the paid version has a different protocol. The binary protocol is very simple: packets start with $\x04\xff\x00 then is the packet type then 7 usually miscellaneous bytes then often string…
AsyncRAT is an open source RAT (Remote Access Tool). While it isn’t typically used for advanced attacks, it’s very common in gaming scenes, thanks to how easy to use and surprisingly polished it is. Thankfully, there exists a RCE flaw. Attack surface The AsyncRAT server listens by default on 6606, 7707 and 8808. No authentication is required to connect to a server, with commands being…
This cheap camera is quite terrible, so that’s why it’s been abandoned, ready for me to tinker with. To aid the tinkering, it would help to have the firmware, which thankfully is very easy to extract. Firmware extraction When I plug the camera in, it prompts asking for usb mode. brian@parrot:~$ adb devices List of devices attached 20080411 device As it’s connecting via adb,…
The chaos ransomware is fairly new, first appearing in June 2021 as a builder, offered on multiple darknet forums and marketplaces. It doesn’t appear to have been involved in any significant incidents yet, a few minecraft players don’t count. Unsurprisingly therefore, the sample has not had a single transaction to the wallet. It isn’t very complicated, as likely a simple…
6 years ago, kaspersky reported a piece of ransomware which displayed a fake windows update screen during encryption. I don’t know the distribution, but I know it starts at Fantom.exe. This appears to be an odd custom loader, but all the main functionality is implemented in the .NET executables. There are 2 parts to the ransomware: the encryptor and the fake windows update screen. Assemblies…
There is a huge amount of malware created and found every day, easily ranging from 1k to 3k every day just on a public resource such as malshare. So there is a big question: Who and why is creating so much malware? Types I believe there’s 2 main bands of malware authors: the kids, and the professionals. Kids Kids can be taken both figuratively and literally. New “hackers” are…
Last year, a major RCE was found in GitLab, CVE-2021-22205, where GitLab versions >= 11.9 and <13.10.3 were affected due to improper image validation before passing it to a file parser. Malicious image The DjVu image is considered a legacy format, so not much attention has been paid to it. The GitLab RCE depends on a vulnerability in ExifTool, CVE-2021-22204, where improper parsing of annotations,…
The SBIDIOT IoT malware was observed earlier this year in april. Recently I spotted a sample with a cryptominer added on, so let’s see what’s changed. The botnet’s main use is for DDOS attacks on game servers. Overview Author I took a look at one of the past versions of this malware: 3e948a7995faac6975af3c8c937c66e6b5733cb69dab5d2b87ba4c22e23ef136 It appears that the author could…
Today I’m taking a look at a password stealer filled with obfuscation and some virtual machine detection. The sample can be obtained from malshare, with an automated analysis report on joesandbox. Property Value File Type Portable Executable 64 File Size 3.69 MB CompanyName Say celebrate Date FileDescription Dress Suffer fuel basic FileVersion 6.4.14.15 LegalCopyright Pine Shit (c) 2005…