Protecting the End User and potential victims one security analysis at a time.
I have spent the last month and a half working on a Sysmon configuration for the LOLRMM framework. This framework is extremely useful for those who intend to hunt down RMMs within their environment. Thus I have been working on this configuration and it is nearly complete and will likely be finalized within the next [ ]
While analyzing a new wave of Hancitor, I have determined that they have combined a variety of techniques together which greatly increases the effectiveness of the campaign. According to my research, they have leveraged an effective combination of Living off the Land Techniques in order to evade detection. WMI for indirect command execution and COM [ ]
While monitoring a blogspot page that keeps embedding malicious scripts to execute on victim systems I seen some code changes that interested me. Specifically they added another payload for victim systems to retrieve. A casual glimpse at the blog post below wouldn t make you think that the post was malicious. However, it does contain embedded [ ]
Currently, Telecoms and Nation States are able to see direct correlations between the source and destination of Signal messages via MetaData of those communications. However, this is also what gives those same entities power to figure out exactly which individuals to target by tracking down the source and destinations of those messages. However, I propose [ ]
While monitoring the latest Threat Intelligence and InfoSec news articles I came across an excellent article posted on April 17th, 2018 by the company AdGuard linked here. I determined a method of detection based on utilizing this campaigns unique usage of hashes in a .txt for domain comparisons. Specifically there was many hashes that are [ ]
Good Afternoon, I have recently been working on methods to detect an Information Stealer/Trojan known as Ursnif. The difficulty in detection relies on the use of encrypted Word documents. These documents use an additional encryption pack that comes by default with Office 2007 SP2 or higher. The encryption pack is known as the High Encryption [ ]
First, I would like to thank Marry Trame at peerlyst.com for posting about this new method that was discovered for a malware downloader. A link to the original post can be found at the bottom of this analysis. I would like to note that I edited the domain to my own in the PowerPoint so [ ]
Good Morning Everyone, I have created a passivetotal project for tracking of the Downloader and payload domains. Information can be found in the link below as to 214 different domains that we have observed thus far over the last 3 days. We are estimating 128 unique domains per day but are still encountering various variants. [ ]
Good Morning, While researching a wave of what other analysts alerted as Emotet/Geodo I found 128 different domains that are hosting the javascript based downloader and the payloads. The list of domains can be found at the following Pastebin, I dont want to link them here as Google will mark my blog malicious if I [ ]