INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
obama224 distribution Qakbot tries .vhd (virtual hard disk) 2022-12-02
Published: 2022-12-02
Last Updated: 2022-12-02 06:47:42 UTC
by Brad Duncan (Version: 1)
Introduction
Qakbot (also called Qbot) is a long-running malware family that has seen wide-spread distribution through malicious spam (malspam) in recent years. During an infection, Qakbot performs different functions as an information stealer, backdoor, and malware downloader.
Metadata tags in the malware code are tied to a specific distribution campaign. The "obama" series distribution tag includes a 3-digit suffix, and it currently represents thread-hijacked emails with attachments for HTML smuggling. When opened, the attached HTML file presents a password-protected zip archive to download, and the web page displays the password.
In recent months, password-protected zip archives for Qakbot have contained disk images using the .iso file extension. However, on Thursday 2022-12-01, zip archives for obama224 Qakbot contained images using the .vhd file extension.
VHD files have been used by other criminal groups to distribute malware, but this is the first I remember seeing them for obama-series Qakbot.
In Microsoft Windows, ISO files can easily be mounted by any normal user account. However, VHD images require an administrative Windows account. Because of this, normal user accounts in an Active Directory (AD) environment cannot mount VHD files on a Windows client without administrative login credentials. VHD images can easily mount on stand-alone Windows 10 or 11 hosts that use administrative accounts.
Read the entire diary entry:
https://isc.sans.edu/diary/obama224+distribution+Qakbot+tries+vhd+virtual+hard+disk+images/29294/
Linux LOLBins Applications Available in Windows Published: 2022-12-03
Last Updated: 2022-12-03 20:09:25 UTC
by Guy Bruneau (Version: 1) Some useful Linux applications that are now part of default installation in Windows 10, Windows Server 2019/2022 (LOLBins - Living Off the Land Binaries).
cURL
The first one is curl which can be very useful for scripting to download or upload files and/or use with a username/password (curl --help) and save the output either to a new filename or the same:
tar
The next application is tar (tar --help) is used to store, extract and manipulate archive files. Let’s take the previous file Example.csv, archive and compress it and then review the result. Using the same options as Linux will use gzip compression and create the file...
Read the entire diary entry:
https://isc.sans.edu/diary/Linux+LOLBins+Applications+Available+in+Windows/29296/
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
obama224 distribution Qakbot tries .vhd (virtual hard disk) 2022-12-02
Published: 2022-12-02
Last Updated: 2022-12-02 06:47:42 UTC
by Brad Duncan (Version: 1)
Introduction
Qakbot (also called Qbot) is a long-running malware family that has seen wide-spread distribution through malicious spam (malspam) in recent years. During an infection, Qakbot performs different functions as an information stealer, backdoor, and malware downloader.
Metadata tags in the malware code are tied to a specific distribution campaign. The "obama" series distribution tag includes a 3-digit suffix, and it currently represents thread-hijacked emails with attachments for HTML smuggling. When opened, the attached HTML file presents a password-protected zip archive to download, and the web page displays the password.
In recent months, password-protected zip archives for Qakbot have contained disk images using the .iso file extension. However, on Thursday 2022-12-01, zip archives for obama224 Qakbot contained images using the .vhd file extension.
VHD files have been used by other criminal groups to distribute malware, but this is the first I remember seeing them for obama-series Qakbot.
In Microsoft Windows, ISO files can easily be mounted by any normal user account. However, VHD images require an administrative Windows account. Because of this, normal user accounts in an Active Directory (AD) environment cannot mount VHD files on a Windows client without administrative login credentials. VHD images can easily mount on stand-alone Windows 10 or 11 hosts that use administrative accounts.
Read the entire diary entry:
https://isc.sans.edu/diary/obama224+distribution+Qakbot+tries+vhd+virtual+hard+disk+images/29294/
Linux LOLBins Applications Available in Windows Published: 2022-12-03
Last Updated: 2022-12-03 20:09:25 UTC
by Guy Bruneau (Version: 1) Some useful Linux applications that are now part of default installation in Windows 10, Windows Server 2019/2022 (LOLBins - Living Off the Land Binaries).
cURL
The first one is curl which can be very useful for scripting to download or upload files and/or use with a username/password (curl --help) and save the output either to a new filename or the same:
tar
The next application is tar (tar --help) is used to store, extract and manipulate archive files. Let’s take the previous file Example.csv, archive and compress it and then review the result. Using the same options as Linux will use gzip compression and create the file...
Read the entire diary entry:
https://isc.sans.edu/diary/Linux+LOLBins+Applications+Available+in+Windows/29296/