INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
PacketCrypt Classic Cryptocurrency Miner on PHP Servers
Published: 2025-01-07.
Last Updated: 2025-01-07 11:40:39 UTC
by Yee Ching Tok (Version: 1)
The SANS DShield project receives a wide variety of logs submitted by participants of the DShield project. Looking at the “First Seen” URLs page, I observed an interesting URL and dived deeper to investigate. The URL recorded is as follows ...
Let’s make it more readable via the quintessential CyberChef or another web proxy tool such as Burp Decoder ...
Interesting. As the name implies, it looks like an executable that is designed to download a secondary payload. A quick search of the filename yielded a recent VirusTotal (VT) submission and a SHA256 hash ...
Some brief dynamic malware reverse engineering yielded very interesting observations ...
Read the full entry:
https://isc.sans.edu/diary/PacketCrypt+Classic+Cryptocurrency+Miner+on+PHP+Servers/31564/
Make Malware Happy
Published: 2025-01-06.
Last Updated: 2025-01-06 07:10:28 UTC
by Xavier Mertens (Version: 1)
When I teach FOR610, I like to use a funny quotation with my students: “Make malware happy!” What does it mean? Yes, we like malware, and we need to treat it in a friendly way. To help the malware work or detonate successfully, it’s recommended that we replicate the environment where it was discovered (or at least, as much as possible). This is not always easy because we often receive a sample outside of its context.
Some examples?
Respect the user rights, are administrator rights required?
Respect the path of files used by the malware (or its own path)
Respect the OS or tools versions
Respect the binary name
…
Some sandboxes launch samples in a VM from the same directory and with the same name like "c:\temp\sample.exe". From a malware point of view, it’s a piece of cake to detect if the environment changed!
First example, detect the name of the executable file in .Net ...
Read the full entry:
https://isc.sans.edu/diary/Make+Malware+Happy/31560/
Goodware Hash Sets
Published: 2025-01-02.
Last Updated: 2025-01-02 15:21:40 UTC
by Xavier Mertens (Version: 1)
In the cybersecurity landscape, we all need hashes! A hash is the result of applying a special mathematical function (a “hash function”) that transforms an input (such as a file or a piece of text) into a fixed-size string or number. This output, often called a “hash value,” “digest,” or “checksum,” uniquely represents the original data. In the context of this diary, hashes are commonly used for data integrity checks. There are plenty of them (MD5, SHA-1, SHA-2, SHA-256, …), SHA256 being the most popular for a while because older like MD5 are considered as broken because researchers have demonstrated practical collision attacks.
Hashes are a nice way to identify malware samples, payload, or any type of suspicious files (I usually share the hash of the malware analyzed in my diaries). In your threat-hunting process, you can search for interesting files across your infrastructure via sets of malware hashes. Some of them are freely available like on Malware Bazaar.
But, other sets of hashes are also interesting when they contain hashes for safe files. The approach is the same: Instead of searching for malicious files, you verify that files on your hosts are good.
Exacorn has released an interesting ZIP archive[2] with “good ware” (as opposed to “malware”). The file (2GB) provides 12M hashes and filenames ...
Read the full entry: