Skip to main content

Malware Ninja

Search This Blog

Unpatched Fortinet VPN devices welcome CRing Ransomware

Get link
Facebook
X
Pinterest
Email
Other Apps

cybersecurity malware ransomware

Get link
Facebook
X
Pinterest
Email
Other Apps

A passionate Threat Researcher and a Cybersecurity enthusiast.

Comments

Post a Comment

Popular Posts

Basic Security Measures You Should Follow

The world wide web (WWW) is an open playground for people all over the globe. And, if you think there are only good people out there providing you with free music, videos, images, quotes, and what not? then definitely you are WRONG! You must be prepared for the worst and the worst, since there are many crooks waiting to break into your life, by exploiting your online presence. If you are a regular (even if not) computer or any electronic device user you should take into consideration following basic security measures to ensure your safety in terms of Cyber Crime and not get fooled into something very nasty. You are a Target If you think "No one is gonna target me", then either you are an Alien or you are somewhere outside the Milky Way Galaxy. Always, consider yourself a target to be exploited, THE VERY FIRST SECURITY MEASURE YOU CAN FOLLOW! Cut-off Sensitive Information from the Web Sounds like, a common-sense thing right? But, do you remember putting your personal details o...

Modular Malware - Evolving Malware Authoring

Malware or malicious software is a piece of code that is used to disrupt the target or victim system. The most common method used to target the victims is Spam or to be more specific MalSpam. Attackers use a list of email addresses crawled from the internet or the list bought from the Dark Web markets. The malware is attached to the email and is sent in huge bulk to the innocent victims form this email list. As soon as the victim opens the attachment, either the malware runs on the system or runs a dedicated script to download the malware from an external source, such as malware stored in a compromised website or from a newly registered malware author owned domain. This is the payload that does its tasks in an un-authorized way, such as stealing sensitive information, dumping passwords and cookies from browsers, gaining access to the network to which the target system is connected, and many more. All these activities are done in stealth mode, i.e., without the user being aware of. Trad...

Extracting Encoded Shellcode Out Of OLEStream

So I recently came across an interesting XLSX sample in the wild. After looking at the sample it seems like an innocent empty XLSX file roaming around. Digging it deeper reveals some interesting things about it. This sample is being propagated (using malware spam) with the name: RFQ-PO220523-supply order.xlsx 7ed0586b68a24bbe7cb29852beb48f2c6a625af46d2fbc3c652d552aa1b1bb5b Straightforward opening the XLSX gives you 3 sheets (all empty) as seen in the below screenshot, with no activity. (Fig. Empty Sheets) Anyways, let us go directly with the well-known oletools and get a much quicker view of what's going on behind the scenes. Using oledump on the file directly gives us some interesting results seen below. (Fig. oledump results) We can see that there is an OLEStream (\1Ole10Native) at A1 (or index 1) that we should definitely have a look at considering that's where the juicy stuff is all the times in such files. Let's dump this stream using the following command: oledump ...

Powered by Blogger