article thumbnail

Buran ransomware-as-a-service continues to improve

Security Affairs

Buran is advertised as a stable malware that uses an offline cryptoclocker , 24/7 support, global and session keys, and has no third-party dependencies such as libraries. The malware will encrypt the files only if the machines are not in Russia, Belarus or Ukraine. . ” reads the analysis published by McAfee.

article thumbnail

[SI-LAB] FlawedAmmyy Leveraging Undetected XLM Macros as an Infection Vehicle

Security Affairs

This technology is stored in the Workbook OLE stream in Excel 97-2003 format which makes it very difficult to detect and parse by antivirus (AV) engines. An important point to note in “Root Entry” is the version of the document “ Microsoft Excel 97-2003 “. Figure 5: Microsoft Excel 97-2003 version identified. dll library).

article thumbnail

Best Digital Forensics Tools & Software for 2021

eSecurity Planet

The Sleuth Kit enables administrators to analyze file system data via a library of command-line tools for investing disk images. Be it advanced locks, encryption barriers, or deleted and unknown content, the UFED (Universal Forensic Extraction Device) can extract physical and logical data.