Security Affairs

MAY 9, 2020

The activity of the Lazarus APT group (aka HIDDEN COBRA ) surged in 2014 and 2015, its members used mostly custom-tailored malware in their attacks. The Mac version uses the same AES key and IV as the Linux variant to encrypt and decrypt the config file. “Both Mac and Linux variants use the WolfSSL library for SSL communications.

Libraries 87

Libraries Communications Encryption Authentication 87

Security Affairs

MARCH 19, 2020

” According to the experts, the first infections were observed in late 2019, victims reported their files were encrypted by a strain of malware. locked to the filename of the encrypted files. CERT-FR’s alert states that the Pysa ransomware code based on public Python libraries. newversion file extension instead of.

Ransomware 107

Ransomware Government Encryption Passwords 107

Security Affairs

SEPTEMBER 12, 2018

exe will drop malware components — several C++ and Python libraries and the Python 2.7 Core dynamic-link library (DLL) — along with the main ransomware executable (lockyfud.exe, which was created via PyInstaller ) in C:Users{user}AppDataLocalTempis-{random}.tmp.” When successfully run, the Facture_23100.31.07.2018.exe

Ransomware 87

Ransomware Libraries Encryption Archiving 87

Security Affairs

NOVEMBER 5, 2020

Dynamic-link library (DLL) side-loading takes advantage of how Microsoft Windows applications handle DLL files. The attackers use a simple XOR encryption algorithm with the string “Hapenexx is very bad” as a key. In these attacks, the encryption key used is the string “HELLO_USA_PRISIDENT.”

File names 109

File names Encryption Libraries IT 109

Security Affairs

JANUARY 11, 2019

In this phase, the ransomware sends to the command and control server information on the encryption process, including a string that contains the Initialization Vector (IV) and a random password used by the ransomware to encrypt the files. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Ransomware 98

Ransomware Encryption Passwords Libraries 98

Security Affairs

SEPTEMBER 3, 2020

The second layer of Python code decodes and loads to memory the main RAT and the imported libraries. The malware communicates with the C2 communications via POST HTTP requests and uses RC4 encryption with a hardcoded key encoded with Base64. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Phishing 137

Phishing Encryption File names Metadata 137

Security Affairs

NOVEMBER 27, 2018

The Event-Stream library is a very popular NodeJS module used to allow developers the management of data streams, it has nearly 2 million downloads a week. It has been estimated that the tainted version of the library was downloaded by nearly 8 million developers. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Libraries 81

Libraries Encryption IT Security 81

Security Affairs

AUGUST 27, 2019

The module was hidden in a 3rd-party advertising library that the author of the app recently was introduced. “After analyzing the app, we saw an advertising library in it that contains a malicious dropper component. . Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

IT 99

IT Libraries Encryption Security 99

Security Affairs

OCTOBER 15, 2020

Over the weekend, users have been complaining on Nook’s Facebook page and Twitter that they were not able to access their library of purchased eBooks and magazine subscriptions. 2/2) Please be assured that there is no compromise of customer payment details which are encrypted and tokenized. Thank you for your patience.

Ransomware 113

Ransomware Encryption Retail Access 113

Security Affairs

APRIL 14, 2020

.” The messages use a weaponized rich text format (RTF) attachment that exploits the CVE-2012-0158 buffer overflow in Microsoft’s ListView / TreeView ActiveX controls in MSCOMCTL.OCX library. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” continues the analysis.

Ransomware 116

Ransomware Phishing File names Encryption 116

Security Affairs

SEPTEMBER 12, 2019

This operation is similar to the threat group’s August 2018 campaign , using compromised university resources to send library-themed phishing emails.” The hackers appear to be interested in getting access to the library, they sent phishing messages to people with access to the library of the targeted university.

Phishing 80

Phishing Libraries File names Metadata 80

Security Affairs

SEPTEMBER 4, 2019

JSWorm encrypts all the user files appending a new extension to their name. During the encryption phase, the ransomware creates an HTML Application “JSWRM-DECRYPT.hta” in each folder it encounters. The malware encrypts all the files whose extension is not present in the list. Figure 3: Extensions excluded from encryption.

Ransomware 82

Ransomware Encryption File names Libraries 82

Security Affairs

MARCH 19, 2019

The flaw is an “Absolute Path Traversal” issue in the library that could be exploited to execute arbitrary code by using a specially-crafted file archive. The ransomware encrypts data on the victim’s machine and appends the.Jnec extension to the encrypted data asking a ransom 0.05 bitcoins (about $200). Pierluigi Paganini.

Ransomware 72

Ransomware Archiving Encryption Libraries 72

Security Affairs

MAY 10, 2020

This issue could be exploited only when the encryption keys are obtained via a separate attack, meaning that the attackers have to chain more exploits in their campaigns. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Mining 86

Mining Libraries Access Encryption 86

Security Affairs

SEPTEMBER 28, 2019

One of the second-stage instances of PowerShell downloads the legitimate node.exe tool, while another drops WinDivert packet capture library components. based payload, and a bunch of encrypted files. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

e-Delivery 81

e-Delivery Retail Libraries Education 81

Security Affairs

APRIL 7, 2020

Upon the installation, the malicious app registers itself as a foreground service and extracts an encrypted payload that gathers information about the victim’s device (android_id, manufacturer, model, firmware version, etc.) Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” concludes Kaspersky.

Manufacturing 124

Manufacturing Libraries Access Encryption 124

Security Affairs

NOVEMBER 12, 2019

Buran is advertised as a stable malware that uses an offline cryptoclocker , 24/7 support, global and session keys, and has no third-party dependencies such as libraries. The malware will encrypt the files only if the machines are not in Russia, Belarus or Ukraine. . ” reads the analysis published by McAfee. Pierluigi Paganini.

Ransomware 45

Ransomware Encryption Libraries Security 45

Security Affairs

OCTOBER 10, 2019

The malware implements a modular structure with a dispatcher and loadable plugins, all of which are implemented as dynamic-link libraries (DLLs). The Attor malware makes sophisticated use of encryption to hide its components. ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Communications 80

Communications Encryption Metadata Libraries 80

Security Affairs

AUGUST 12, 2019

Searching online the expert first found an encrypted firmware, he found on a forum a Portable ROM Dumper , (a custom firmware update file that once loaded, dumps the memory of the camera into the SD Card) that allowed him to dump the camera’s firmware and load it into his disassembler (IDA Pro). ” continues the post.

Ransomware 88

Ransomware Encryption Libraries Authentication 88

Security Affairs

JUNE 18, 2020

It exploits a vulnerability in the Windows wdigest.dll library and then uses an improved ListPlanting technique to inject its code into a trusted process. The activity of the group is characterized by the heavy use of legitimate tools and per-victim encryption in the early stages of the attack chains. Pierluigi Paganini.

Military 81

Military Communications Libraries Encryption 81

Security Affairs

JANUARY 15, 2020

dll module that contains various ‘Certificate and Cryptographic Messaging functions’ used by the Windows Crypto API for data encryption. . “This month we addressed the vulnerability CVE-2020-0601 in the usermode cryptographic library, CRYPT32.DLL, The flaw affects the way Crypt32.dll Pierluigi Paganini.

Libraries 75

Libraries Encryption Security Risk 75

Security Affairs

NOVEMBER 2, 2019

“Although issues with certificate validation have been identified within the encrypted communication between the mobile application and the backend system, the inner layer of end-to-end encryption could not be broken.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Encryption 48

Encryption Privacy Libraries Risk 48

Security Affairs

NOVEMBER 21, 2019

One of the addresses disguised the Bot sample as a Google font library “ roboto. ” The analysis of the bot revealed that it supports seven functions: reverse shell, self-uninstall, gather process’ network information, gather Bot information, execute system commands, run encrypted files specified in URLs, DDoS attack, etc.

Honeypots 81

Honeypots Systems administration Passwords IoT 81

Security Affairs

JUNE 12, 2019

Experts pointed out that Microsoft failed to address a flaw in SymCrypt , a core cryptographic function library currently used by Windows. The flaw could be exploited by malicious programs trigger a denial of service condition by interrupting the encryption service for other programs. Pierluigi Paganini.

Security 65

Security Authentication Libraries Encryption 65

Security Affairs

NOVEMBER 11, 2018

Flaws in several self-encrypting SSDs allows attackers to decrypt data they contain. Apache Struts users have to update FileUpload library to fix years-old flaws. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Security 63

Security IoT Insurance Libraries 63

Security Affairs

FEBRUARY 19, 2019

This file acts as downloader in the infection chain, using a series of hard-coded server addresses, It heavily rely on obfuscation and encryption to avoid the antimalware detection. Shade encrypts all the user files using an AES encryption scheme. Background of the infected machine, after encryption phase.

Ransomware 76

Ransomware Mining File names Encryption 76

Elie

MARCH 17, 2018

This file is encrypted with a hardcoded [XOR encryption] function. This encryption is used to escape the signatures that detect the code that Gooligan borrows from previous malware. Encrypting malicious payload is a very old malware trick that has been used by. Android malware. since at least 2011. publicly shared code.

Encryption 82

Encryption Libraries Ransomware Marketing 82

Elie

MARCH 17, 2018

This file is encrypted with a hardcoded [XOR encryption] function. This encryption is used to escape the signatures that detect the code that Gooligan borrows from previous malware. Encrypting malicious payload is a very old malware trick that has been used by. Android malware. since at least 2011. publicly shared code.

Encryption 82

Encryption Libraries Ransomware Marketing 82

Security Affairs

AUGUST 25, 2019

A backdoor mechanism found in tens of Ruby libraries. million to allow towns to access encrypted data. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. 5 Ways to Protect Yourself from IP Address Hacking.

Security 50

Security Mining Data breaches Libraries 50

Security Affairs

MAY 5, 2020

Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Recently other IoT botnets made the headlines, such as including Hoaxcalls , Mukashi , and dark_nexus. Pierluigi Paganini. SecurityAffairs – Kaiji malware, hacking).

IoT 129

IoT Libraries IT Security 129

Security Affairs

NOVEMBER 1, 2019

The vulnerabilities, tracked as CVE-2019-13720 and CVE-2019-13721, reside respectively in Chrome’s audio component and in the PDFium library. “[$7500][ 1013868 ] High CVE-2019-13721: Use-after-free in PDFium. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Libraries 56

Libraries Encryption Security IT 56

Security Affairs

JANUARY 29, 2019

Then, all the information is encoded in Base64 and sent to the C2 through the “ connect ” function, using a SSL encrypted HTTP channel. This last code snippet is likely borrowed from a publicly available AutoIT library script called “ CompInfo.au3 ”: an AutoIt interface to access the Windows Management Instrumentation framework’s data.

Communications 81

Communications Libraries Encryption Security 81

Security Affairs

FEBRUARY 21, 2020

The two dll are legit windows library and are used in support of the malicious behaviour. This executable has got a sophisticated encryption method of communication with the C2: Figure 13: Evidence of the decrypting routine of the certificate. The downloaded code has been encrypted through the Rijndael algorithm with a hard-coded key.

Military 116

Military Communications Encryption IT 116

Security Affairs

DECEMBER 20, 2018

The malware tries to connect to the remote host 149.154.157.104 (EDIS-IT IT) through an encrypted SSL channel, then it downloads other components and deletes itself from the filesystem. These registry keys are responsible of the loading of dynamically linked libraries in the “read only ” and “ hidden ” “ C:ProgramDataD93C2DAC ”.

Libraries 75

Libraries Phishing Encryption Authentication 75

Security Affairs

AUGUST 22, 2018

This dynamic-link library (DLL) is responsible for decrypting the encrypted rcview.log file and executing it in memory. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Passwords 43

Passwords Libraries Encryption Access 43

Security Affairs

SEPTEMBER 20, 2019

Before passing the control to the “ swety.dll ” library, which is a sort of helper component with no particular scope except the identification of analysis environments, the first instructions executed here are designed to decode and load a byte array embedded inside the executable, unpacking the obfuscated code. Load()” method.

Libraries 81

Libraries Passwords IT Phishing 81

Security Affairs

AUGUST 23, 2018

This is a binary blob with a special format that contains encrypted commands for the backdoor ,” reads the report released by ESET. The backdoor is a standalone DLL (dynamic link library) that interacts with Outlook and The Bat! Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Metadata 46

Metadata Military Libraries Access 46