Security Affairs

NOVEMBER 16, 2018

The downloaded file (wraeop.sct) represents a Javascript code reporting the Stage 2 of the infection process. The script downloads a file named: AZZI.exe and saves it by a new name: VRE1wEh9j0mvUATIN3AqW1HSNnyir8id.exe on a System temporary directory for running it. Stage 1: Microsoft PowerPoint Dropping Website.

Computer and Electronics 106

Computer and Electronics File names Security IT 106

Security Affairs

AUGUST 20, 2018

As usually, I am not going to show you who was able to detect it compared to the one who wasn’t, since I won’t ending on wrong a declaration such as (for example): “Marco said that X is better than Y” Anyway, having the hash file I believe it would be enough to search for such information.

Computer and Electronics 70

Computer and Electronics Encryption Security File names 70

Security Affairs

MAY 3, 2020

Based on the magic file bytes this graph would track the percentages of file types that Malware used as carrier. In other words, it could be nice to see what are the patterns used by malware in both: domain names, file names and process names. TOP domains, TOP processes and TOP File Names.

Computer and Electronics 98

Computer and Electronics File names Cybersecurity IT 98

Security Affairs

MAY 2, 2019

Indeed we might observe a File-based command and control (a quite unusual solution) structure, a VBS launcher, a PowerShell Payload and a covert channel over DNS engine. The group conducts operations primarily in the Middle East, targeting financial, government, energy, chemical, telecommunications and other industries.

Computer and Electronics 92

Computer and Electronics Communications Government File names 92

Security Affairs

AUGUST 31, 2018

My entire “Cyber adventure” began with a simple email within a.ZIP file named “Nuovo Documento1.zip” Stage1 was dropping and executing a brand new PE file named: rEOuvWkRP.exe (sha256: 92f59c431fbf79bf23cff65d0c4787d0b9e223493edc51a4bbd3c88a5b30b05c) using the bitsadmin.exe native Microsoft program.

Computer and Electronics 62

Computer and Electronics File names Security Access 62