Email Campaign Spreads StrRAT Fake-Ransomware RAT

Threatpost

Microsoft Security discovered malicious PDFs that download Java-based StrRAT, which can steal credentials and change file names but doesn't actually encrypt.

STRRAT RAT spreads masquerading as ransomware

Security Affairs

Microsoft warns of a malware campaign that is spreading a RAT dubbed named STRRAT masquerading as ransomware. This RAT is infamous for its ransomware-like behavior of appending the file name extension.crimson to files without actually encrypting them.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Integrating AWS S3 and Windows PowerShell to Download and Rename Files

Perficient Data & Analytics

You may change the profile name to whatever you like. Downloading and Renaming Files from AWS S3 using PowerShell. Define the bucket you would like to download the files from. Define the folder within the bucket you would like to download the files from.

Details of the REvil Ransomware Attack

Schneier on Security

After writing a base-64-encoded payload to a file named agent.crt the dropper executed it. […]. The ransomware dropper Agent.exe is signed with a Windows-trusted certificate that uses the registrant name “PB03 TRANSPORT LTD.”

New COVID19 wiper overwrites MBR making computers unusable

Security Affairs

Upon execution, the wiper drops a series of helper files into a temporary folder, including a BAT file named “coronovirus Installer,” which is responsible for most of the setup work. The BAT file creates a hidden folder named COVID-19, then move the dropped files to it.

Nemty ransomware “LOVE_YOU” malspam campaign

Security Affairs

“Attached to each email is a ZIP archive with a name formatted as with only the #s changing,” reads the advisory published by IBM X-Force IRIS. The ransomware deletes shadow copies of encrypted files to make in impossible any recovery procedure.

Hack of DNA website exposes data from 92M accounts

Information Management Resources

MyHeritage received a message from a researcher who unearthed a file named 'myheritage' containing email addresses and encrypted passwords of nearly all of its users on a private server outside the company. Hacking Data security Cyber security Cyber attacks

FBI published a flash alert on Mamba Ransomware attacks

Security Affairs

Mamba ransomware is one of the first malware that encrypted hard drives rather than files that was detected in public attacks. Mamba leverages a disk-level encryption strategy instead of the conventional file-based one. Payment does not guarantee files will be recovered.

Sony Bravia Smart TVs affected by a critical vulnerability

Security Affairs

“This application handles file names incorrectly when the user uploads a media file. ” The third flaw directory-traversal vulnerability tracked as CVE-2018-16594 that relates to the way the Photo Sharing Plus app handles file names. The application handles file names incorrectly when receiving a user’s input file via uploading a URL. A attacker can upload an arbitrary file with a crafted file name (e.g.: /./)

Introducing the PhishingKitTracker

Security Affairs

Almost every file into the raw folder is malicious so I strongly recommend you to neither open these files, nor misuse the code to prank your friends. NB: Large File System Hahead. This folder is tracked by using Git Large File System since many files are bigger than 100MB.

New ransomware group Hive leaks Altus group sample files

Security Affairs

On June 14th, Altus Group, a commercial real estate software solutions firm, disclosed a security breach, now Hive ransomware gang leaked its files. Files leaked online. The sample archive is password protected – but the file names and types are clearly visible.

BlackWater, a malware that uses Cloudflare Workers for C2 Communication

Security Affairs

Researchers from MalwareHunterTeam discovered a suspicious RAR file named “COVID-19-” that was being distributed online, likely through phishing emails. "Important The RAR archive contains a file named “Important – COVID-19” that displays a Word icon.

BlackCocaine Ransomware, a new malware in the threat landscape

Security Affairs

“The WHOIS information for the domain reveals that the domain of the BlackCocaine ransomware was registered on May 28, 2021” The researchers reported that a file named a.BlackCocaine was recently submitted to different public sandboxes.

Emsisoft released a new free decryption tool for the Avest ransomware

Security Affairs

The Avest ransomware encrypts victim’s files and appends the extension “ ckey().email().pack14” The decryption tool could be used by the victims only after they have successfully removed the malware from their system to avoid that the Avest ransomware will repeatedly lock the machine or will encrypt files. ransomware to decrypt their files for free.

Proactively Protecting Your Sensitive Information for Remote Workers

AIIM

This strategy can help keep project files organized among team members and aid in the disposition of documents once a project has been completed. Discovering content on an employee’s workstation by examining meta-data criteria such as file name, type, or age.

Microsoft warns of Dexphot miner, an interesting polymorphic threat

Security Affairs

Layers of obfuscation, encryption, and the use of randomized file names hid the installation process. Polymorphic techniques involve frequently changing identifiable characteristics like file names and types, encryption keys and other artifacts.

South Korea suffers from the spread of people infected with Corona 19

Security Affairs

The malware found is an executable program (EXE) using file names such as ‘Corona’s domestic status’ and ‘Corona’s real-time corona status.’

A new Shamoon 3 sample uploaded to VirusTotal from France

Security Affairs

” In the attempt to deceive the victims, attackers used the internal file name “Baidu PC Faster” and the “Baidu WiFi Hotspot Setup” in the description of the file. As observed in previous Shamoon samples the internal file name invokes a known PC tool, likely as a lure to allay initial user suspicion.”

B0r0nt0K ransomware demands $75,000 ransom to the victims

Security Affairs

The ransom encrypts all files and renames them by appending. rontok extension to the file names. According to the popular malware researcher Michael Gillespie , when the B0r0nt0K ransomware encrypts a file it will base64 the encrypted data. “The file’s name will also be renamed by encrypting the filename, base64 encoding it, url encoding it, and finally appending the.rontok extension to the new file name.

A new Linux Botnet abuses IaC Tools to spread and other emerging techniques

Security Affairs

Experts highlighted that this Linux botnet downloads all the files it needs from the Tor network, including legitimate binaries like ss , ps , and curl.

Mining 109

ToxicEye RAT exploits Telegram communications to steal data from victims

Security Affairs

Threat actors behind ToxicEye spread the RAT via phishing emails containing a malicious.exe file. Researchers noticed that that the ToxicEye RAT configuration file includes a Telegram bot that is compiled into an executable file.

Magecart gang hides PHP-based web shells in favicons

Security Affairs

The file named Magento.png attempts to pass itself as ‘image/png’ but does not have the proper PNG format for a valid image file.” Threat actors edited the shortcut icon tags with a path to the fake PNG file.

Crackonosh Monero miner made $2M after infecting 222,000 Win systems

Security Affairs

Upon rebooting the system, Crackonosh will scan for the existence of antivirus software and will attempt to disable them, the malware also wipes log system files. It has names of folders, where they are installed and finally it deletes %PUBLIC%Desktop.”

Hacker breached Perceptics, a US maker of license plate readers

Security Affairs

Last week, a hacker that goes online with the moniker ‘Boris Bullet-Dodger’ reported the hack to The Register and showing it a list of files as proof of the attack. The hacker stole hundreds of gigabytes of files along with Microsoft Exchange and Access databases, ERP databases, HR records, and Microsoft SQL Server data stores. “The file names and accompanying directories – numbering almost 65,000 – fit with the focus of the surveillance technology biz.”

Nemty ransomware operators launch their data leak site

Security Affairs

Nemty ransomware first appeared on the threat landscape in August 2019, the name of the malware comes after the extension it adds to the encrypted file names. The ransomware deletes shadow copies of encrypted files to make in impossible any recovery procedure.

Operators behind Nefilim Ransomware threaten to release stolen data

Security Affairs

Nefilim will encrypt a file using AES-128 encryption, then the AES encryption key is encrypted using an RSA-2048 public key that is embedded in the ransomware executable. The encrypted AES key will be included in the contents of each encrypted file.

Cyber Threats Observatory Gets Improvements

Security Affairs

The main improvement sees the introduction of clustering stereotypes for each tracked malware family in three different behaviors: Domains , Files and Processes. Based on the magic file bytes this graph would track the percentages of file types that Malware used as carrier.

Hades ransomware gang targets big organizations in the US

Security Affairs

Experts noticed that each Hades ransomware sample uses a different extension to files that it encrypts and drops a ransom note with file name “HOW-TO-DECRYPT-[extension].txt”.

New KilllSomeOne APT group leverages DLL side-loading

Security Affairs

The name KilllSomeOne comes from the phrase ‘KilllSomeOne’ used in the DLL side-loading attacks, the group is using poorly-written English messages relating to political subjects. . “In both of these cases, the payload is stored in the file named Groza_1.dat.

New variant of Dridex banking Trojan implements polymorphism

Security Affairs

In attacks observed on June 17, the malware was using 64-bit DLLs with file names loaded by legitimate Windows system executables. Duncan pointed out that file paths, file names, and associated hashes would change at every computer login. Security researchers at eSentire tracked a new campaign spreading a variant of the Dridex banking Trojan that shows polymorphism.

New Cyber Attack Campaign Leverages the COVID-19 Infodemic

Security Affairs

During our Threat Intelligence activities we noticed a suspicions artifact named “ CoronaVirusSafetyMeasures_pdf ”, so, intrigued by its name and by its recent submission on Yomi Hunter ( LINK ), we decided to deep dive into it. Figure 3: Dashboard of the file hosting service used.

Best Practices for Organizing Business Files

OneHub

Tired of digging through an endless sea of folders and files to find that one document you need? In addition to costing your company money and stressing out your employees, a poor file structure can jeopardize the security of your files and make onboarding new hires a messy process.

Announcing PSIsafe 12 with Advanced Indexing & Search Functionality

Document Imaging Report

Other document management software applications act like electronic filing cabinets and you can only search based on keywords located in document file names. Auto-generate file names from document metadata.

Himera and AbSent-Loader Leverage Covid19 lures

Security Affairs

Absent-Loader does that and despite its name behaves this way. Following, the static information of this file: Name Covid-19-PESANTATION.doc Thus, once clicked, it allows this malicious document to execute a malicious file named HimeraLoader.exe.

REvil gang threatens to release intimate pictures of celebs who are customers of The Hospital Group

Security Affairs

We pumped out about 600 gb of the most important documents, personal data of customers, as well as intimate photos of these customers (this is not a completely pleasant sight:))” The ransomware gang plans to post the first batch of files, named “Pacient Personal – 20??

Gootkit delivery platform Gootloader used to deliver additional payloads

Security Affairs

“And if that same site visitor clicks the “direct download link” provided on this page, they receive a.zip archive file with a filename that exactly matches the search query terms used in the initial search, which itself contains another file named in precisely the same way.”

Malicious npm packages spotted delivering njRAT Trojan

Security Affairs

db-json.js “ Both packages were created by the same author last week who masqueraded them as tools to work with JSON files. The script attempted to download and execute a file named patch.exe that was used to install the njRAT remote access trojan.

Cyber Threat Trends Dashboard

Security Affairs

Most of the infosharing activities involved in cybersecurity are mostly focused on Indicator of Compromise such as: URL, IPs, Domains and file hashes which are perfectly used to arm protection tools such as: proxies, ng-firewalls and Antivirus Engines.

China-linked LuminousMoth APT targets entities from Southeast Asia

Security Affairs

Anyway experts speculate that the actual targets were only a subset of these that included high-profile organizations, namely government entities located both within those countries and abroad.

Shade Ransomware gang shut down operations and releases 750K decryption keys

Security Affairs

The ransomware also drops on the Desktop 10 text files, named README1.txt through README10.txt, The README.txt files include instructions to contact the crooks via an email address in order to receive information on how to make the payments.