Authored by: Alexander Sevtsov Edited by: Stefano Ortolani A new malware has recently made the headlines, targeting several computers during the opening ceremony of the Olympic Games Pyeongchang 2018. While Cisco Talos group, and later Endgame, have recently covered it, we noticed a couple of interesting aspects...
Authored by Alexander Sevtsov Edited by Stefano Ortolani Introduction Everybody knows that PowerShell is a powerful tool to automate different tasks in Windows. Unfortunately, many bad actors know that it is also a sneaky way for malware to download its payload. A few days ago we stumbled upon...
By Oleg Boyarchuk and Stefano Ortolani Introduction When ransomware behavior is clearly exhibited, it is relatively easy for a sandbox or a personal A/V to assert detection; after all, in its simplest form, ransomware malware must at least: (1) search for files to be encrypted, and (2)...
A Sandbox is a dynamic file analysis system that allows a researcher to analyze the behavior of potentially malicious code in a virtualized environment without damaging a real host system. In some cases, a sandbox has to analyze an attack without seeing the full chain...
We've recently discovered a malicious Office Excel file that appeared to have the ability to download and execute malware. Examining the file, we saw no evidence of macros, shellcode, or DDE functionality. When scanning the file on Virustotal, the low detection gives the appearance that...
Authored by: Alexander Sevtsov Phishing emails with suspicious attachments are one of the most popular malware delivery vectors today. These attachments usually consist of script-based downloaders (WSF, JS, HTA), or, more commonly, Microsoft Office files with embedded macro code inside. Social engineering methods are used to...
