Another Macro Script Technique in Executing Malware

Recently I came across with a macro malware that uses a technique quite new to me. If macro is enabled, macro script does the following: Save the Doc file as RTF file, 300.rtf and 301.rtf Open the 300.rtf file with an embedded PE file Then execute the PE file Lets start analyzing the file and see how it successfully used the above trick. Upon inspecting the file in Hiew...

Read More

New Crypto 3.0 sample

August 11, 2015, one of our systems managed to get a new sample belonging to the family of Cryptowall 3 (Crowti). Using ThreatSecure Networks' behavioral determination, we were able to confirm the "maliciousness" of this sample as it exhibited the following notable behaviors "Runs an exe in the system folder" "Creates a hidden file" "Known malicious behavior, Crowti related" "Opens...

Read More

Uncovering a new MFC downloader

Last July 23, 2015, ThreatTrack's new product, ThreatSecure Network (TSN), uncovered a new sample that was not detected by any major antivirus vendors. Using TSN's unique behavioral determination engine, we were able to tag that a particular sample going through one of our appliances was possibly malicious. Our engine determined that it performed anomalous behaviors...

Read More

[BE CAUTIOUS] Dragon Ball Z: Resurrection of F MALWARE and SCAM

Be wary of downloading movies in torrent sites.  Executables can also be executed with a file size as huge as a gigabyte.   A recent Dragon Ball Z movie from Japan was released entitled Dragon Ball Z: Resurrection 'F'  has been making rounds as of this writing.  References at: http://en.wikipedia.org/wiki/Dragon_Ball_Z:_Resurrection_%27F%27 Searching...

Read More

Unpacking MFC Compiled CryptoWall Malware

Unpacking MFC Compiled CryptoWall Malware Introduction First and foremost, this article does not intend to analyze what CryptoWall malwares are (since many malware researchers did that already) but instead this analysis is focused on unpacking MFC compiled cryptowall. You can also download this MFC tutorial by Externalist on this site https://tuts4you.com/download.php?view.2509...

Read More

Upatre: .ENC File Extension

Cybercriminals uses different techniques to pass through different kinds of network intrusion defenses the users have in their system to avoid malwares. This time criminals have found a new way to deceive users and be able steal important information by encrypting the file and making it unexecutable with a file extension of either “.ENC” or “.EXE”. These files are known to...

Read More