A Hesperbot Core Analysis

A Hesperbot Core Analysis Like most malware families, Hesperbot may originate in a spam email. Once executed, it will attempt to download its malicious modules through command-and-control (C&C) servers and monitor the activities of the infected computer. These “monitoring activities” may range from logging of keystrokes, recording of the screen, web browser hijacking...

Read More

PDF CVE-2013-5065 - Dropped BAD Malware

This malware is definitely created by a professional as it has an advance method of installing itself. And the malware author knows that what he/she created is BAD. 0x0BAD - Signature of ShellCode for data stealing. Installation This malware was dropped by a PDF file that takes advantage of a known vulnerability which results to Privilege Escalation. To maintain its...

Read More

New PDF Exploit uses 2 new vuln's + JJencode

Last week, a new zero-day exploit has been found in the wild. The exploit is a vulnerability that allows attackers to escalate privilege and execute code in kernel or ring0 mode. More details of the CVE-2013-5065 vulnerability can be found in this Microsoft website. After we got a sample of the supposed PDF that was used in the targeted attack,we immediately went to work...

Read More