A blog about threat hunting and information security.
Today I wanted to do a real quick post on a PowerShell downloader linked to Emotet. Here is a little background on what Emotet is according to Malwarebytes: Emotet is a Trojan that is primarily spread through spam emails. The infection may arrive either via malicious script, macro-enabled document files, or malicious link. Emotet emails […]
Read More PowerShell Downloader – EmotetSo today I wanted to do a blog post on Black Energy. The sample I will be working with was sourced from hybrid analysis here: https://www.hybrid-analysis.com/sample/39d04828ab0bba42a0e4cdd53fe1c04e4eef6d7b26d0008bd0d88b06cc316a81?environmentId=4. This particular piece of malware was used to target the networks used to control power grids and has been associated to the Sandworm Team, who used it to also […]
Read More Black Energy – AnalysisToday I wanted to do a quick behavioral analysis of Vidar. This particular piece of malware I downloaded from https://www.malware-traffic-analysis.net/2019/01/10/index2.html and is part of the Hookads campaign that is using the Rig Exploit Kit to push Vidar. So lets get started… So what I will be doing is fairly straight forward. I will first setup my […]
Read More Rig Exploit Kit – Vidar Behavioral AnalysisSo today I wanted to do a blog post on an executable SHA-256: 408e38b4d81de63e5762dcb8024f81360b426429821f9934b087aa0a6b44c56f that has been tied back to the Gamaredon Group, in my research. I pulled it down from @0xffff0800 .onion website http://iec56w4ibovnb4wc.onion/Library/GamaredonGroup/. Thank you @0xffff0800 with sharing these samples with the community! A little background on who the Gamaredon Group is. According […]
Read More Basic Dynamic Analysis Pteranodon.bin – Gamaredon GroupToday I wanted to do a blog post on unpacking Shade (Troldesh) ransomware md5 7F9D970C685F7F33AA8A961F2A10173D. The sample I used was acquired from here. Troldesh is a crypto ransomware variant that was created in Russia. So the short story is it will encrypt your files and try to extort money from you. The technique I used on […]
Read More UNPACKING SHADE (TROLDESH) RANSOMWARESo today I wanted to analyze a Microsoft Word document I downloaded from 0xffff0800 .onion website http://iec56w4ibovnb4wc.onion and just go through some quick triage steps to strip out some Indicators of Compromise (IOC’s) if you needed to start scanning your environment quickly. So as usual, when I pull down a sample I will transfer it […]
Read More APT34 OilrigThreeDollarsMacro.doc AnalysisToday I wanted to do a blog post on a malicious Microsoft Word Document that I pulled down from http://iec56w4ibovnb4wc.onion, this is @0xffff0800 repository of malware. It is definitely an excellent resource of malware. So far from what I can tell in my analysis is that this Word document is a downloader, but with that […]
Read More MagicHoundAPT34 Word Doc AnalysisToday I wanted to cover some command-line tips and tricks I’ve learned over the years to help me filter and analyze pcap files. The tools I will be using for this are TCPDump and TShark. The pcap I will be using is from https://www.malware-traffic-analysis.net. If you haven’t checked out this site yet you should because […]
Read More PCAP Command-line Tips & TricksSo in this blog post I wanted to talk about my approach to hunting on the network. I won’t delve into collection of the data, but instead this will be a situation where you have a packet capture already and you don’t know where to start. So depending on the size of the packet capture […]
Read More Threat Hunting Snippets for the NetworkThese are fascinating times we find ourselves in as security professionals, never has there been so much information at our fingertips on how to do our jobs in creative and outside the box ways! It’s literally like being Neo in the Matrix, you can find and follow bona fide rockstars such as Matt Graeber, Will […]
Read More 3 Steps to Improve Your Security