enSilo | Breaking Malware

Cybersecurity news and updates from the enSilo threat research team.

[enSilo | Breaking Malware @breakingmalware]

ICYMI, we’ve officially moved to @FortiGuardLabs! This partnership allows us to study and analyze data collected from more than three million sensors around the globe.

[enSilo | Breaking Malware @breakingmalware]

We’re moving! Follow us at @FortiGuardLabs for more updates from the industry’s leading threat research team.

[enSilo | Breaking Malware @breakingmalware]

[2/2] MSI: https://t.co/YwL3ezI0Du
Dropped DLL: https://t.co/1yFfEfG34c
Side-loaded DLL: https://t.co/YVCzIZ1JDX
Injected payload: https://t.co/D2EfxacRyJ

Our previous analysis: https://t.co/1dJX89pQcx

[enSilo | Breaking Malware @breakingmalware]

[1/2] Brazilian #cybercrime group uses #Metamorfo with new DLL side-loading target - Microsoft's ctfmon.exe.
Like past activities, a malicious MSI checks for a VM and drops a downloader. Payload hijacks ctfmon.exe and inject code to wmplayer.exe.

[enSilo | Breaking Malware @breakingmalware]

AndroMut downloader uses the "Mocking Trusted Directories" UAC bypass technique published towards the end of 2018.
SHA256: bb5054f0ec4e6980f65fb9329a0b5acec1ed936053c3ef0938b5fa02a9daf7ee
Recent campaign was analyzed by @proofpoint https://t.co/lqFxD1HfwN

[enSilo | Breaking Malware @breakingmalware]

New #BreakingMalware blog post by @kerneronsec and @_adi_z! #Adware #DealPly reverse engineered @Microsoft SmartScreen and @McAfee WebAdvisor APIs to harvest reputation data and stay under the radar.
https://t.co/VvugjIN1ud

[enSilo | Breaking Malware @breakingmalware]

New #BreakingMalware blog post! #TxHollower, an evasive loader actively developed and extensively used by more than 20 malware families #GandCrab #SmokeLoader #ThreatIntel
https://t.co/QQhPs0xeYz

[enSilo | Breaking Malware @breakingmalware]

The Avast Abuser | New blog by @chen_erlich from enSilo Intelligence team dissects a Metamorfo Banking Malware variant which abuses Avast digitally signed executable.
#AvastAbuser #Metamorfo #ThreatIntel
https://t.co/1dJX89pQcx

[enSilo | Breaking Malware @breakingmalware]

@McAfee_Labs Endpoint products relying on stale names is indeed a serious issue. Our root cause analysis from a couple of years ago with relevant mitigations can be found in our blog.

https://t.co/rhTcHlkgF0

https://t.co/jeLxhks933

[enSilo | Breaking Malware @breakingmalware]

@McAfee_Labs Endpoint products relying on stale names is indeed a serious issue. We published the first warning two years ago in our blog.
https://t.co/rhTcHlkgF0
https://t.co/jeLxhks933

[enSilo | Breaking Malware @breakingmalware]

New #BreakingMalware blog post by @B_H101!
Found new activity of #APT10, abuses (another) legitimate Java executable signed by Oracle #PlugX #QuasarRAT #APT #ThreatIntel https://t.co/KCJSzLXIXp

[enSilo | Breaking Malware @breakingmalware]

Analysis of MuddyWater's toolset https://t.co/z7WKFgIiXA

[enSilo | Breaking Malware @breakingmalware]

Using YETI and Elasticsearch for #ThreatHunting by @chen_erlich from enSilo's threat intelligence team https://t.co/Syg8wcPDyl

[enSilo | Breaking Malware @breakingmalware]

The technical details on Operation ShadowHammer - supply chain attack using ASUS live updater https://t.co/U2yTkTCHWf

[enSilo | Breaking Malware @breakingmalware]

@raashidbhatt dissected #Emotet’s network communication protocol https://t.co/zr5sx7Odiu

[enSilo | Breaking Malware @breakingmalware]

New #0day #vulnerability in win32k.sys, CVE-2019-0859
https://t.co/NIk9BQRrPa

[Mathy Vanhoef @vanhoefm]

Me and @eyalr0 discovered several flaws in WPA3. Read more about it at https://t.co/cihpr5oGpQ Or you can read our paper! https://t.co/eiF3iyJq2Y #Dragonblood

[enSilo | Breaking Malware @breakingmalware]

TajMahal APT – a sophisticated platform active for at least the past five years https://t.co/nppcExkHPL https://t.co/tLXUTci9p8 @kaspersky

[enSilo | Breaking Malware @breakingmalware]

Operation SneakyPastes - Gaza Cybergang Group1 latest activities in the middle east https://t.co/W2mOPrIn91 @kaspersky

[enSilo | Breaking Malware @breakingmalware]

Dropper Sample: https://t.co/H6ZJhdOkUt

Links in VB:
https://t.co/lU3IO7wz7h

https://t.co/bJsDKZaTuz

[enSilo | Breaking Malware @breakingmalware]

[1/2] Found a fresh ransomware written in #Go. Dropped using a .doc file with an embedded excel sheet containing a Macro which may evade AV’s detection.

The Macro uses BITS to download the #Ransomware payload from a public #github repo.
Sets wallpaper to George Carlin’s quote.