Yesterday evening i downloaded a copy of 'Final1stspy' malware played by Jay Rosenberg (https://www.intezer.com/apt37-final1stspy-reaping-the-freemilk/) in the same day. This is a variant of a malicious component being part of a larger malware set adopted by the Reaper Group in order to conduct their operations. Original discovery is to be attribuited to Unit 42 of Palo Alto Networks … [Read more]
Una nuova campagna melevola riconducibile al noto trojan Ursnif si sta probabilmente diffondendo in queste ore prendendo come target primari utenze italiane. La primaria risorsa di rete adibita a veicolare il malware risulta attestata sul dominio "pagamento.us", da cui è stato generato il seguente grafico relazionale:E' importante chiarire che le relazioni qui presentate potrebbero appartenere a società e profili fittizi o del tutto inconsapevoli di quanto accaduto !Per … [Read more]
Nel momento in cui scrivo, tutti i professionisti dell'IT Security avranno già sentito parlare del ransomware che sta terrorizzando il mondo: WannaCry. Dal 12/05 ogni blog specializzato nel settore oltre che la stampa in genere, non fa che parlare dei danni (reali, ipotetici o presunti) che l'incrontrollata diffusione di tale codice starebbe causando. Da circa un paio di giorni ho iniziato a studiare in maniera abbastanza approfondita diversi campioni (malware samples) appartenenti alla campagna … [Read more]
This morning I received on my company box an email with an attached .xlsm file named D92724446.xlsm coming from [email protected] Central and local AV engines did not found anything malicious and also a multiengine scan got 0/57 as result. I decided to investigate a little more in-depth in order to confirm that was a malicious file and to extract at least the code I was imagining being inside this document. These are some general info collected about the received file: Name: … [Read more]
This morning, a colleague of mine pointed out me to some reversing “challenges” addressed to participants of SANS Brussels 2015 (what? I was not there?). Why not to take a quick look and try to solve them ? I hope to publish the solutions/suggestions is not cause of rage for mentors of SANS, for whom I have a lot of esteem. However, at the time of this writing these challenges are online and accessible without any particular restriction at https://www.sansemea.com/challenges.php, therefore I … [Read more]
This topic has been dealt in one of my last technical articles. The document shows as it’s possible to approach an incident investigation on the basis of common instructions used by shellcodes to achieve their goals. The analysis is conducted within a memory dump. In this regard have been developed some yara custom rules that can be used as an aid for experienced analyst to quickly locate malicious code. Note, however, that this is a very wide topic (have you ever heard of padding, permutations, … [Read more]
This evening I received an email with an attached zip. This email was very well made and my anti-virus did not detect anything dangerous -_- veeeery nice…i decided to take a look and see what strange monster was inside :] The executable is a trojan/downloader packed with something custom! After recovering the original executable bypassing all protections, i was able to have a look within it and immediately i saw some interesting functions … [Read more]
Reb October is the name of a cyber-espionage toolkit discovered by Kaspersky Lab. The malware was operating worldwide for up to 5 years before to be discovered, transmitting to its C&C servers a lot of informations. Red October is considered an advanced cyber-espionage campaign intended to targeting diplomatic, governmental and financial organizations. This is an analysis conducted by me on 01/13 for InfoSec Institute but published but published after a little... It's possible to view my … [Read more]
BatchWiper has been described by experts as an "Old Style" threat. It's programmed to delete data from entire logical partitions managed by infected systems. It 's simple, not well cared or optimized, but effective in its minimalistic design. It was discovered very recently by iranian CERT, and soon became quite famous among the "experts". This analysis takes into consideration the phases of reverse engineering and study of one of these samples. It's available for download a detailed report … [Read more]
This document is the result of work done by Emanuele De Lucia for the final CREA certification exam (Certified Reverse Engineering Analyst).The malware analyzed appeared obscured and encrypted in order to make more difficult all tasks targeted to its identification and analysis.The present document was rendered freely available with permission of the competent institute. The document is available for download in English.