Category: SANS Full Feed

On Friday’s Stormcast, Johannes talks about Evasive ZIP Concatenation, a technique where 2 (or more) ZIP files are concatenated together to evade detection. This gives me a good opportunity to remind you that my zip analysis tool zipdump.py can handle this type of file. zipdump uses Python’s zipfile module (or pyzipper if you install it),…

Read More

I found an interesting script targeting Steam users. Steam[1] is a popular digital distribution platform for purchasing, downloading, and playing video games on personal computers. The script is called “steam-account-checker” and is available in Github[2]. Its description is: steam account checker ? check your steam log 2024 ? simple script that validates steam logins fast and easy. Updated…

Read More

[This is a Guest Diary by Trevor Coleman, an ISC intern as part of the SANS.edu Bachelor’s Degree in Applied Cybersecurity (BACS) program [1]. Figure 1: ISC Web Honeypot Log Overview Chart [2] The month of August brought with it a notable surge in web traffic log activities, catching my attention. As I delved into…

Read More

While hunting, I found another interesting Python RAT in the wild. This is not brand new because the script was released two years ago[1]. The script I found is based on the same tool and still has a low VT score: 3/64 (SHA256:1281b7184278f2a4814b245b48256da32a6348b317b83c440008849a16682ccb)[2]. The RAT has a lot of features to control the victim’s computer: remnux@remnux:/MalwareZoo/20241021$…

Read More

Once in a while, I get a question about my pdf-parser.py tool, not able to decode strings and streams from a PDF document. And often, I have the answer without looking at the PDF: it’s encrypted. PDF documents can be encrypted, and what’s special about encrypted PDFs, is that the structure of the PDF document…

Read More