New answers tagged

0

Well, actually, Ransom32 is not an .exe file, it's a .scr (which is basically the same thing) and he doesn't use WinRAR code but NSIS code in the latest version that I've found on the web. We can easily unpack the scr file to see interesting things : First, the NSIS script file will launch a .NET 4.0 installer if not found on the system Then it'll ...


4

What risks do you have? Possibly that your computer is now infected with malicious software like a virus or a trojan horse. The following steps should be taken if you didn't already. What to do? There are some steps you can take: First of all, don't click on links that you don't trust or know Use unshortenit.it or urlex.org to check where the ...


2

JAD has been unmaintained for a while now. For decompiling a jar, I typically use JD-GUI, just as your linked question proposes.


1

Does Conficker really needs 50000 workings domains in order to contact the C&C server? Certainly not, a handful is sufficient. Conficker will try 50000 domains knowing that, somewhere in this list, it will find a responsive C&C server. On the other side can the authorities buy 50000 domains per day to block Conficker? Certainly not, here it would be ...


3

I assume you are referencing this Wikipedia article for your info. Basically, the malware does not register the domain names, it just generates a list of possible domain names. The attacker registers domain names that are "possible" outputs of the DGA. For example, if the DGA is something like: x = rand(10) domain = "xyz" + x + ".com" contact(...


1

There are multiple reasons for this (sending data all over the place). If you are phishing with the intent of exploiting something, you may have something like mod_redirect running in the background to target specifics. E.g.: if UserAgent = IE && Windows 7 then send them to this particular page with Win7 IE specific exploits or if UserAgent = ...


1

What makes you believe it is not executing properly? Many variants of malware have checks and balances that disable full execution if certain programmed parameters are not met for example: Check if I am virtualized if so don't run Check to see if I have true Internet connectivity if not don't run Check to see if I can exploit anything on this machine for ...


2

You did answer your own question already: Is this something exploited through vulnerabilities ... Buffer Overrun Buffer overflows are not intended behaviour, but indeed exploitable vulnerabilities. Browsers vendors will fix B.O. when they find it => they do protect from it. The problem is, as with all vulnerabilities, someone has to recognize ...


2

Nope, no software exploits, just classic exploitation of dumb users. The payload is distributed in a self-extracting RAR file. A self-extracting RAR file is really just an executable extractor with the .rar file appended to the file. Such a file is an executable file with the .exe extension, and has a feature to run arbitrary code after extraction. The ...


2

This is not Javascript breaking out of a browser's vm/sandbox but rather an executable that runs with full local user privileges that happened to be written in Javascript... There's nothing to harden as local Javascript app platforms like NW.js are designed to allow exactly that and like all other platform/frameworks they can be used for good as well as for ...


3

The most important thing to consider here is that this type of JavaScript malware does not run in a browser. It runs in a special runtime called NW.js which gives powerful NodeJS API's not found in a browser. While NW.js shares many technologies with the Chromium browser, it is not a browser but a type of native wrapper for making desktop apps, and this ...


1

CryptoLocker was taken down in 2014. Some copycat ransomware developers have chosen to imitate it, but the original CryptoLocker is gone. TeslaCrypt, CryptoWall etc. are all different strains of ransomware. However, because of the aforementioned copying of CryptoLocker's name and because it was the first ransomware to be widely succesfull, some media ...


0

This is metasploit meterpreter shell trying a reverse tcp, basically injecting a service (dll) into a process and getting shell.


0

If they're standard headphones with an analogue audio cable, then they can't transmit malware. If they've got a digital connection such as HDMI, they can theoretically transmit malware but a vulnerability in the headphones would have to be exploited by the device transferring the malware to the headphones, and the malware on the headphones would then have to ...


2

First, we should look at what the name "Trojan" actually means: In a 10 years long war between the Greeks and the city of Troy, the Greeks built a wooden horse and offered it as a gift to the city (or simply left the horse outside of the city while pretending to sail away - stories differ sometimes). The inhabitants of the city pulled the horse inside, ...


0

In the IT world a trojan horse is a file wich looks like for instance an MP3 file but is actually malicious. When you open the file you install the malware. So actually you do all the work and install the file by yourself by running an .exe file wich looks like an MP3 file. Most of the time this is done with some great social engineering tricks but also ...


0

You might be able to identify known malware and exploit fragments with a malware scan. This might address your concerns quickly and easy. But if it was a more professional attack this might not be possible. If you assume your computer is compromised you might have to re-format the device and re-install the operating system. This action would be mandatory in ...


12

Potentially, yes -- but it depends! Quite a number of Android devices (and potentially a lot of others) enable access on a serial UART console on the headphone jack during boot (a nice wrapup also exists on pentestpartners.com). You don't need a lot of electronics (and space requirements) to build a headphone that can (ab)use UART access to do something evil,...


1

The way I see it, you are asking if an Android phone infected with an Android malware could store data on your headset infect your iOS device The first question has already been answered quite clearly. The second however hasn't been answered. If Android code could possibly run on iOS, well a lot of programmers would be so satisfied. One could argue that ...


-1

Delete the file (and I really mean delete, not just put into the recycler) Defrag (if you feel paranoid). Profit. Deleting the file won't execute it, so there's no risk to do it. Deletion will only mark the area used by the file as 'free', and OS will not be able to access it the normal way. It's not really readable unless you use forensic/data recovery ...


-1

I'd take 3 steps: Delete the file. Complete a virus scan after deleting the file, using an alternate up-to-date with virus definitions VS scanner that you've totally researched. Consider decent AV software that assists in flagging files in case a download like this happens again and you miss it.


7

Malware files by themselves are not special in any way, they're just like any other file albeit with a malicious purpose. So, you can simply delete it as you would any other file. If for some reason you feel that someone (yourself included) might go digging through your computers recycle bin, you can also empty it to prevent accidental retrieval.


0

I can think of a few things to look out for in your situation. You can potentially get infected on your win 10 machine not just by running a malicious .exe file but also by opening any malicious file. MS Office or PDFs etc have the potential to be just as dangerous. (Of course this does require user action.) If the laptop is infected and remote access ...


7

Something that looks like headphones and plugs into the headphone jack could be evil -- it could fry your audio chip by pushing electric current beyond normal limits. But without extra software already on the device, it can't save data to the hard drive of the device.


4

No, you can't give your Android phone malware by using Apple earbuds. Pretty much, earbuds, like any headphones, are just two small speakers each soldered to two wires that complete the circuit between the earphone and the headphone jack. Some headphones have a volume switch, small microphone, playback control (pause/play, stop, rewind, fast forward, etc.) ...


4

Speakers and microphones are essentially the same thing: a vibrating element controlled by an electronics signal. Because of that, you can turn a speaker into a microphone quite easily by messing with the cables. In theory, a modified headset equipped with bluetooth or a data cable (like the upcoming Lightning-connected earpieces might be) could spoof a ...


3

No, it is not possible because a common jack cable headphone lacks 3 things that are necessary for a malware infection: Storing data Executing code Transferring data This is something we might see coming onto headphones in the future. For example USB-headphones might come with such features which would make a malware infection and propagation possible.


80

I doubt there is a way to store any information (thus transfer information) on regular headphones. Some more advanced models (such as noise canceling) have some processing ability and firmware, but I don't see it as a viable attack vector.


12

As far as I can establish, these headphones don't have memory, so they would not be able to store malware. Also, the datastream should only be from the computer or mobile to the headphones. Even if an attacker managed to put malware on the headphones, it would be hard to send the malware to another computer or mobile. If it were a headset (i.e. with a ...


39

While I would not say "impossible", I can say that you don't need to worry. Headphones do not have any storage that could be used to store malware. Also, they usually do not actively send much data to the phone they are plugged into that could be used. For example, only send sound data if there is a mic, and maybe some simple play/stop/skip/volumeup/down ...


0

From your comments: I just want to know how to proof if a system is infected or not. This is what is called a forensic analysis. You must be aware that a well done malware will take specific precautions in order to remain undetectable as much as possible and to hide its inner working. Therefore, it requires very specific competences to do such an ...


4

No. Viruses can infect any commonly used bootable media. The spread of this type of viruses became thwarted (in addition to better protection mechanisms) because of a change in media usage patterns. Floppy disks in their golden age were used as a medium for live OS (booting and running), software distribution and for data exchange. Nowadays you use: ...


5

Yes, it is possible for a malware to infect the Windows partition while your are using Linux - source: it happened to me. This was many years ago when I was starting with Linux. The dualboot system was currently running under Linux, and I wanted to exchange files between two computers using Samba. Since there were some problems with it, I removed all ...


2

is it possible to extract the encryption key remotely via malware out off the ram memory, and if possible, how come that the law enforcement does not use this method instead of a cold boot attack? Of course it is possible. The malware requires to achieve privilege elevation ad access the encryption driver's memory; both things can be made difficult, but ...


7

In many Ubuntu dual-boot setups it is possible to run code as an unprivileged user which has the ability to write to the Windows partition. Because, if you can do it with the file manager without getting asked for a system password a malware could mount the windows partition too with the same kind of helper. And if the malware setups a file into the ...


1

The other answers explain pretty well why Windows malware won't run on Ubuntu. However there are some languages like Java, and most interpreted languages which are cross platform like PHP, Python, Ruby, etc, and malware written in any of those languages will execute just fine on Windows, Mac, Linux, and even BSD. Assuming the malicious code can run ...


12

If you had two viruses in play, one that infected Linux with a payload to infect Windows, then it could conceptually happen. However, a native Windows virus cannot run in Linux at all. The reason why nothing would happen has to do with something known as the "Application Binary Interface", or "ABI" for short. In Windows, most system calls are performed ...


3

If the Windows partition is mounted, then any user with permission to write to that mount can change any file as they please, without the normal restrictions or permissions that would be enforced when Windows is booted. This could allow a malicious user to replace critical system files in order to infect Windows. That being said, I don't think there is any ...


1

From Wikipedia: Trojan horse, or Trojan, is any malicious computer program which is used to hack into a computer by misleading users of its true intent. The term is derived from the Ancient Greek story of the wooden horse that was used to help Greek troops invade the city of Troy by stealth. Therefore the difference is that a trojan horse is supposedly ...


2

Well actually Removable media is a subset of physical media. Its the old "a cube is always a beam, but a beam is not always a cube." thing. Boot sector viruses have been know to be spread through: Hard Disks Floppy Discs CD/DVD/Blu-ray Discs Tape's Cartridge's BIOS and Secondary BIOS infections PCI equipment (I only know of lab-experiments like this, but ...


12

Thanks Alexandar O'Mara for pointing me in the right direction - it was a small tip, but it got me there. I ran nslookup with the domains and got: C:\Users\xxx>nslookup scorecardresearch.com Server: router.asus.com Address: 192.168.56.1 Name: scorecardresearch.com Address: 103.16.230.165 C:\Users\xxx>nslookup sb.scorecardresearch.com Server: ...


3

Since browsers and plugins like flash are not bug-free there is a non-zero risk that you can be attacked with malware just by visiting a web site or that your credentials gets stolen. These can be silent attacks (drive-by-downloads, cross-site-scripting, CSRF...) or social attacks (downloads of fake software updates, scareware, fake login,...). You will find ...


1

Going to web-pages can be dangerous. The most immediate danger is getting your browser hooked. These hooks act as anchors in your browser and allow the attacker to have some basic control over your browser. This can lead to further exploitation and, if the attacker plays it right, can end in you getting owned. If disabling JavaScript entirely isn't an ...


1

With proper encryption, it could be impossible to know that an encrypted file was originally an executable. Of course, if it gets redistributed in that exact same binary state, antivirus makers could identify a signature to recognize it. Such a distribution system would require a process to be already present on the client computer to decrypt and run the ...


1

There's a tool to detect packed .exes called PEiD . As for good-to-know stuff, check out this reading about how to detect packed .exes based on raw binary data. There are other tools like RDG Packer Detector, but most of them detect specific packers based on signature checking, so practically the same way an anti-virus does.


17

It certainly does. gdb will not isolate the process at all and will merely give you some control over it to understand what it does. To do that kind of analysis, you should resort to a fully isolated system such as a VM with no network access. Break points will be respected, but you should always account for human errors which can have drastic ...


6

I think your group is in fact a so-called Super Group. Super Groups work a little differently than normal groups and the one-check/two-check system doesn't apply here. All messages get double checks instantly when received by the server. (That's a feature.) The creator of your original group has clicked the 'upgrade to supergroup' button at some point, ...


2

My answer would require writing some code. I'm only posting this answer because you mentioned a programming related solution in your question. Ever since Window Vista, the windows kernel raises an event for basically every single thing that happens on your computer. Microsoft provides a library called TraceEvent for .NET that makes it absolutely trivial to ...


1

You can detect it by monitoring free space (very easy) or file writes (not that easy). The screenshots must be stored somewhere so files will have to stack up to a not-so-obvious location. This is the method I used, and I managed to locate and eliminate a multi-logger just by using a simple file manager.


3

The short answer, albeit deceiving without the long answer: Yes, a cookie can carry a virus. Yes, it is possible to get such a virus by merely visiting a website delivering the cookie. In the above paragraph, replace "a cookie" with "any file, data, or anything else," and replace "visiting a website" with "possessing," and the statement still holds true. ...



Top 50 recent answers are included