Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

4
votes
0answers
373 views

How to deal with Sage Ransomware 2.2 infection?

My PC got stuck like this: It's a Sage 2.2 Ransomware. How do I fix this? Does restoring the system help me?
3
votes
0answers
184 views

Why is Spotify using my webcam (AppleCamera)

I'm running Mac OS Mojave. I've just run the following command into terminal to see which applications are using my web cam. lsof | grep "AppleCamera" Google and Spotify showed up: Spotify 668 ...
3
votes
0answers
75 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
2
votes
0answers
90 views

What security isolation exists between VDI instance to VMware Horizon to ESX?

I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to ...
2
votes
0answers
152 views

Eventviewer empty logs with English written in Cyrillic Greek

So a while ago I entered my event viewer on windows 10 and I noticed a bunch of weird entries. They look like they where written in English but with the use of Cyrillic and Greek alphabets. I am ...
2
votes
0answers
109 views

BlackEnergy2 vs. BlackEnergy3: Which one targeted HMIs?

Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation. The ...
2
votes
0answers
79 views

Search function in Outlook and attachements

I am wondering how the search function of Outlook is working, especially in regards to researching key words that are presents in emails attachements. Does the Outlook search function opens the files ...
2
votes
0answers
139 views

Comodo Firewall HIPS (Paranoid Mode) Regedits

Old time lurker and odd poster here with a general question. I think this might fall more in the nature of understanding system processes. I've activated comodo HIPS on paranoid mode to firstly see ...
2
votes
0answers
56 views

What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?

Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
2
votes
0answers
89 views

Need Security advice on virtualization and windows security

I have a little doubt about the security of my virtual machine and Windows. Can anyone please point me in right direction? Below is my what, how and why I made my virtual machine. Let me tell you ...
2
votes
0answers
118 views

Wikileaks Vault 7 'WheepingAngel' SmartTV Malware

I investigated a little about the WheepingAngel Malware that was recently leaked due the 'Vault 7 CIA Leaks' by Wikileaks. What i couldn't find where the actual CVEs that enable WheepingAngel to ...
2
votes
0answers
471 views

Does storing user files in S3 ensure that my server is secure from user uploaded malware?

Consider a common scenario where I'm using an Amazon S3 bucket to store the files uploaded by my users and not in my actual server. So, all the files the user uploads, go to the s3 bucket, and doesn't ...
2
votes
0answers
96 views

Special characters found in logs?

Whilst reviewing logs for a PC we believe to be compromised, we noticed that we had special characters in the authentication failure logs originating from the PC itself. By this I mean that the logs ...
2
votes
0answers
225 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
2
votes
0answers
284 views

Creating a dynamic malware analysis environment

I don't know much about malware analysis so why this question here. I have analysed Short cut virus statistically and its impact on USB drives and wrote a code to repair its damage. My static ...
2
votes
0answers
43 views

Can I trust LPS?

LPS protects against spyware/malware by booting an OS from trusted media without reading from hard drives. However, not all components are open source. How do I know the US DoD didn't include ...
2
votes
0answers
375 views

Novicorp WinToFlash Lite, spyware etc

I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick. While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
2
votes
0answers
164 views

Is the process Wslxrqjet.exe, tagged 'Google Chrome', malicious?

Multiple instances (between 3 and 15) of this of this process Wslxrqjet.exe are running on my Windows 8 system at all times. Windows Task Manager 'Description' field for all instances is "Google ...
1
vote
0answers
89 views

Exploit Development - Bad chars

I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ? The only explaination i could think of is that, in the case of a buffer overflow,...
1
vote
0answers
47 views

Invocation of a trusted NodeJS script tries to connect to unkown IP

I have a houskeeping script which I invoked using node index.js which got me this output The error is because you cannot connect to the IP, but why would it try to connect to it in the first place? ...
1
vote
0answers
35 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
1
vote
0answers
206 views

Weird Python script found on a Mac Os X client machine

I was reviewing a Mac Os X machine (a late 2016 MacBook Pro) and I found some weird scripts in the LaunchAgent folder. 8 -rw-r--r-- 1 XX wheel 500 30 Lug 07:18 com.1e1zq.plist 8 -rw-r--r-- 1 XX ...
1
vote
0answers
147 views

Is This a Virus?

i want to ask about a program is it a malware or a program from mozilla? When i turn on my pc it start normally but i see an open program called update.exe and it have a firefox icon on it, when i ...
1
vote
0answers
57 views

Are there any malware for USB-connected printers

At work, we have a printer/scanner that connects only to USB. As far as I know, no one who uses it has a print server on their computers so I'm not sure it's accessible over the internet. Because most ...
1
vote
0answers
104 views

How to get malware campaign runners to use my mail honeypot?

I have a working mail honeypot but have yet to receive any malware. I've already tried submitting my domain to several unsubscribe forms, but it does not seem to have worked. Any suggestions would be ...
1
vote
0answers
353 views

Can VBR rootkit survive format?

I found this article which talks about a rootkit which infects the VBR and creates a virtual file system in unallocated space between partitions. I know that there are MBR rootkits which cannot be ...
1
vote
0answers
240 views

Malware Analysis for Internet of Things Malware

How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
1
vote
0answers
71 views

Wannacrypt - MS Outlook email

I use MS Outlook for email and have an exchange account such that the email is stored on my laptop as well as in the cloud. Is it safe to rely on the cloud version of the mail as a backup in the event ...
1
vote
0answers
61 views

Unwanted browswer redirection

I use IE 10 on Windows 10, and when I type www.outlook.com, my Facebook page opens! I can type www.msn.com and use it to get to the email, but what is causing this and how to fix it? I tried several ...
1
vote
0answers
119 views

What is the typical half-life of a virus/worm on the internet?

I am curious about the typical half-life (i.e., loosely relating to radioactive half-life here), if one has been measured/estimated, for the average virus/worm on the internet. Has anyone done a ...
1
vote
0answers
559 views

Actual example of strcpy exploit?

IIUC the C function strcpy copies the character string x to the character string y . void strcpy(char x[], char y[]) { int i = 0; while (x[i] != 0) { y[i] = x[i]; i = i + 1; ...
1
vote
0answers
132 views

Secured Web Browsing

What can be done to make a setup for super secured web browsing? I've been looking at something like this: Windows host > Sandboxie > Virtualbox > Linux Guest > Web Browser (Chrome with uBlock ...
1
vote
0answers
117 views

Does KillDisk use existing commands on a server to encrypt the data?

I've been reading up on this KillDisk exploit for Linux. https://www.bleepingcomputer.com/news/security/killdisk-ransomware-now-targets-linux-prevents-boot-up-has-faulty-encryption/ Does anyone ...
1
vote
0answers
61 views

Will Gooligan or Gooligan-like near-future variants be capable of targeting Marshmallow users?

Android malware called Gooligan has already surpassed it's infection points up to 1M+ in Android market which targets Jellybean & Lollipop. Seems it doesn't work for Mashmallow due to security ...
1
vote
0answers
46 views

Forwarding requests to known suspicious site to an isolated server

I keep getting IPS alerts for suspicious DNS requests for a known host with malware. I can't find anything from the Windows DNS logs from the domain controllers because it just shows the source ...
1
vote
0answers
137 views

Is this link dangerous with source?

I received a suspicious email from a friend of mine with stange name of the form first.last@zs3.szczecin.pl, where first and last are his/her first and last names. But the domain is totally awkward. ...
1
vote
0answers
153 views

Is Norton Mobile Security for Kindle Fire a Fraud? (or Malware?)

I downloaded a security app to my Kindle Fire a few months ago, (in this case Norton Mobile Security), and I am doubting it's authenticity now. Why? Because of these reasons: Reason 1: The 5-star ...
1
vote
0answers
46 views

Are there any methodology for malware in case of threat assessment?

Malware is a threat in security assessment. Are there any criteria to assess malware in case of threat assessment?
1
vote
0answers
101 views

Volatility Plug-ins to investigate packed exe files

I am using volatility for malware analysis. I have got a process in my memory image that is packed by malware using UPX packer. Malfind plugin doesn't show injected code for it also. How can i use ...
1
vote
0answers
169 views

Bizarre HTTP requests to VPS, former malware command and control server?

I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP ...
1
vote
0answers
289 views

How exactly does the HummingBad Android malware gain root access?

I've read a little bit in the last few days about HummingBad, an Android virus which tries to gain root access. It seems to use the root access to display ads and install apps. Varying estimates put ...
1
vote
0answers
176 views

How to prevent cache-based side-channel attacks in IoT devices

The sharing of hardware resources from various vendors in the Internet of things is fundamental for efficient processing in the cloud. The presence of a myraid of clients accessing the same hardware ...
1
vote
0answers
122 views

Is it suspicious that mail server sends traffic to Tor Exit node?

I am monitoring the outbound traffic from mail server through IDS and recently I observed there were some traffic sending to Tor Exit nodes from mail server, for example, IP 46.183.85.124. After doing ...
1
vote
0answers
64 views

Polymorphic Analysis

I'm a beginner at malware analysis. For my research studies, I have to identify polymorphic malware based from experiments. I would like to know if there are any guides showing how to analyze the code ...
1
vote
0answers
280 views

How Skype Click to Call plugin is used to send spam?

My friend had Skype Click to Call plugin installed within browser on Mac OSX. And his Skype account started to send some automatic spam messages linking to lose weight websites (via goo.gl) without ...
1
vote
0answers
133 views

Access android internal storage for full passive deep malware scan?

Is it possible to passively (with a computer) view/scan all content on an android mobile device's internal storage without crackopen/damaging it? For a deep malware scan of the whole storage of the ...
1
vote
0answers
66 views

cuckoo sandbox - PID exit

I hope someone could help me I've played with cuckoo for a while however I've just done a new installation and it all works however it will not run the binary i would like to scan. the PID exits ...
1
vote
0answers
175 views

Does this pdf file embeds an exploit or malware?

So a friend of mine was sent a phishing attack(Which was tailored for him and he fell for it) which also downloaded this pdf file: hxxps://www.dropbox.com/s/qw9mcw9p3pmc5j5/resume.pdf?dl=0 and he ...
1
vote
0answers
309 views

Linux: Chinese Unionpay plugin, Ubuntu 64-bit - Spamware / Trojan?

China / Linux / Bank / Trojan / Backdoor / Executables Hey guys. I've got an account with a Chinese bank (I live here), and in the process of setting up an online account for the Chinese version of ...
1
vote
0answers
168 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?