Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

172 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
0answers
112 views

How to find malware added in supply chain to Android phone?

As has become a mainstream news story many times over, some Android phones are being shipped with malware preinstalled, because they go from factory to a second party who adds the malware and then to ...
5
votes
0answers
398 views

How to deal with Sage Ransomware 2.2 infection?

My PC got stuck like this: It's a Sage 2.2 Ransomware. How do I fix this? Does restoring the system help me?
5
votes
2answers
297 views

What allows for reinfection of the same PUP after quarantine and removal?

I use an antimalware program- the scan finds a PUP (Potentially Unwanted Program), which is quarantined and removed. It comes back! I am guessing it is stored somehow to resurface after normal shut ...
4
votes
0answers
128 views

What security isolation exists between VDI instance to VMware Horizon to ESX?

I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to ...
4
votes
0answers
249 views

Comodo Firewall HIPS (Paranoid Mode) Regedits

I've activated Comodo HIPS on "paranoid mode" to firstly see if I have an intrusion via my router but moreover to understand processes that occur. As of recent, I have had a lot of requests ...
4
votes
1answer
624 views

Suspicious Skype IP connection

I'm posting this three weeks after a malware and keylogger scare that happened through Skype, and my own negligence, which resulted in a fresh install of Windows 7. Everything's running and clean, ...
3
votes
1answer
231 views

Kinsing Malware entering via compromised Dockerhub Images?

I got a server infected with the Kinsing malware, which mines crypto on your server, maxing out your CPUs. The malware initially creates the files /tmp/kdevtmpfs and /tmp/kinsing If you delete these ...
3
votes
0answers
125 views

First Known Client/Server Architecture Malware

What malware was the first to use a client-server architecture to relay commands? The earliest that I could find appears to be NetBus which was written in early 1998. The next closest would be Back ...
3
votes
0answers
131 views

How did Stuxnet prevent the user from seeing the malicious files on a USB stick?

From what I can tell there were two main TMP files present on the infected USB stick. The smaller of the two would run first and hook various functions related to viewing files so as to hide the LNK ...
3
votes
0answers
74 views

Burst and rebuild pdf to discard eventual embedded malware

This question deals with how to scan, while i am curious if my acrobat reader DC is compromised but in an isolated container and i pull out the pdf. Is it safe to disassemble the pdf by pdftk burst .. ...
3
votes
2answers
477 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
3
votes
1answer
2k views

Potential router malware? Receiving "Access Denied" and other weird blocks from various websites

So I've been having some weird browsing behavior over the last few weeks and it's gotten a lot worse the last few days. I've been getting blocked/banned by various websites off and on. Here are a few ...
3
votes
0answers
95 views

Search function in Outlook and attachements

I am wondering how the search function of Outlook is working, especially in regards to researching key words that are presents in emails attachements. Does the Outlook search function opens the files ...
3
votes
2answers
481 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
3
votes
0answers
75 views

What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?

Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
3
votes
0answers
144 views

Need Security advice on virtualization and windows security

I have a little doubt about the security of my virtual machine and Windows. Can anyone please point me in right direction? Below is my what, how and why I made my virtual machine. Let me tell you what ...
3
votes
0answers
147 views

Wikileaks Vault 7 'WheepingAngel' SmartTV Malware

I investigated a little about the WheepingAngel Malware that was recently leaked due the 'Vault 7 CIA Leaks' by Wikileaks. What i couldn't find where the actual CVEs that enable WheepingAngel to ...
3
votes
0answers
685 views

Does storing user files in S3 ensure that my server is secure from user uploaded malware?

Consider a common scenario where I'm using an Amazon S3 bucket to store the files uploaded by my users and not in my actual server. So, all the files the user uploads, go to the s3 bucket, and doesn't ...
3
votes
0answers
115 views

Special characters found in logs?

Whilst reviewing logs for a PC we believe to be compromised, we noticed that we had special characters in the authentication failure logs originating from the PC itself. By this I mean that the logs ...
3
votes
0answers
250 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
3
votes
1answer
320 views

Malware Analysis for Internet of Things Malware

How do we do malware analysis for Non-Windows based datasets? In the Internet of Things, a good percentage of devices are neither windows based, nor Linux nor Mac nor Android. They are sensor and ...
2
votes
0answers
93 views

Process Injection and Process Isolation by OS

If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
2
votes
1answer
140 views

New trend? Recognizable and specific subject in Spam / malware mails

It seems that a new trend has emerged in the past few weeks. While users are (meanwhile) aware that an unexpected mail with subject "Your invoice" or "Your delivery" is suspicious, ...
2
votes
0answers
343 views

How do EDR prevent you from uninstalling even as local admin?

I have an CrowdStrike EDR and it seems like the only way to disable this on all OS is to provide maintenance-token or ask CrowdStrike to disable the defences so you can uninstall it. I also have a ...
2
votes
0answers
151 views

Using other programming languages for malware against EDR?

As an example, one of the most basic malware to inject into a process to get a C2 beacon goes like this: Get Handle of a process -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread ...
2
votes
0answers
257 views

What is the current (mid-2020) status of hardware rootkit/malware and possible detection/monitoring?

I've posted a question (link) related to a potential compromised computer via SSH access with root user. Although no evidence of a break-in, I'm considering extended measures to ensure (as much as ...
2
votes
0answers
85 views

Can binary firmware packages be executed on the system?

Kernels like linux-libre (standard in Debian and other free Linux distributions) ship no binary firmware packages by default. From my limited understanding of their functionality, a binary firmware ...
2
votes
0answers
136 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...
2
votes
0answers
88 views

Can malware in Android persist after reformatting/reinstalling?

Something similar to this happened to me recently. According to the suggested actions in the post: Do take the device into the dealer and make them explain what those messages are. If they can't ...
2
votes
0answers
238 views

Exploit Development - Bad chars

I'm learning exploit development and while writing an encoder i was wondering what was the root cause of "bad chars" ? The only explaination i could think of is that, in the case of a buffer overflow,...
2
votes
0answers
70 views

Invocation of a trusted NodeJS script tries to connect to unkown IP

I have a houskeeping script which I invoked using node index.js which got me this output The error is because you cannot connect to the IP, but why would it try to connect to it in the first place? ...
2
votes
0answers
233 views

BlackEnergy2 vs. BlackEnergy3: Which one targeted HMIs?

Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation. The ...
2
votes
0answers
93 views

Malware abusing SSH agent active keys

I am thinking about this lately a lot, so I wanted to get someone else's opinion. Let's say that I have an SSH key agent (e.g. Pageant or ssh-agent) running in background with loaded keys (keys were, ...
2
votes
0answers
268 views

Is This a Virus?

i want to ask about a program is it a malware or a program from mozilla? When i turn on my pc it start normally but i see an open program called update.exe and it have a firefox icon on it, when i ...
2
votes
1answer
946 views

Antivirus warns about processes trying to access my webcam

For the last two weeks I am constantly getting notifications from my antivirus about attempts of using my webcam. I have always chosen "Block access", often after checking "remember for this ...
2
votes
0answers
123 views

Are there any malware for USB-connected printers

At work, we have a printer/scanner that connects only to USB. As far as I know, no one who uses it has a print server on their computers so I'm not sure it's accessible over the internet. Because most ...
2
votes
0answers
125 views

How to get malware campaign runners to use my mail honeypot?

I have a working mail honeypot but have yet to receive any malware. I've already tried submitting my domain to several unsubscribe forms, but it does not seem to have worked. Any suggestions would be ...
2
votes
0answers
505 views

Can VBR rootkit survive format?

I found this article which talks about a rootkit which infects the VBR and creates a virtual file system in unallocated space between partitions. I know that there are MBR rootkits which cannot be ...
2
votes
0answers
83 views

Wannacrypt - MS Outlook email

I use MS Outlook for email and have an exchange account such that the email is stored on my laptop as well as in the cloud. Is it safe to rely on the cloud version of the mail as a backup in the event ...
2
votes
0answers
74 views

Unwanted browswer redirection

I use IE 10 on Windows 10, and when I type www.outlook.com, my Facebook page opens! I can type www.msn.com and use it to get to the email, but what is causing this and how to fix it? I tried several ...
2
votes
0answers
141 views

What is the typical half-life of a virus/worm on the internet?

I am curious about the typical half-life (i.e., loosely relating to radioactive half-life here), if one has been measured/estimated, for the average virus/worm on the internet. Has anyone done a ...
2
votes
0answers
56 views

Can I trust LPS?

LPS protects against spyware/malware by booting an OS from trusted media without reading from hard drives. However, not all components are open source. How do I know the US DoD didn't include ...
2
votes
0answers
583 views

Novicorp WinToFlash Lite, spyware etc

I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick. While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
2
votes
1answer
592 views

Feasibility of persistent iOS malware which survives factory reset

Generally speaking, when an iOS device is purchased, it will be a couple of security updates behind the latest version of iOS. This means that in many cases, out of the box an iOS device will be ...
1
vote
0answers
32 views

Is "drag-drop files" computer backup sufficient to avoid most malware/ have all my files?

I'm debating dragging all my files onto an external hard drive manually - rather than a time machine backup - and then pulling over any specific files I need if I ever need them. Afterwards, I'll ...
1
vote
1answer
82 views

Cross OS GPU based malware

I've been doing some research into GPU based malwares, and would like to know if there is a way to run them on a dual boot scenario with the code being executed only on one Operational System and be &...
1
vote
0answers
97 views

How can I know if phone is already infected?

Last year, my friend who is learning hacking for nearly 3 years hacked my phone using social engineering by installing some malware in my phone. (After researching on Google, I think it might be a ...
1
vote
1answer
170 views

Are emulators isolated from the host for malware testing?

I know that virtualization is different from emulation; I was wondering if emulation is isolated from its host and any destruction on it will not affect the host as if it were a virtual machine. I ...
1
vote
1answer
356 views

If a file has previously been scanned by VirusTotal, will the VirusTotal website always indicate this fact?

I recently downloaded a very popular open-source application. Usually, I compile open-source applications myself after reading the source code. But my compiler box was busy with many tasks, so I ...
1
vote
0answers
49 views

Exploitation of Resource Packages in Java

I understand this might be a usual question but I thought it'd be interesting to get people's feedback regardless as this relates to security. In games, in particular I am thinking about Minecraft, ...