Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

Filter by
Sorted by
Tagged with
0
votes
0answers
55 views

ThinkPHP show my website as the req.host - did the request really come from my web server?

I have ThinkPHP wordpress garbage coming at my server https://medium.com/@knownsec404team/analysis-of-thinkphp5-remote-code-execution-vulnerability-5de8a0afb2d4 , for example: /public/index.php?s=...
0
votes
2answers
748 views

I clicked on a grabify link and I don't know if it installed a virus [duplicate]

I was in a discord recently and someone sent a grabify link. I clicked on it and it led me to a soundcloud page. I think my firewall on my router is alright, is that enough to prevent them from doing ...
1
vote
1answer
330 views

Can I get malware from a .rar file without opening it in Android?

I was on a group with almost 200k people on it in Telegram. One of these members (probably new, his account is now deleted) sent me (and to other people too) a file named "Customer deposit H.rar&...
4
votes
3answers
1k views

Is Firefox's new JavaScript support within PDF files a security concern?

Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
0
votes
0answers
68 views

Using PEframe tool to find indicators of compromise

I try to find some indicators of compromise through the PEframe tool. Firstly, by using the volatility tool, I found out that there is a DLL file that is malicious. I checked it with the help of Virus ...
1
vote
0answers
87 views

Detecting and understanding malware/spyware [closed]

Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around. Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...
1
vote
1answer
126 views

What's the point of Empire if all payloads get flagged?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
0
votes
2answers
122 views

What could re-enable uPnP on router apart from malware?

I'm the sole person who has access to this router. I turned uPnP off and have twice found it turned back on in recent weeks. The Router is Asus DSL-AC68U. I have a VPN running at the router level, ...
0
votes
1answer
215 views

Check USB mouse for malicious code

When I first used this mouse and keyboard, my PC died shortly after. Today I used it and it somehow corrupted my Linux. I once put a clean Linux on a laptop and plugged this mouse in and left it, ...
0
votes
0answers
22 views

Is it ok to give out IP address to web developer [duplicate]

I’m currently working with web developer and he ask for IP address. Is it ok for me to send or is he trying to give me a virus or something
0
votes
1answer
573 views

I clicked on a grabify link. What can someone do with my IP? [duplicate]

I clicked on a link in discord not knowing it was a grabify link. I understand that an IP only gives your general location but what else can someone do with my IP? Can they find a way to access my ...
1
vote
0answers
57 views

watch-video.net malware and preventing these types of infections at the network level [closed]

How does a computer get infected with watch-video.net malware, and why aren't popular tools like windows defender or malwarebytes able to detect and remove it? Is there a practical way to prevent ...
2
votes
1answer
1k views

How to replace certain backup files on a website every 30 minutes? [closed]

I have a website built with WordPress, unfortunately somebody hacked it several times, deleted my adsense code and put his own adsense. I tried many security techniques, changed database name, did ...
1
vote
0answers
80 views

Do modern video game consoles sandbox games? [closed]

If for example there is a game, that is specifically designed to try to get control of your game console or to be able to provide the user of the game control over their system and somehow got onto ...
1
vote
1answer
173 views

Are emulators isolated from the host for malware testing?

I know that virtualization is different from emulation; I was wondering if emulation is isolated from its host and any destruction on it will not affect the host as if it were a virtual machine. I ...
0
votes
0answers
42 views

Wondering if a USB dongle for gaming controller could have malware installed [duplicate]

I purchased a usb gaming controller used. It has a usb dongle that plugs into the PC and a I assume its bluetooth. Is it possible for the USB dongle to contain a keylogger that starts up when I plug ...
1
vote
2answers
506 views

Embedding malicious code into an exe

How does malware usually embed into / infect exe files? (As in actually modifying the file on disk, not in memory). I've read it may look for gaps in the code section, insert its code, then redirect ...
0
votes
1answer
236 views

Can a text file disguised as .xlsm be malicious?

A hour ago we receive a suspicious mail targeting some of our mailing lists. It contains a .zip file, itself containing a .xlsm file. This .xlsm file appears to be recognized as an ASCII text file ...
0
votes
1answer
134 views

Infecting peers downloading files using BitTorrent protocols

I have read about BitTorrent protocols and how uTorrent works specifically. The main idea is that instead of many clients accessing the same server for downloading a file, different parts of the file ...
1
vote
1answer
140 views

Is it possible for a javascript malware to put keylogger extension in my browser? [duplicate]

I clicked on "It's like you" virus in Facebook Messenger. Then I archived the original link with archive.ph (archive.today), and during the process the site showed me this: https://pastebin....
2
votes
3answers
242 views

How does the government install a trojan horse on somebody's mobile phone?

I am reading a news article (in italian) in which the police snooped on the Dean of a university by a trojan horse that the police had installed on his mobile phone. In particular, the trojan horse ...
-2
votes
1answer
111 views

Unathorized Access to Google Drive

My Google Account was hacked granting unauthorized access to YouTube and Google Drive. The third party immediately started posting inappropriate content on YT which prompted an email from Google after ...
1
vote
1answer
376 views

If a file has previously been scanned by VirusTotal, will the VirusTotal website always indicate this fact?

I recently downloaded a very popular open-source application. Usually, I compile open-source applications myself after reading the source code. But my compiler box was busy with many tasks, so I ...
0
votes
0answers
94 views

How to read output of a Reflective DLL?

Reflective DLL Injection is one of the most interesting and best techniques to run custom code in memory. I've been learning about it a lot, I've learned how to pass in inputs, But I can't figure out ...
1
vote
0answers
159 views

Is this javascript code malicious? [closed]

a friend visited this site: h-t-t-p-s://adidastore.buzz/adidass/tb.php?_t=1614958342 I malformed the url so no one accidently clicks on it Below is the code the site is serving. I don't know ...
2
votes
4answers
263 views

Can a antivirus software detect a malware that steals data?

For example, consider a software that wants to package all txt files in the /user/Desktop directory and upload them to its own server. I am not a programmer, but I know it can be done very easily with ...
1
vote
1answer
189 views

Is it possible to get malware from .txt files? [duplicate]

I want to know is it possible to get malware from .txt files? I think it's possible, because a program executes the .txt file and program may get infected. If it is, how?
1
vote
0answers
74 views

I searched "Amazon.com" in Opera quicksearch and it led me to a strange page [closed]

I searched "amazon.com" in Opera quicksearch and it led me to this site: http://iyfnzgb.com/?pid=9PO1H9V71&dn=amanzon.com Is it malicious? Opera didn't open a proper internet page, only ...
1
vote
2answers
140 views

Can scripts execute virus on its own if we only open it in an IDE or Notepad?

If you download scripts such as file with extension such as .py, .java, .cs, .cpp, etc and if you don't run it but only open it in an IDE or notepad then will the virus get executed or is this ...
3
votes
0answers
56 views

How do malware analysts know when malware is state-sponsored? [duplicate]

When reading malware-analysis posts, I see researchers talking about sophisticated state-sponsored actors. How can researchers know when something is state-sponsored from their code/C2 servers alone?
0
votes
0answers
17 views

Unknown user directory on Windows with funky file names [duplicate]

Poking around my machine today, realised there's an unknown user listed in there: tVA2uiJ14w First I thought it could be some IT account, but then again the filenames are too funky to be business ...
0
votes
3answers
831 views

Can Android spyware like Pegasus survive flashing of a new ROM?

I live in a country that is not fully authoritarian but is increasingly illiberal. State agencies have been caught misusing spyware to target activists and dissidents on multiple occasions. Given ...
2
votes
1answer
118 views

Found a backdoor and multiple trojans in a computer. Is the hacker doing everything manually? [closed]

So I found a backdoor, multiple trojans and crypto miners in a client's PC. He is worried that his personal information has been compromised. What happened: During the installation of Kaspersky anti-...
1
vote
0answers
56 views

Exploitation of Resource Packages in Java

I understand this might be a usual question but I thought it'd be interesting to get people's feedback regardless as this relates to security. In games, in particular I am thinking about Minecraft, ...
0
votes
2answers
156 views

How do servers protect against straight up sending a HTTP request that is actually some malware or HTML code? [closed]

I know servers have something to block you from just sending them an HTTP request that is actually some malware or a webpage that is malicious, because it would be so easy to just spam HTTP requests ...
1
vote
2answers
174 views

Can I be sure a Word document is safe if it doesn't have macros

I am aware that MS Word documents can be potentially dangerous due to the executable macros contained within them. But for a particular document, I have opened the macros and can see there are none. ...
54
votes
6answers
20k views

If malware does not run in a VM why not make everything a VM?

There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make ...
3
votes
2answers
1k views

How to protect from dependency confusion attacks?

I recently came across following article https://www.bleepingcomputer.com/news/security/researcher-hacks-over-35-tech-firms-in-novel-supply-chain-attack/ it describe about an exploit which exploit ...
0
votes
1answer
174 views

How secure is Heads for detecting tampering or infection of firmware or boot sector? (Pureboot)

I'm thinking of getting a Librem laptop with Pureboot which uses Heads (with the Librem key) for tamper detection. But I've heard rumours that there are weaknesses or vulnerabilities so I wanted to ...
1
vote
1answer
135 views

How does malware avoid AV's when using a simple DLL injection technique?

As far as I understand it, a simple approach for a malware DLL injection would require 2 DLLs. The first for the DLL side loading, while the malicious DLL remains encrypted. And then this 'loader' ...
1
vote
0answers
123 views

Virustotal alerts for Surfshark VPN [closed]

Virustotal is giving some alerts for the Windows installation of Surfshark VPN. I am sure they are false positives, I just wanted to hear what other users say about this...
16
votes
1answer
5k views

Norton detects intrusion attempt from virtual machine - how is this possible?

Sometimes I have to fix an infected WordPress website. I always check the infected website from a virtual machine (Oracle VM VirtualBox). I'm also running Norton 360 DeluXe on the host machine. In the ...
4
votes
2answers
265 views

Wireshark - How to monitor TLS traffic from a malware? (It does not write into the SSLKEYLOGFILE)

I recently found malware that uses TLS 1.2 to communicate with the c2 server. I wanted to check the content of that but is encrypted. I have tried the method with the SSLKEYLOGFILE but unlike for ...
0
votes
0answers
108 views

I suspect that my mac laptop is infected with malware that can view all my activity. What should I do?

Is it sufficient to reformat with a new osx install. If so, can the malware persist in cloud syncing programs like adobe creative cloud, icloud, onedrive and google drive?
1
vote
0answers
25 views

Can I safely view a malicious PDF in gmail or dochub? [duplicate]

I receive pdfs that could be malicious. Is it safe to view them within Gmail? What about DocHub? Is that the same as 'opening' them? (FYI I use Firefox as a browser)
2
votes
1answer
134 views

Wayback machine downloading a file called default.exe?

When I look up a site on wayback machine, I click through a couple of links on the site, and then instead of loading the page, it downloads a file called "default.exe". Since I was expecting ...
1
vote
0answers
71 views

Intercept HTTP requests for invalid domains in Linux

I am using Ubuntu 18.04. When making a HTTP request to invalid domains, I get a HTML page with javascript code that redirects me to uniregistry a landing page. More specifically, when trying to load ...
0
votes
2answers
102 views

Is there any way to validate the firmware in a USB flash drive?

I bought a pair of USB flash drives made by Huawei and I want to know if there are any tools in existence for verifying that the firmware on these drives is secure. I bought them for researching this ...
0
votes
0answers
93 views

How to protect a vulnerable Family Member?

I apologize if this isn't the best exchange to be asking in, but I'm a little new at this. Problem: A close relation outside my local area with declining cognitive function is demonstrating ...
1
vote
1answer
351 views

Can a malware steals my Facebook c_user, xs, and datr Cookies?

Just as the title suggests. I have a PasswordStealer on my PC and I'm afraid that it can do that. AFAIK, that malware can record keystrokes and steal saved passwords which I don't mind because I don't ...

1 2
3
4 5
47