New answers tagged

1

Fresh code will not be flagged as malware, at least not by signature scanning (the most common form of analysis), someone needs to add the signature. Dynamic analysis can catch it, but there are ways around that too. Also, even old malware, with signatures on almost all antivirus, can be cloaked with the right tools. A polymorphic crypter can make malware ...


1

I'll add to the other good answers here that it is best practice to store exe's long term and rescan them regularly as signatures are updated. As for the possible dangers, it might do what you are expecting it to do and nothing more. It could do what you are expecting and also be a first stage that establishes persistence in your system then phones home ...


8

It is entirely possible for a file that is not detected by any scanner to still be malware. In fact, I would expect that most new malware starts out that way! Keep in mind that the bad guys have access to antivirus software too. And they will absolutely take advantage of that by making adjustments to their malware until no antivirus software detects it. (...


1

There are many information out there on how write or transport malware in order to bypass antivirus and other security products. And since attackers and vendors of security products continuously improve their products there will always be some some malware which passes AV, i.e. there will be no AV which is able to protect against every known and unknown ...


0

You will have to be careful where you download and store files, but there may be a simple solution. On your download directory, edit the security settings (right-click, Properties, Security tab, Advanced button) and add a deny entry for execution for Everyone. Do the same for any directory where you would store these files. Media files are only read, not ...


2

Malware sitting quiescently on your system is not a danger in the sense that it can spontaneously do something. The risk is more along the lines of, "Don't Push The RED Button!" The fact that it's there is an opportunity for mistakes. It could be a manual mistake of you inadvertently running it, or another program (like a Virus Scanner) finding it and ...


1

The company isn't 'attacking' your servers, rather it's just part of a scan that the company provides as a service to it's customers. On their website they claim they "scan the entire public internet to create real-time threat intelligence streams...bla bla bla". Basically they scan the internet, and provide the data to their customers. These logs are ...


0

Recommend running Tron and going from there. Tron is a script that fights for the user. It's a multi-stage bootable system cleaner. I find running it on clean Windows installs yields great performance afterwards, and works wonders for badly infected systems. It runs most of the tools mentioned in this page, plus a few others. You will also want to use ...


3

It's protected in the sense that malware cannot be installed on the unmounted encrypted drive. However it's still possible for the encrypted drive to be damaged or destroyed if the drive can be written. A simple dd to the raw unmounted drive can destroy it. ---- Edit ---- If the encrypted drive is a bootable drive, then there is an unencrypted boot ...


-1

I would like to add to and correct some of the initial comments regarding CDR. I would also like to highlight that I work for Votiro. There are many vendors who claim that they provide CDR. Most of the solutions on the market are taking a document and converting it to an image. This process is highly secure but not productive at all. We call this Level 1 ...


-3

Also, if the attacker didn't gain control of the account, why use it to enroll in all these services? First of all, some of the spam you are getting might actually be phishing attempts to lure you into revealing your password. Second reason, and maybe the most obvious: since all those sign-in attempts generate security notifications, the hacker obviously ...


6

The use of your email to sign up for services might be a coincidence and not being done by the party who logged into your account. I get a dozen of these types of "mistakes" a week from around the world due to my fairly generic email account. So, this set of events might not relate to the person who logged in. However, there are a couple of scenarios that ...


2

You have been confusing and combining many different concepts into one. To understand how all this works, you need to separate out all the functions separately. Each is simple by itself. Once the virus code is running, it can do what any other program can do on a computer. It can even trigger functions that already exist on the computer and other programs. ...


0

install ClamAV and feed your suspect files in for a scan ... if you own your incoming email server you can install ClamAV such that your email server automatically triggers such scans ... such a pairing is available from email server https://github.com/tomav/docker-mailserver ... I have been running this in prod for several years without too much fuss ... ...


2

As far as I am aware, MFA only protects your login to the GMail web mail service. If the attacker could successfully guess your password and you have IMAP client access enabled on your GMail account, he would still have had access to your emails up to the time where you changed the password. You should definitely review those access settings, check the trash ...


96

Should I be concerned about this? Yes. This should be of concern to you because an attacker was able to obtain the valid password for your Gmail account. From the details of warning you have provided, it looks like it is from fraud detection rather than an OTP failure. If it was an OTP failure, you would have received an OTP when that login attempt was ...


3

You shouldn't be concerned. Just as you said yourself, the attacker was blocked and you have changed the password. There are, however, some actions you should take: Verify that the discovered password does not hint at any other password you may have used anywhere else. Harden passwords of other accounts you hold that the attacker may deduce from the ...


0

… to stay safe from malware as much as possible. … … Is there any other extension that I should install? … Yes: a malware-oriented extension. I use Malwarebytes Browser Guard and Emsisoft Browser Security. Primarily the Malwarebytes extension. Take into consideration that NoScript will also increase the attack surface ...


2

Hypothetical questions like this are difficult to answer and are thus discouraged. In order to be able to receive specific answers, you would first actually need to have been infected by the malware. Second, you would need to be capable of discovering, extracting, and analyzing said malware before anybody would be able to tell you what you should be worried ...


-1

Browsers such as Chrome have a built-in malware download scanner which help detect malware in most files that you download. ZIP Files themselves normally add in a layer of protection from any .exe file from being accidentally used on your computer, as the file itself is encoded in the compression algorithm. The closest thing to a 'ZIP file virus' is a Zip ...


0

Blind - Cross Site Scripting (XSS) can be performed as per my guess. Due to unclear scenario I assume we are uploading a file but cannot execute it. So to exploit it back-end dashboard must be vulnerable to XSS. A file containing malicious JavaScript code in it can be uploaded to the server. For an example a SVG file containig following JS <svg><...


1

WannaCry does not have any VM detection features, at least according to all the existing analysis. WannaCry itself also does not launch the EternalBlue SMB exploit; the WannaCry dropper does. If you're just trying to use the unpacked crypter executable, you won't see it attempting to exploit EternalBlue. The first thing the dropper does is attempt to ...


3

Relevant talk: https://media.ccc.de/v/36c3-10737-sim_card_technology_from_a-z Our phones blindly connect to them every day. Wrong, towers need to authenticate; if you're not using obsolete 2G ciphers, that auth can and will be relatively secure. In fact, attackers can set up rogue towers that trick phones into connecting to them instead in order to ...


3

Is it possible to decode the md5 hash, and therefore learn which malicious website was using the back doors to my server? As for the (in)feasibilty to decode the md5 hash see for example here. In short: if it is simple you can brute force it, if it is complex it will be infeasible. But even if you would be able to decode the hash: it does not contain the ...


2

You're wasting your time. I'm trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market. Even the big names in software development can't protect their software from cracking. Despite very draconian DRM that drives legitimate users nuts, it all ends up on the pirate sites within days of ...


3

CDR Overview CDR (Content Disarm and Reconstruction) describes the process of creating a safe copy of an original file by including only the safe elements from the original file, as defined by the document manufacturer (e.g. Adobe for PDF, MSFT for Word etc.). CDR Advantages High Security Protects from known and unknown attacks. Deterministic – Since ...


1

I will explain both, DLL Hijacking & DLL Injecting. DLL Hijacking is a way for attackers to run unwanted code on your system. This means that if an attacker can get a file/program on your system (by social engineering, remote control, etc.) that file could be performed when the user runs an application that is vulnerable to DLL Hijacking. DLL injection ...


0

Windows searches for dlls in this order: it checks to see whether the requested dll is in KnownDlls(a list of dlls specified in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs) or not, if not it follows the Microsoft dll search order defined by MSDN here. Dll Hijacking: also known as load-order hijacking, affects only ...


4

CDR and analysis inside a sandbox are both techniques which have their own problems. Sandboxes can be bypassed by clever attackers by basing the behavior of the malware on environment and time and thus not showing malicious behavior inside the sandbox. CDR instead somehow must assume what kind of payload is allowed in the first place in order to remove ...


0

You can inject a stub in your target file, and make that this stub would be metamorphic and so as when it will be loaded into memory, your pe will have a lot of differentt signatures. But it's very long to create and to realize.


0

Can applications in recycle bins be executed? Or is there some mechanism that prevents deleted dlls and executables from being run? Yes, executables in the recycling bin can be executed. The $RECYCLE.BIN has a special purpose in Windows Explorer so items inside of it cannot be interacted with. This does not prevent the executables from being listed as a ...


0

Nothing here indicates for me a DNS tunnel and all the arguments you present yourself are against this too. The kind of URLs you see are not untypical for CDN or advertisement networks. Note that *.msn.com is specifically documented in the document you link to as "Windows Spotlight related traffic" and Windows Spotlight is according to Wikipedia "...a ...


0

Zip files can be malicious Just as most other types of files, zip files may be maliciously designed to exploit some security vulnerability in the application that will be opening them. For example, some 'unzipping' programs had directory traversal vulnerabilities that could allow an attacker to overwrite arbitrary system files in order to gain futher access ...


Top 50 recent answers are included