There's an interesting new malware that is currently being distributed actively around the globe through phishing campaigns. This malware is a Trojan RAT, that poses as a version of the popular open-source archive utility PeaZip. The authors of this malware have copied the file info and make it look like a legit version of PeaZip. Careful analysis of this malware shows us that this infact is a Trojan RAT, that is falsely adverstised as PeaZip. In this article, we analyse this malware and discuss the findings. There are strong indicators that suggest that this is a re-packaged version of DarkComet…

Introduction Keymarble is a trojan malware that has recently been seen in the wild. US CERT released initial information about this malware late last week which can be accessed here - https://www.us-cert.gov/ncas/analysis-reports/AR18-221A In this article, we analyse the malware and try to understand the execution flow. We also look at some useful network IOC that can be extracted from the malware. Some of these have been documented in the release that has been linked above. We'll look at some other IOC that have not yet been released publicly. This is a quick analysis that…

The following process walks through how to mount an Apple Disk Image, or more commonly known as a .dmg file. This process walks through mounting the HFS section of a .dmg file on a Linux system to allow the extraction of files for further analysis. Step 1 - Checking The File Type To begin with, I usually check what type of .dmg file it is with the "file" command. This is done to understand if it is a compressed or uncompressed .dmg file. $ file application.dmg The output you could typically expect could be: application.dmg: data which…

Following a presentation I did for a SANS community night in Melbourne Australia recently, I had a lot of attendees ask if I could provide the graphical timeline that I presented which showed the events leading up to the discovery of WannaCry in May 2017. Below is that timeline with events unique to the WannaCry variant that got a lot of attention in the mainstream news in May 2017. I've tried not to dive too far down the rabbit hole of the EternalBlue exploit, and its use in other malware - which is most certainly occurring in the wild. I've…

In the aftermath of the WannaCry ransomware outbreak, what are the real lessons we should have all learned? Or even better, what should we be telling those not in the Cyber Security industry, so they don't fall victim to media hype or vendor spin. My hope is this information is also useful in clearing up any misinformation that's spread about WannaCry. This whole attack was not the result of a phishing email. No email type protections would have saved you from getting infected with WannaCry. The malware was spread via other users on the internet directly connecting to your network/…

Ever wondered how much metadata is included within the PDF files you email or share with others. Well, believe it or not, there is a lot that can be determined from a PDF you've created. This post looks at how to clean the metadata from your PDF files before you send them, and how to protect them, so they aren't easily edited or copied by a recipient. These techniques are sometimes referred to anti-forensics with the goal to limit the amount of forensic information you provide within a file that you have produced. If you're after the quick copy and…