yara/rules_fuzzer: Incorrect-function-pointer-type in _start

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=4674537548414976 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzerubsanyara Platform Id: linux Crash Type: Incorrect-function-pointer-type Crash...

yara/pe_fuzzer: Heap-buffer-overflow in pe_parse_exports

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5839717883969536 Project: yara Fuzzer: libFuzzeryarapefuzzer Fuzz target binary: pefuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address:...

yara/pe_fuzzer: Heap-buffer-overflow in wide_string_fits_in_pe

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5211130361282560 Project: yara Fuzzer: libFuzzeryarapefuzzer Fuzz target binary: pefuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

yara/elf_fuzzer: Heap-buffer-overflow in parse_elf_header_64_le

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5012978286985216 Project: yara Fuzzer: libFuzzeryaraelffuzzer Fuzz target binary: elffuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 3 Crash Address:...

DHS Alert on Dragonfly APT Contains IOCs, Rules Likely to Trigger False Positives

A joint Technical Alert, TA17–293A, released over the weekend by the FBI and Department of Homeland Security describing the activities of a Russian APT may contain signatures and rules likely to trigger false positives in some security systems. The alert, made available Saturday morning, dissects...

A week in security (September 11 – September 17)

Last week, we dug into phishing campaigns done via Linkedin accounts, remediation versus prevention, issues with smart syringe pumps, and advised you to go patch against a Word 0day. We had some tips regarding identity theft protection, explored crowdsourced fraud, and explained YARA rules...

UPDATE: Cuckoo Sandbox 2.0.4

PenTestIT RSS Feed My previous post was about this open source, malware analysis automation framework - Cuckoo Sandbox 2.0.0. This post however, is about an update made to the framework. We now have Cuckoo Sandbox 2.0.4 which include a number of important improvements simplifying and improving yo...

Explained: YARA rules

YARA rules are a way of identifying malware or other files by creating rules that look for certain characteristics. YARA was originally developed by Victor Alvarez of Virustotal and is mainly used in malware research and detection. It was developed with the idea to describe patterns that identify...

Pharos: A Static Binary Analysis Framework

PenTestIT RSS Feed All of us know what static binary analysis means. It means that the analysis of the binary is performed without actually executing it. Almost two years ago, an open source framework - Pharos, was created by the Carnegie Mellon SEI, CERT Division in collaboration with the Lawren...

Threat Analysis: Word Documents with Embedded Macros Leveraging Emotet Trojan

Many customers have recently asked how Carbon Black's solutions detect macros and droppers specifically referencing Emotet dropper files. Customers often say that macros and droppers are an ongoing problem in their environments. They are also seen day-to-day by most practitioners. The analysis...

APKiD - Android Application Identifier for Packers, Protectors, Obfuscators and Oddities

APKiD gives you information about how an APK was made. It identifies many compilers, packers, obfuscators, and other weird stuff. It's PEiD for Android. For more information on what this tool can be used for, check out: Android Compiler Fingerprinting Detecting Pirated and Malicious Android Apps...

Serverless, Real-time Malware Detection: BinaryAlert

BinaryAlert is an open-source serverless AWS pipeline where any file uploaded to an S3 bucket is immediately scanned with a configurable set of YARA rules. An alert will fire as soon as any match is found, giving an incident response team the ability to quickly contain the threat before it spread...

Artificial Inteligent Packet Inspection Engine: AIEngine

AIEngine is a next generation interactive/programmable Python/Ruby/Java packet inspection engine with capabilities of learning without any human intervention, NIDS Network Intrusion Detection System functionality, DNS domain classification, network collector, network forensics and many others...

Fedora Update for yara FEDORA-2017-088b16a69a

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for yara FEDORA-2017-156d12fa2f

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 25 : yara (2017-1d46019681)

bump to 3.6.3 release - bugfix CVE-2017-11328 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 24 : yara (2017-944e86b623)

bump to 3.6.3 release - bugfix CVE-2017-11328 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

YARA object.c file heap buffer overflow vulnerability

YARA is a set of tools used to help software researchers identify and categorize malware samples. A heap buffer overflow vulnerability exists in the 'yrobjectarraysetitem' function of the object.c file in the YARA 3.x release. An attacker can exploit this vulnerability to cause a denial of servic...

Fedora 26 : yara (2017-088b16a69a)

bump to 3.6.3 release - bugfix CVE-2017-11328 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

[SECURITY] Fedora 25 Update: yara-3.6.3-1.fc25

YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families or whatever you want to describe based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strin...