HeaderLessPE

HeaderLessPE Introduzione 中文 HeaderLessPE è una tecnica di caricamento di PE in memoria utilizzata dal Trojan Icedid. Basandoci su questa tecnologia, proponiamo un nuovo modo di attacco senza file utilizzando HVNC. Questo miglioramento consente di iniettare HeaderLessPE per eseguire strumenti di...

SharpNoPSExec

SharpNoPSExec Esecuzione di comandi senza file per movimento laterale. SharpNoPSExec interroga tutti i servizi e ne seleziona casualmente uno con tipo di avvio disabilitato o manuale, stato corrente fermo e privilegi di LocalSystem da riutilizzare. Una volta selezionato il servizio, ne salva lo...

WMI Event Subscription Persistence

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' require 'msf/core/post/windows/powershell' require 'msf/core/post/file' class MetasploitModule 'WMI Event Subscription Persistence',...

WMI Event Subscription Persistence Exploit

This Metasploit module will create a permanent WMI event subscription to achieve file-less persistence using one of five methods. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell'...

Adware the series, part 6

In this series of posts, we will be using the flowchart below to follow the process of determining which adware we are dealing with. Our objective is to give you an idea of how many different types of adware are around for Windows systems. Though most are classified as PUPs, you will also see the...

Kovter becomes almost file-less, creates a new file type, and gets some new certificates

Trojan:Win32/Kovter is a well-known click-fraud malware which is challenging to detect and remove because of its file-less persistence on infected PCs. In this blog, we will share some technical details about the latest changes we have seen in Kovter’s persistence method and some updates on their...