The state of ransomware among SMBs

In a report conducted by Osterman Research and sponsored by Malwarebytes, more than 1,000 small and medium-sized businesses were surveyed in June 2017 about ransomware and other critical security issues. What we discovered was surprising—ransomware authors aren’t only targeting enterprise...

Adware the series, the final: Tools section

So far in this series, we have handed you some methods to recognize and remediate adware. We used this diagram as a guideline. During this journey, we have touched upon several free tools that we used to get some insight on what type of infection we were dealing with and where the adware could be...

A .NET malware abusing legitimate ffmpeg

There is a growing trend among malware authors to incorporate legitimate applications in their malicious package. This time, we analyzed a malware downloading a legitimate ffmpeg. Using this application, this simple spyware written in .NET got a powerful feature. Most of the malware is sufficient...

Learning PowerShell: The basics

I bet I went about learning PowerShell the wrong way, so I may need your help, readers of this blog. If only to organize my knowledge and use it for the fight against malware and not just to figure out how it was used in malware. The first serious look I had at PowerShell was when I was trying to...

EternalPetya and the lost Salsa20 key

We have recently been facing a huge outbreak of a new Petya-like malware armed with an infector similar to WannaCry. The research is still in progress, and the full report will be published soon. In this post, we will focus on some new important aspects of the current malware. The low-level attac...

A week in security (June 19 – June 25)

Last week, we expanded on all the different technologies that Malwarebytes uses to break the attack chain and our Incident Response solution. We also warned you about a Roblox Robux generator scam and a phish targeting customers of Barclays Bank. Below are notable news stories and security-relate...

Solution Corner: Malwarebytes Incident Response

Unless you’ve been stuck at a fiery music festival, I don’t need to tell you the threat landscape is constantly evolving and that threats have become increasingly sophisticated at evading detection. Recent Malwarebytes Labs reports, including the 2017 State of Malware shine a light on just how fa...

Malwarebytes Anti-Malware < 2.0.3 / Anti-Exploit < 1.03.1.1220 - Update Remote Code Execution

Exploit for windows platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Malwarebytes Anti-Malware and Anti-Exploit Update Remote Code Execution...

Malwarebytes Anti-Malware - Customized SSL, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Malwarebytes Anti-Malware published at the 'play' market has multiple vulnerabilities...

Malwarebytes Handles PE Files with Memory Corruption Vulnerability

Malwarebytes is an antivirus program. Malwarebytes handles PE files with a memory corruption vulnerability. Due to by constructing malformed PE format samples can crash the antivirus program. If successfully exploited, it can lead to arbitrary code execution...

CVE-2 0 1 6-1 0 1 9: a Magnitude attack tool flash vulnerability-vulnerability warning-the black bar safety net

Last month, Proofpoint has a security researchers found the Magnitude of attack tools there appears to be some new stuff. So in their cooperation we analyzed the sample and found that Magnitude EK added before exist in the Adobe Flash Player Vulnerability, cve-2 0 1 6-1 0 1 9, and then the wild u...

info.malwarebytes.org XSS vulnerability

Vulnerable URL: http://info.malwarebytes.org/acton/fs/blocks/showLandingPage/a/8327/p/p-0009/t/page/fm/0?s=%3C/title%3E%3C/script/%22-alert%280%29-%22--%3E%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 03.05.2016 Latest check for patch:|...

Malwarebytes 2.2.0.1024 DLL Hijacking

Hi @ll, Malwarebytes executable installers mbam-setup-2.2.0.1024.exe and mbae-setup-1.08.1.1189.exe available from and load and execute UXTheme.dll and DWMAPI.dll from their "application directory". For software downloaded with a web browser the application directory is typically the user's...

Malwarebytes Anti-Malware Elevation of Privilege Vulnerability

Malwarebytes Anti-Malware MBAM is a suite of anti-malware spyware from the American company Malwarebytes. The software supports the removal of worms, dial-up programs, Trojans, rootkits, spyware, exploits, bots, and other malware, among others. An elevation of privilege vulnerability exists in...

Joomla Joins WordPress As TeslaCrypt Ransomware Target

Exploit kits infecting thousands of WordPress websites are setting their sights on the open-source content management system Joomla in a new campaign spotted by a researcher at the SANS Institute’s Internet Storm Center. “The group behind the WordPress ‘admedia’ campaign is now apparently targeti...

Malwarebytes AntiVirus 2.2.0 - Denial of Service (PoC)

Malwarebytes AntiVirus 2.2.0 - Denial of Service PoC Application: Malwarebytes Antivirus Platforms: Windows Versions: 2.2.0. CVE: No CVE have been assigned Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction...

Malwarebytes Antivirus Denial of Service Vulnerability

Malwarebytes Anti-Malware MBAM is a find and remove malware application that runs under Windows and Apple operating systems. Malwarebytes Antivirus suffers from a denial of service vulnerability. The vulnerability can be exploited by attackers to launch a denial-of-service attack and cause a syst...

Malwarebytes AntiVirus 2.2.0 - Denial of Service (PoC)

Application: Malwarebytes Antivirus Platforms: Windows Versions: 2.2.0. CVE: No CVE have been assigned Author: Francis Provencher of COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== Malwarebytes Anti-Malware MBAM is an...

Malwarebytes Anti-Exploit Installed

Binary data malwarebytesantiexploitinstalled.nbin...

Malwarebytes Anti-Exploit < 1.04.1.1012 RCE

The Malwarebytes Anti-Exploit installed on the remote Windows host is a version prior to 1.04.1.1012. It is, therefore, affected by a vulnerability that allows a man-in-the-middle attacker to spoof the update server in order to upload and execute arbitrary code on the remote host. C Tenable Netwo...