Automatically Extracting Obfuscated Strings from Malware using the FireEye Labs Obfuscated String Solver (FLOSS)

Introduction and Motivation Have you ever run strings.exe on a malware executable and its output provided you with IP addresses, file names, registry keys, and other indicators of compromise IOCs? Great! No need to run further analysis or hire expensive experts to determine if a file is malicious...

Threat Outbreak Alert RuleID15071: Email Messages Distributing Malicious Software on May 4, 2015

Medium Alert ID: 38661 First Published: 2015 May 4 18:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID15071 may contain the following files: Name | Size ...

CVE-2014-6985

The Georgia Packing aka com.tapatalk.georgiapackingorg application 3.9.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Georgia Packing aka com.tapatalk.georgiapackingorg application 3.9.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6985

The CVE-2014-6985 entry concerns the Georgia Packing Android app (version 3.9.16). The vulnerability is due to the app not verifying X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive information via a crafted certificate. The connected...

CVE-2014-6985

The Georgia Packing aka com.tapatalk.georgiapackingorg application 3.9.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Threat Outbreak Alert: Fake Packing Invoice and Shipping Information Email Messages on June 30, 2013

Medium Alert ID: 29867 First Published: 2013 July 1 18:54 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an invoice and shipment notification for the recipient. The text in the email message attempts to convince the...

Malware Developers Like AutoIt for Ease of Use

AutoIt, the BASIC-like automation language for Windows programmers, is becoming a favored tool among malware developers for the same reasons it attracts legitimate users: it’s free, flexible and easy to use. Trend Micro TrendLabs’ Kyle Wilhoit wrote in today’s Security Intelligence Blog that...

BloXor - A Metamorphic Block Based XOR Encoder

A Metamorphic Block Based XOR Encoder. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/encoder/bloxor/bloxor' BloXor is a cross architecture metamorphic block based xor encoder/decoder for Metasploit...