Attack – Page 3 – Marco Ramilli Web Corner

Attacking Machine Learning Detectors: the state of the art review

June 26, 2018January 9, 2019

Machine learning (ML) is a great approach to detect Malware. It is widely used among technical community and scientific community with two different perspectives: Performance V.S Robustness. The technical community tries to improve ML performances in order to increase the usability on large scale while scientific community is focusing on robustness by meaning how easy […]

DMOSK Malware Targeting Italian Companies

June 8, 2018January 9, 2019

Today I’d like to share another interesting analysis made by my colleagues and I. It would be a nice and interesting analysis since it targeted many Italian and European companies. Fortunately the attacker forgot the LOG.TXT freely available on the dropping URL letting us know the IP addresses who clicked on the first stage analysed […]

MalHide: an interesting Malware sample

May 28, 2018January 9, 2019

Today I’d like to share an interesting (at least to me) analysis on a given sample. I have called this sample MalHide but you will see “why” only at the end of my post :D. I believe this is a quite interesting Malware since it firstly implements several obfuscation stages by using different obfuscation techniques […]

CERTs, CSIRTs and SOCs after 10 years from definitions

March 25, 2018January 9, 2019

Nowadays is hard to give strong definitions on what are the differences between Security Operation Centers (SOC), Computer Emergency Response Teams (CERT) and Computer Security Incident Response Teams (CSIRT) since they are widely used in many organisations accomplishing very closed and similar tasks. Robin Ruefle (2007) on her paper titled “Defining Computer Security Incident Response […]

Control Flow Integrity: a Javascript Evasion Technique

February 21, 2018January 9, 2019

Understanding the real code behind a Malware is a great opportunity for Malware analysts, it would increase the chances to understand what the sample really does. Unfortunately it is not always possible figuring out the “real code”, sometimes the Malware analyst needs to use tools like disassemblers or debuggers in order to guess the real […]

Huge Botnet Attacking Italian Companies

January 20, 2018January 9, 2019

On January 18 a colleague of mine (Luca) called me telling a malicious email was targeting Italian companies. This is the beginning of our new analysis adventure that Luca and I run together. The email pretended to be sent by “Ministero dell’ Economia e delle Finanze” the Italian Department of Treasury and it had a […]

Info Stealing: a new operation in the wild

December 29, 2017January 9, 2019

Attack attribution is always a very hard work. False Flags, Code Reuse and Spaghetti Code makes impossible to assert “This attack belongs to X”. Indeed nowadays makes more sense talking about Attribution Probability rather then Attribution by itself. “This attack belongs to X with 65% of attribution probability” it would be a correct sentence. I […]

Unprotecting VBS Password Protected Office Files

November 15, 2017January 9, 2019

Hi folks, today I’d like to share a nice trick to unprotect password protected VB scripts into Office files. Nowadays it’s easy to find out malicious contents wrapped into OLE files since such a file format has the capability to link objects into documents and viceversa. An object could be a simple external link, a […]

Advanced ‘all in memory’ CryptoWorm

September 27, 2017January 9, 2019

Introduction. Today I want to share a nice Malware analysis having an interesting flow. The “interesting” adjective comes from the abilities the given sample owns. Capabilities of exploiting, hard obfuscations and usage of advanced techniques to steal credentials and run commands. The analyzed sample has been provided by a colleague of mine (Alessandro) who received […]

TOPransom: From eMail Attachment to Powning the Attacker’s Database

August 1, 2017January 9, 2019

Hi folks, today I want to share a quick but intensive experience in fighting cybercrime. I wish you would appreciate the entire process from getting an email attachment to powning the ransom server trying to stop the infection and to alert everybody about the found threats. As a second step I would try to identify […]