Follow us into the rabbit hole. New blog post about the technical analysis of a malware sample spreading through COVID-19-related malicious documents. #malware#reverseengineering#dotnet
Dropped file yUtro.exe or chme.exe with SHA256 hash a1f8429d0e0750461e796507148f39535fbf28710d45dd5fc90691235b078271
Created shortcut to yUtro.exe at C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start-up\floqqq.lnk
#ioc#iocs#indicatorsofcompromise
📢 Did you know the #AIS 2.0 program saw a staggering 99% drop in #IndicatorsOfCompromise shared after a federal handoff? Explore the nuanced findings of the #OIG report on #CISA's information-sharing efforts.
Read the blog →
Unusual Outbound Traffic
- Spot unusual traffic patterns leaving the network
- Monitor the activities within the network and look for traffic leaving the perimeter
- Compromised systems communicate with the command-and-control servers
#IndicatorsOfCompromise
#WordNotes: Origin and context: In order to block bad guy activity or detect that a bad guy is in your network, security practitioners have used the concept of #indicatorsofcompromise since the internet was young. Let @racebannon99 tell you more about it: