Threat analysis – Page 17 – Computer Security Articles

MalwareBytes Security

Using ILSpy to analyze a small adware file

October 5, 2017 admin .NET, Adware, assembly, decompile, dotdo, grandfather.exe, ilspy, malware, Pieter Arntz, Threat analysis

Credit to Author: Pieter Arntz| Date: Thu, 05 Oct 2017 16:19:25 +0000

ILSpy is an open-source .NET assembly browser and decompiler. We demonstrate its use looking at a simple adware file.

Categories:

Tags: .NET adware assembly decompile dotdo grandfather.exe ilspy Pieter Arntz

(Read more…)

The post Using ILSpy to analyze a small adware file appeared first on Malwarebytes Labs.

MalwareBytes Security

Tech support scammers abuse native ad and content provider Taboola to serve malvertising (updated)

October 3, 2017 admin click bait, fraud, malvertising, msn, Social engineering, Taboola, tech support scams, Threat analysis

Credit to Author: Jérôme Segura| Date: Thu, 28 Sep 2017 14:58:32 +0000

See how scammers redirected visitors from MSN to their tech support scam page in this latest malvertising campaign.

Categories:

Tags: click bait fraud malvertising msn Taboola tech support scams

(Read more…)

The post Tech support scammers abuse native ad and content provider Taboola to serve malvertising (updated) appeared first on Malwarebytes Labs.

MalwareBytes Security

Tech support scammers abuse native ad and content provider Taboola to serve malvertising

September 28, 2017 admin click bait, fraud, malvertising, msn, Social engineering, Taboola, tech support scams, Threat analysis

Credit to Author: Jérôme Segura| Date: Thu, 28 Sep 2017 14:58:32 +0000

See how scammers redirected visitors from MSN to their tech support scam page in this latest malvertising campaign.

Categories:

Tags: click bait fraud malvertising msn Taboola tech support scams

(Read more…)

The post Tech support scammers abuse native ad and content provider Taboola to serve malvertising appeared first on Malwarebytes Labs.

MalwareBytes Security

Elaborate scripting-fu used in espionage attack against Saudi Arabia Government entity

September 27, 2017 admin espionage, goverment, macro, malware, Microsoft Word, Powershell, saudi arabia, scripting, Threat analysis, Trojan

Credit to Author: Malwarebytes Labs| Date: Wed, 27 Sep 2017 01:06:51 +0000

In this post, we take apart a clever set of scripts used in a targeted attack against the government of Saudi Arabia.

Categories:

Tags: espionage goverment macro microsoft word powershell saudi arabia scripting trojan

(Read more…)

The post Elaborate scripting-fu used in espionage attack against Saudi Arabia Government entity appeared first on Malwarebytes Labs.

MalwareBytes Security

Elaborate scripting-fu used in espionage attack against Saudi Arabia Government

September 27, 2017 admin espionage, goverment, macro, malware, Microsoft Word, Powershell, saudi arabia, scripting, Threat analysis, Trojan

Credit to Author: Malwarebytes Labs| Date: Wed, 27 Sep 2017 01:06:51 +0000

In this post, we take apart a clever set of scripts used in a targeted attack against the government of Saudi Arabia.

Categories:

Tags: espionage goverment macro microsoft word powershell saudi arabia scripting trojan

(Read more…)

The post Elaborate scripting-fu used in espionage attack against Saudi Arabia Government appeared first on Malwarebytes Labs.

MalwareBytes Security

Drive-by mining and ads: The Wild Wild West

September 25, 2017 admin ads, browser, coinhive, cryptominer, cryptomining, cryptonight, exploit kit, JS, malvertising, malware, Social engineering, Threat analysis

Credit to Author: Jérôme Segura| Date: Mon, 25 Sep 2017 17:16:27 +0000

Cryptomining in the browser is all the rage lately. But what are the impacts for users when it is being abused by dubious publishers?

Categories:

Tags: ads browser coinhive cryptominer cryptomining cryptonight exploit kit JS malvertising malware

(Read more…)

The post Drive-by mining and ads: The Wild Wild West appeared first on Malwarebytes Labs.

MalwareBytes Security

Fake IRS notice delivers customized spying tool

September 21, 2017 admin CP2000, CVE-2017-0199, doc, exploit, irs, malspam, malware, office, phishing, Rat, remote administration tool, RMS, spy, Threat analysis, Word

Credit to Author: Jérôme Segura| Date: Thu, 21 Sep 2017 15:00:24 +0000

Threat actors leverage a Microsoft Office exploit to spy on their victims. In this blog post, we will review its delivery mechanism and analyze the malware we observed, a modified version of a commercial Remote Administration Tool (RAT).

Categories:

Tags: CP2000 CVE-2017-0199 doc exploit IRS malspam malware Office phishing rat remote administration tool RMS spy word

(Read more…)

The post Fake IRS notice delivers customized spying tool appeared first on Malwarebytes Labs.

MalwareBytes Security

Explained: YARA rules

September 15, 2017 admin Explained, malware, Pieter Arntz, rules, Security world, Technology, the more you know, Threat analysis, yara

Credit to Author: Pieter Arntz| Date: Fri, 15 Sep 2017 15:00:08 +0000

YARA is a tool that can be used to identify files that meet certain conditions. It is mainly in use by security researchers to classify malware.

Categories:

Tags: Explained malware Pieter Arntz rules the more you know yara

(Read more…)

The post Explained: YARA rules appeared first on Malwarebytes Labs.