List of “Malware”

  • Malware Clustering using impfuzzy and Network Analysis - impfuzzy for Neo4j - Malware
    Malware Clustering using impfuzzy and Network Analysis - impfuzzy for Neo4j -
    Hi again, this is Shusei Tomonaga from the Analysis Center. This entry introduces a malware clustering tool “impfuzzy for Neo4j” developed by JPCERT/CC. Overview of impfuzzy for Neo4j impfuzzy for Neo4j is a tool to visualise results of malware clustering using a graph database, Neo4j. A graph database is a database for handling data structure comprised of records (nodes) and relations among the records. Neo4j provides functions to visualise registered...

    Read more

  • Malware Leveraging PowerSploit Malware
    Malware Leveraging PowerSploit
    Hi again, this is Shusei Tomonaga from the Analysis Center. In this article, I’d like to share some of our findings about ChChes (which we introduced in a previous article) that it leverages PowerSploit [1] – an open source tool – for infection. Flow of ChChes Infection The samples that JPCERT/CC confirmed this time infect machines by leveraging shortcut files. The flow of events from a victim opening the shortcut...

    Read more

  • PlugX + Poison Ivy = PlugIvy? - PlugX Integrating Poison Ivy’s Code - Malware
    PlugX + Poison Ivy = PlugIvy? - PlugX Integrating Poison Ivy’s Code -
    Hi again, this is Shusei Tomonaga from the Analysis Center. PlugX is a type of malware used for targeted attacks. We have introduced its new features in the blog article “Analysis of a Recent PlugX Variant - ‘P2P PlugX‘”. This article will discuss the following two structural changes observed in PlugX since April 2016: the way API is called the format of main module changed from PE to raw binary...

    Read more

  • ChChes – Malware that Communicates with C&C Servers Using Cookie Headers Malware
    ChChes – Malware that Communicates with C&C Servers Using Cookie Headers
    Since around October 2016, JPCERT/CC has been confirming emails that are sent to Japanese organisations with a ZIP file attachment containing executable files. The targeted emails, which impersonate existing persons, are sent from free email address services available in Japan. Also, the executable files’ icons are disguised as Word documents. When the recipient executes the file, the machine is infected with malware called ChChes. This blog article will introduce characteristics...

    Read more

  • A New Tool to Detect Known Malware from Memory Images – impfuzzy for Volatility – Malware
    A New Tool to Detect Known Malware from Memory Images – impfuzzy for Volatility –
    Hi again, this is Shusei Tomonaga from the Analysis Center. Today I will introduce a tool “impfuzzy for Volatility”, which JPCERT/CC has created for extracting known malware from memory images and utilises for analysis operations. Malware Detection in Memory Forensics To judge if a file type malware sample is a known kind, the easiest and fastest way is to check the hash value (e.g. MD5 or SHA 256) of the...

    Read more

  • Evidence of Attackers’ Development Environment Left in Shortcut Files Malware
    Evidence of Attackers’ Development Environment Left in Shortcut Files
    A shortcut file, also referred to as a shell link, is a system to launch applications or to allow linking among applications such as OLE. As we introduced in a previous blog post “Asruex: Malware Infecting through Shortcut Files”, shortcut flies are often used as a means to spread malware infection. Generally, shortcut files contain various types of information including the dates and environment that the shortcut file was created....

    Read more

  • Asruex: Malware Infecting through Shortcut Files Malware
    Asruex: Malware Infecting through Shortcut Files
    JPCERT/CC has been observing malicious shortcut files that are sent as email attachments to a limited range of organisations since around October 2015. When this shortcut file is opened, the host will be infected with malware called “Asruex”. The malware has a remote controlling function, and attackers sending these emails seem to attempt intruding into the targets’ network using the malware. According to a blog article by Microsoft, the malware...

    Read more

  • Classifying Malware using Import API and Fuzzy Hashing – impfuzzy – Malware
    Classifying Malware using Import API and Fuzzy Hashing – impfuzzy –
    Hello all, this is Shusei Tomonaga again. Generally speaking, malware analysis begins with classifying whether it is known malware or not. In order to make comparison with the enormous number of known malware samples in the database in a speedy manner, hash values are used, derived by performing hash functions to the malware sample. Among the different hash functions, traditional ones such as MD5 and SHA1 derive totally different hash...

    Read more

  • Decoding Obfuscated Strings in Adwind Malware
    Decoding Obfuscated Strings in Adwind
    From the latter half of 2015 to 2016, there have been an increasing number of cyber attacks worldwide using Adwind, a Remote Access Tool [1]. JPCERT/CC also received incident reports about emails with this malware in its attachment. Adwind is malware written in Java language, and it operates in Windows and other OS as well. It has a variety of functions: to download and execute arbitrary files, send infected machine...

    Read more

  • Banking Trojan “Citadel” Returns Malware
    Banking Trojan “Citadel” Returns
    Hello again, this is You ‘Tsuru’ Nakatsuru from Analysis Center. It has been just about two years since I delivered a talk “Fight Against Citadel in Japan” at CODE BLUE 2013 (an international security conference in Tokyo) about the situation on banking trojans observed in Japan at that time and detailed analysis results on Citadel (See my blog entry here). For the presentation material and audio archive, please see Reference...

    Read more