UPDATE: The tool „Detekt“: what you should know about it
As reported, the recently launched tool “Detekt” is a tool to detect nation-state spyware by performing in-memory scans with the help of static Yara rules. G DATA appreciates the approach to raise awareness against spyware, but looking at the technical realization of the tool, we have to say that it…
The tool „Detekt“: what you should know about it
Amnesty International, Digitale Gesellschaft, Electronic Frontier Foundation and Privacy International jointly launched a tool named "Detekt". Primarily, they wish to raise awareness about spying actions against computer users and especially against activists and journalists. The tool is designed…
IT Security, Foosball and Charity: VB 2014 had it all
The VB International conference is a worldwide institution when it comes to IT-Security and its 24th edition held some remarkable highlights. Technical and corporate audiences were able to follow high-class talks and presentations about threats and dangers the industry faces, possible solutions and…
The Uroburos case: new sophisticated RAT identified
In February 2014, the experts of the G DATA SecurityLabs published an analysis of Uroburos, the rootkit with Russian roots. We explained that a link exists between Uroburos and the Agent.BTZ malware, which was responsible for "the most significant breach of U.S. military computers ever." [1] Nine…
Operation "TooHash": how targeted attacks work
The experts of G DATA’s SecurityLabs discovered a cyber-espionage campaign that perfectly exemplifies the way how targeted attacks work. The purpose of this campaign was to steal valuable documents from the targeted entity. We entitle this operation “TooHash”.
COM Object hijacking: the discreet way of persistence
G DATA SecurityLabs experts discovered a new Remote Administration Tool, which we dubbed COMpfun. This RAT supports 32-bit and 64-bit Windows versions, up to the Windows 8 operating system. The features are rather common for today’s espionage tools: file management (download and upload), screenshot…
New FrameworkPOS variant exfiltrates data via DNS requests
Between April and September 2014, the American retailer Home Depot was targeted by criminals who aimed to steal credit card information. The malware used during these attacks targets Point of Sale systems. Home Depot said that the cyber criminals stole 56 million of debit and credit card numbers…
Cuckoo Sandbox Evasion PoC available
In the beginning of this week we discovered a security flaw in the famous malware analysis framework „Cuckoo Sandbox“. We disclosed this bug to the developers on the 7th of October 2014. Not even three hours later the patch was verified and the updates were supplied by the developers.
Poweliks: the persistent malware without a file
When security researchers talk about malware, they usually refer to files stored on a computer system, which intends to damage a device or steal sensitive data from it. Those files can be scanned by AV engines and can be handled in a classic way. The following analysis is an example of malware which…
G DATA Malware Report July - December 2013
G DATA’s Malware Report H2 2013 includes the most important statistics and information regarding new malware types, websites’ threat potential as well as botnet and banking Trojan activities. Check out the essential facts.
Karsten Hahn
Virus Analyst
Tim Berghoff
Security Evangelist
