A quick tutorial on ClamAV detection: Win.Adware.Bprotector
Bprotector is a fairly popular yet unexceptional family of adware. The thing that distinguishes it from other families is its prevalence. A specific sample, first seen in October 2013, has consistently been on top for detection rates on our FireAMP and Immunet products. The follo
I'm calling this Goon Exploit Kit, for now
We started seeing this exploit kit in our systems on November 21st. It has some similarities to Redkit and the Dotcache exploit kit. Cookiebomb redirection to: 192.168.0.58 1044 173.237.187.203 80 GET 173.237.187.203 /cnt.php?id=786629 Mozil
Microsoft Update Tuesday November 2013: HyperV vulnerability and fix for 0day
We have a relatively light Update Tuesday this month: 8 bulletins covering 19 CVEs, 3 of which are marked critical. The most interesting vulnerability this month is actually in the non-critical ones: a vulnerability in Hyper-V (MS13-092). We’re also getting a fix for a 0-day vuln
Exploit kits, they sure do like to change ports
Since the arrest of Paunch, (the author of the Blackhole and Cool exploit kits, that I talked about in my last post), exploit kits are clamoring for who will be number one. So I come with a status update of sorts, as of the writing of this blog post, Magnitude, aka, Popads seems
Sweet Orange Exploit Kit was the new king of the hill, until it went away.
Here in the VRT, we keep a pretty close eye on Exploit Kits, their trends, their pattern shifts, and how we can protect our customers against these exploit kits in the real world. Recent headlines from various news agencies stated that the author of the Blackhole and Cool exploi
IE Zero Day CVE-2013-3897 -- You've been protected for more than a week.
A little over a week ago the VRT discovered a very interesting bit of javascript on a popular JS unpacker site. Several things immediately piqued our interest in this sample. First of all, we found multiple calls to Math.atan2() with curious parameters: This is a popular techniq
Microsoft Update Tuesday October 2013: Another IE 0-day release
This month's Microsoft Tuesday Update brings us 8 bulletins for a total of 26 CVEs. Four of these bulletins are marked as critical, while the rest are marked as important. First, let's take a look at the 4 critical bulletins: The most important update this month is a cu
Android Basic Block Signatures
Writing ClamAV signatures is a bit of an art. When matching bytes in a file, you need to make a selection that most, if not all of the malicious files will have, and hopefully, no clean files will have. Strings are an easy target. Often there are unique typos or a strange user-ag
