Hello, welcome to the Friday, February 12, 2021 edition of the Sandstone Storm Center's Stormcast. My name is Johannes Ulrich. And I'm recording from Jacksonville, Florida.

Jan came across an interesting ancient Tesla sample. Now, at first, it looked like, well, just any ancient Tesla sample. It arrived as

one of those fake DHS shipping notices. In itself, this was not done very well. It used a from address

that claimed to be from DHL.com. Now, with dhl.com using SPF, these emails most likely ended up in your spam folder.

The attachment was an ISO file, which again is not really all that unusual, but the content

of the ISO file then turned out to be somewhat odd as Jan dove deeper into it.

In addition to just bloating the content of the sample by attaching Bitmap image files,

the sample also included a code, a couple of DLs and such, from valid and high malware.

Jan identified the source of the code as a piece of software called Virus Effect Remover.

No longer being sold and it's about 10 plus years old, but that's the code that they appended to this particular

malicious sample. At this point, we can only really guess why they did it. So first of all,

attackers do sometimes like to float their malware samples, make them larger in order to evade inspection.

A lot of antivirus tools will not inspect files above a certain size.

And that's why you, for example, in this case as well, see images being included with the malver.

The other reason, and that may be a little bit more sinister, but also not very

likely given the overall sophistication or lack of sophistication for this sample, it may be an attack

trying to bypass or evade some machine learning algorithms. There have been some interesting

papers recently that described how machine learning algorithms. There have been some interesting papers recently that described how machine learning algorithms

are anti-malver based on machine learning can be fooled into believing that Malver is actually

benign by including a sample of common benign software.

In a particular paper, for example, they used notepad.exe.

Maybe this is sort of a little attempt to do something like this.

...