Hello and welcome to the Friday, March 29th, 2004 edition of the Sands and it's Storms and a stormcast. My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

We got another gem for the malware reverse analysts here today from Xavier.

Xavier looked at some pretty interestingly obfuscated JavaScript.

It used sort of a number of different tricks to make analysis of the JavaScript quite

difficult.

It was created using UTF16, so you had to essentially remove every second bite.

Then there was a bunch of additional code that pretty much just, well, did nothing and

that just served to sort of distract the analyst.

Also, some commands were using aliases like curl was replaced with press for some reason.

In the end, it downloaded an async rat, a well-known remote admin tool, so that's what you ended up

with here, and you gave essentially the attacker remote access to your system.

The original name of the file was Rechnung, then set of numbers, PDF.js.

Rechung is the German word for invoice, so it apparently tried to claim to be an invoice PDF,

which of course we often see in email attachments.

The virus total score came in at only three out of 59.

Now, I think it was about a month ago when we had some attacks against Team City,

and this JetBrains product got in a little bit of trouble here with a security

company Rapid 7 for releasing patches without disclosing their security content.

And with that, of course, administrators were kind of flying dark.

Now, there was a couple couple articles I at least saw today

that published about the just-released version of Team City.

That's version 24-3.

...