Hello, welcome to the Monday, April 13th, 2020 edition of the Santernut Storms,

I'm Stormcast. My name is Johannes Ulrich, and yes, I'm still recording from Jacksonville, Florida.

It's always great to have some of our readers further analyze some matter that was discussed in our diaries. Now, we got a post here by Vinny that Didier put up,

and it looked in more detail at the encrypted K-pot malware that was discussed by Didi in a prior

post. Now, what Vinny here did in order to decrypt this K-Pod Malware is, well, just run it

and essentially let it decrypt itself and then dump memory in order to get a snapshot of

the decrypted code.

And this worked pretty nicely here.

He was able then to essentially just use simple strings to learn more about the matter.

So if you're interested, take a look at what he did here in order to accomplish this.

Now, first of all, he used just simple task manager in order to get a process dump for this dlllhost.exe binary, and then he just used foremost to extract the actual executables.

Once extracted, he had it all decrypted and could use simple strings in order to sort of learn

a little bit more about this particular malware. So pretty neat and quick technique.

Also nice that in addition to task manager, the only thing he needed was Formos, which of course

is sort of a stable, a well-known forensics tool to extract data from binary dumps like memory or disk dumps.

And if you are running VMware's V-Center server, it's time to update VMware released a patch on Friday

that addresses an information disclosure vulnerability with a CVSS score of a full

10. So this can lead to a complete system compromise. Now, these sensitive information disclosure

vulnerability is always a little bit tricky to gauge, but apparently here the problem is VM there and it doesn't

implement correct access controls. It's possible to gain access to data that you're not supposed

to have access to, which apparently may include credentials and such, which then in turn, of course,

can be used to compromise the system. However, in order

...