Hello, welcome to the Monday, January 31st, 2021 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Xavier wrote up an interesting HTML file on Friday. It's not just an HTML file, but it also includes an ISO.

Now, typically we associate ISO files with these large multi-gigabyte DVD or CD images, but

well, in this case, it's actually not all that big about 50 kilobytes and entirely included inside the HTML file.

The way this works is that there is a little obfuscated JavaScript that will dynamically create the ISO file from a base 64 encoded string and then offer it for a download. The intention here is obvious

in that it attempts to bypass any filters that are looking for isophiles being delivered via

email. The basic mail scanner would just see an HTML file, and of course, HTML is pretty standard.

The JavaScript may give it away inside an email, but still at the time when Xavier looked at

the file, virus total scores were pretty low. Now, they have been improved somewhat since Xavier published the diary.

The isophile has somewhat better virus total recognition, so if you end up saving at the disk,

it may actually get detected, but if you do launch the code inside the ISO file, you will download additional malware.

Now if you see something odd like an ISO file inside an HTML file,

you may be tempted to write a YARA signature

in order to recognize these files

and, well, not sure if you had a chance, but in the Holiday

Hack Channel, there was actually a real interesting sort of Yara challenge as well.

The bugging Yara signatures can be a little bit painful, but the upcoming version 4.2 of

Yara may make this a little bit easier.

And D.D. wrote about the console module that's being included here.

A release candidate is available and it allows you to basically debug Yara rules by outputing various constants and such to the console and help with debugging.

Microsoft has a nice blog writing up a recent attack that they have observed

where attackers are registering devices with organizations Asia AD.

...