Hello, welcome to the Monday, March 23rd, 2020 edition of the Sands and the Storms on us Stormcast. My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

But now it looks like any Malver gang out there has jumped on the COVID-19 or coronavirus bandwagon. Recurring themes are trying to provide more

information or taking advantage of government regulations that are of course very quickly changing

these days, but also some mask sales that, of course, often turn out to be fraudulent.

Did he take a look at some of the malware that we have been seeing now in this case, actually,

the malware promised as an attachment some kind of permission slip that apparently you can use to leave your house in case

of a national state of emergency. Needless to say, such permission slip doesn't really exist,

and there is also nothing like a national state of emergency, at least in the U.S. that would require you to have a slip like

this. But of course, people will download this document, try to execute it. In itself, the document

is not really all that sophisticated. Now, the ultimate download is one of those auto IT scripts.

Haven't seen them in a while, but they have certainly been around for a while.

Auto IT is of a scripting language, and in order to run the script, the malware actually also

installs the auto IT interpreter on your system.

Now, if you managed to download all the files needed to actually run the final malware while

it was still active, you would have ended up with the K-Pot InfoSteeler.

Overall, none of the attempts we have seen so far are really sophisticated

in any way, sophisticated maybe in the sense that they very quickly sort of jumped on that COVID-19

bandwagon, but any kind of reasonable endpoint protection should protect you from this type of malware.

The one thing we haven't really seen much of for now,

and I guess that's good, is any donation scams around COVID-19.

Now, we have gotten a number of requests to look into a website called cdcfoundation.org. This website is legit.

It is actually associated with the CDC. It's a little bit an oddball as far as foundations and

...