Hello, welcome to the Thursday, July 28, 2022 edition of the Sands and the Storm Center's

Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Brad today posted another one of his Malver analysis diaries. This time he's going over an iced ID sample, and this particular

sample either installs a dark VNC or Cobalt Strike. As so often, the attack starts with a good

old email and a password-protected SIPD iso file.

Password of course is pretty easy and can typically be found in the email, but is of course intended

to make analysis, in particular automated analysis, a little bit more difficult.

Now once the user opens this SIP file and then exposes the ISO file that's included, there is the old link file trick that's then being used to load a DLL and then Iced ID is installed. Now Iced ID is fairly flexible and of course has been around for a while after the malware is completely installed

that's then when dark vnc or cobalt strike will be installed to obtain persistent access

to the victim's system as usual with pratt's diaries you'll find links to the malware on

virus dutal as well as packet captures.

So great learning opportunity here again to learn how to figure out what's happening based on network traffic.

And WebAssembly is back in the news and with that crypto jacking. WebAssembly is code that runs in browsers. A little bit like JavaScript, but unlike JavaScript, it comes in a binary sort of compiled format. Now, it's not assembly language as WebInsInSemply implies it's more bytecode, but the

idea is that you can run it in the browser, it's platform independent, and it's faster than

normal JavaScript. So with it running faster and more efficient, it of course makes a great tool for attackers to run crypto miners in users' browsers.

That's something, of course, that we've heard of before, typically implemented in JavaScript way back in a day.

There was good old Coin Hive service that made that really easy. But with Coin Hive shutting down

and also browsers implemented actually some features in JavaScript that made it more difficult

to sort of abuse the crypto functions in JavaScript. That pretty much has sort of put the traditional JavaScript-based

cryptojacking at a halt. Now, Sukhuri security has found an attack affecting multiple

websites that essentially resurrects that old cryptojacking idea. Now it's implemented in WebAssembly,

so some of the countermeasures that browsers implemented don't actually work here. And Securea

...