Hello, welcome to the Thursday, May 7, 2020 edition of the Sandcent Storm Center's Stormcast.

My name is Johannes Ulrich.

And then I'm recording from Jacksonville, Florida.

Did he wrote a post today testing how unique Malveur it typically is when it is is being received or if the same exact piece of

Malver keeps getting reused. Now in order to do this, Did he used Virus Total and collected

8,000 something different samples from Virus Total that did match Didier's YARA rules and that were uploaded to VirusTotal over

the last 18 months. Now, then he checked how often was this exact file uploaded, what's the

time difference between the first and the last time it was uploaded. And what did he found? And probably should be a huge

surprise here, but 95% of malware was uploaded to a virus total only once, meaning it was unique

malware submitted by only one entity. Now, he's comparing Shah hashes here. So unique means different Shah-256 hash in this

case. So this doesn't mean these are targeted attacks because a lot of run-of-the-mill malware

these days will create slightly modified versions of itself whenever it is being deployed.

Now, he found a couple of outliers here as well, and probably the most famous one, invoke mimicats.ps.

Well, that, of course, is the famous mimicats script that's often used by pen testers and such.

So no surprise that this has been uploaded the most and had the longest lifetime starting

in November of 2015 and going all the way till April 4th.

So that's probably when Diddy here collected his data. Lesson learned, well,

Shah checksums as an indicator of compromise are kind of useless in the sense that you're

unlikely going to find the same Shah hash in your environment that someone else reported.

And Google appears to continue to have a hard time keeping malicious extensions out of the Google Chrome Web Store.

As reported by the Register, yet another set of malicious extensions has been identified in the Google Chrome store by researchers.

And these extensions, again, were stealing passwords from users by claiming to be extensions

...