Hello, welcome to the Thursday, September 22nd, 2016 edition of the Sansonet Storms and a Storms and a stormcast.

My name is Johannes Ulrich and the day I'm recording from Baltimore, Maryland.

Brad got a nice review of recent changes to Locky Crypto ransomware, in particular the switch from executables to DLLs.

I guess in part a real surprising issue here is that nothing has changed about the initial

downloader, these compressed JavaScript or Windows scripting files, and in part probably

because as I pointed out in a diary a couple weeks ago,

the antivirus tools really focus on the actual ransomware. So probably by moving from the EXE to the DLL,

there is a better chance of actually getting the system encrypted.

The initial downloader is all too often not detected, so not a lot of pressure really on the

Locky creators here to make any changes to the initial downloader.

And just a little reminder to those of you who rely on network-based tools

in order to detect the actual malware download, Lockhe does encrypt that part so you don't see

the typical MZ header or things like that that usually identified as an executable. Now I'm talking about attacks that

are using scripts like JavaScript, VB script, and of course a PowerShell that has been an ongoing

problem for Windows and with Windows 10, Microsoft introduced something new and and this is the anti-malware scan interface,

which in particular is meant to capture things like malicious PowerShell scripts.

There's now a black hat presentation that has been made public that goes to quite a bit of detail in what this tool

actually does, what it prevents, and how it can be bypassed by an attacker. Since it's still

signature-based, it can be bypassed by obfuscating the binary or the script in this case. For example, you need to change things like variable

names and then signatures may no longer be able to identify the script as malicious. But this article

goes well beyond that. So if you are using PowerShell scripts in, for example, pen testing work, you may want to take a look at this

presentation because, well, with Windows 10 AMSI is enabled by default, so you may run into it.

...