Hello, welcome to the Tuesday, January 8th, 2019 edition of the Sansonet Storm Center's

Stormcast. My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

The matter of the day analyzed by the DA today is an encrypted Microsoft Office documents. So if you have seen quite a few of them

in the past, now the VA put together a little proof force tool for these type of documents

in case you do not have the password. The password is usually listed in the body of the email, but if you just have the attachment,

you no longer have the body, then it can be useful to prudeforth the password.

And since these passwords are usually rather simple, like short numbers and the like, it

shouldn't be too hard to do this.

In this particular case, it was just one, two, three, four.

And as usual, the malware actually turned out to be a downloader that was then used to retrieve

additional malware from a web server. One interesting sort of little thing here is the URL was

just an IP address. one way how you can

actually spot a lot of these suspicious downloads is if you are looking for host headers

that are IP addresses instead of a host name that's somewhat unusual and sometimes

used by malware like in this case.

And we got a blog post from Vandera about how to spot malicious applications, and they focused here on iOS, so malicious applications in Apple's App Store.

Now, I used this somewhat to illustrate their checklist they sort of have, So malicious applications in Apple's App Store.

They used this somewhat to illustrate their checklist they sort of have that gives you clues as to what application may be malicious.

One interesting thing they ran into is a few applications that actually connected with a command control server that's commonly associated with the Gold Duck malware. Now, Apple doesn't allow any additional code to be loaded this way,

but all it takes is a vulnerability that would make that possible. Right now it appears that

this command control server is mostly gathering information

from the device like IP address and a couple of other items that are accessible to the software,

...