Hello and welcome to the Wednesday, February 21st, 2004 edition of the Sands and Storms oners Stormcast.

My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Xavier today wrote up a new interesting infestiler written in Python.

One of the problems Malbert always is trying to cope with is that sometimes, well,

a malware is examined by researchers like Xavier and they try to prevent researchers from running

the malware inside a sandbox.

The sandbox are often virtual machines, so detecting sandboxes often comes down to detecting if the system is running inside a virtual machine.

The tricky part here is that researchers, of course, sometimes try to evade these detections by modifying

what values their virtual machines return for things like Mac adders or such that are often

being used. The trick that's being deployed by this latest Infostela Malver that Xavier ran into

is that they keep a list of these indicators online

on a website called Our Entry.C.O.

It's sort of a pastebin-like website.

And then the malware will check specific URLs on the website for the latest and greatest list of indicators, sort of a very typical signature update approach.

This particular list that Xaviya ran into was last updated on January 27th doesn't appear to be actively used at this point because this Rentry.C.O. website also nicely offers a view

counter telling you how often a particular file has been downloaded. And I think the lesson here

to any researchers that are using virtual machines is number one, and that shouldn't be new,

that attackers are trying to recognize them.

And number two, try to stay flexible, adjust your settings ever so often to evade these different evasion techniques.

And if you're using ConnectWise's screen connect in order to remote access desktops, well, it's time for you to update in particular if you're running the on-premise version of the software.

Cloud-based instances are already being taken care of by Connectwise, but on premise you have to update it

to fix two vulnerabilities, one with a CFSS score of 10, and that's an authentication bypass, using

...