Hello and welcome to the Wednesday, June 17th, 2006 edition of the Science Inundate Storm Center's Stormcast. My name is Johannes Ulrich, recording today from Jacksonville, Florida. And this episode is brought you by the sands.edu credit certificate program in cloud security.

One thing we really like is when readers actually send us malware samples.

We love malware samples on our website.

You can actually download malware samples via our contact forum.

And Xavier took a look at a sample we received

yesterday from a user. First of all, this sample arrives as a VHDX file. These are disk images,

so once you download the file, it in Windows will actually typically automatically mount itself and with that

start off some JavaScript. Now the JavaScript has not only obfuscated also the way it starts

the PowerShell strip then that will actually, well, load additional malware, is interesting in

that it goes via WMI. WMI, typically more used

sort of for remote access to other systems. But here using the chain JavaScript,

WMI, and then PowerShell, well, makes this less suspicious to some endpoint protection systems

than going JavaScript to PowerShell directly.

So that's what the attacker is trying to accomplish here. They're trying to further obfuscate,

not just the Malware itself, but also the behavior that is being exhibited by the Malware.

And that, of course, goes straight against some of these more modern endpoint protection

systems. There are a couple more stages, but in the end, the victim ends up with Remco's

rat, good old remote access tool, have talked about this for years, and a virus, end point

protection still appears to be having a hard time with it.

But anyway, the behavior here is quite telling and definitely something that you want to check your endpoint protection systems for to check if they are actually alerting on some of these more obfuscated execution paths.

And there's hardly been a podcast where I haven't talked about some kind of supply chain. more obfuscated execution paths.

And there's hardly been a podcast where I haven't talked about some kind of supply chain issue today a little bit of different perspective of it, and that's, well, more the defensive

...