More Phish

In my last post, we saw attackers carry out a targeted campaign, sending phishing emails with malicious attachments. This article picks up where we left off, briefly looking at the malware attachment, then examining its interesting CnC communication techniques.

A blast from the past: How to protect yourself against SYSENTER/SYSCALL hooks

In my last two blogs I discussed PDF exploits and shell code in general, so this time around I’ll make it a little different.

Experienced Windows programmers (well, Linux can be included as well if you think about it) know that for a few years now Microsoft has been taking advantage of the evolution of microprocessors like Intel and AMD.

A long time ago, when a function was called from user mode, the call would trickle down a system DLL and end up calling a system API. The problem was that the context switch between user mode and kernel mode was too expensive and they needed something more efficient. Enter fast system calls.

Backdoor.ADDNEW (DarkDDoser) and Gh0st, a match made in heaven?

At FireEye we monitor all kinds of attacks: targeted, non-targeted, and everything in between. We always try to figure out, not just how a piece of malicious code works, but also other possibilities, like whether it is related to some other malware, in what way, etc.

Gh0st has been much talked about and there is a lot of good research out there on this RAT (Remote Access Trojan). This RAT has been used in many serious attacks and a quick Google search on the Gh0st RAT will give you a lot of good articles which will go into great detail about the versions and the inner workings of the malware. However this post is not about Gh0st. Very recently while investigating some of these Gh0st infections, we identified another interesting piece of malware.